Arch Linux

zerophase

Member

Registered: 2015-09-03

Posts: 239

Building Docker image fails from security permissions.

I'm trying to a build a docker image that calls apt-get during the build step. Only issue is when I run,

docker build - < Dockerfile

I receive:

E: Could not open lock file /var/lib/apt/lists/lock - open (13: Permission denied)

I still receive that error if I add my user to the Docker group. I'm guessing

/var/lib/docker/overlay2/[cointainer string]

is where apt-get is pulling files to.

Is there any reason

/var/lib/docker

is not included in the Docker group by default? Just adding that folder to the docker group should fix my issue right?

Last edited by zerophase (2022-04-19 19:32:43)

tucuxi

Member

From: Switzerland

Registered: 2020-03-08

Posts: 291

Re: Building Docker image fails from security permissions.

Are you running the docker daemon as non-root?

zerophase

Member

Registered: 2015-09-03

Posts: 239

Re: Building Docker image fails from security permissions.

Should be running as root. This is the service file. The default User equals root, right?

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target docker.socket firewalld.service
Wants=network-online.target
Requires=docker.socket

[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
ExecStart=/usr/bin/dockerd -H fd://
ExecReload=/bin/kill -s HUP $MAINPID
LimitNOFILE=1048576
# Having non-zero Limit*s causes performance problems due to accounting overhead
# in the kernel. We recommend using cgroups to do container-local accounting.
LimitNPROC=infinity
LimitCORE=infinity
# Uncomment TasksMax if your systemd version supports it.
# Only systemd 226 and above support this version.
#TasksMax=infinity
TimeoutStartSec=0
# set delegate yes so that systemd does not reset the cgroups of docker containers
Delegate=yes
# kill only the docker process, not all processes in the cgroup
KillMode=process
# restart the docker process if it exits prematurely
Restart=on-failure
StartLimitBurst=3
StartLimitInterval=60s

[Install]
WantedBy=multi-user.target

tucuxi

Member

From: Switzerland

Registered: 2020-03-08

Posts: 291

Re: Building Docker image fails from security permissions.

Yes, unless you made an effort to set it up rootless, dockerd runs as root. Check if the uid is 0:

ps -l $(pgrep dockerd)

What does the Dockerfile that causes the error look like?

zerophase

Member

Registered: 2015-09-03

Posts: 239

Re: Building Docker image fails from security permissions.

UID is 0.

Docker file looks like: https://pastebin.com/4KkyhMDe