How do I Docker COPY as non root?

docker dockerfile
FGreg picture FGreg · Jun 26, 2017 · Viewed 53.4k times · Source

While building a Docker image, how do I COPY a file into the image so that the resulting file is owned by a user other than root?

Answer

FGreg picture FGreg · Jun 26, 2017

For versions v17.09.0-ce and newer

Use the optional flag --chown=<user>:<group> with either the ADD or COPY commands.

For example

COPY --chown=<user>:<group> <hostPath> <containerPath>

The documentation for the --chown flag is now live on the main Dockerfile Reference page.

Issue 34263 has been merged and is available in release v17.09.0-ce.

For versions older than v17.09.0-ce

Docker doesn't support COPY as a user other than root. You need to chown / chmod the file after the COPY command.

Example Dockerfile:

from centos:6
RUN groupadd -r myuser && adduser -r -g myuser myuser
USER myuser
#Install code, configure application, etc...
USER root
COPY run-my-app.sh /usr/local/bin/run-my-app.sh
RUN chown myuser:myuser /usr/local/bin/run-my-app.sh && \
    chmod 744 /usr/local/bin/run-my-app.sh
USER myuser
ENTRYPOINT ["/usr/local/bin/run-my-app.sh"]

Previous to v17.09.0-ce, the Dockerfile Reference for the COPY command said:

All new files and directories are created with a UID and GID of 0.

History This feature has been tracked through multiple GitHub issues: 6119, 9943, 13600, 27303, 28499, Issue 30110.

Issue 34263 is the issue that implemented the optional flag functionality and Issue 467 updated the documentation.

Related questions

How do I pass environment variables to Docker containers?

I'm new to Docker, and it's unclear how to access an external database from a container. Is the best way to hard-code in the connection string? # Dockerfile ENV DATABASE_URL amazon:rds/connection?string

Read More
What is the difference between the 'COPY' and 'ADD' commands in a Dockerfile?

What is the difference between the COPY and ADD commands in a Dockerfile, and when would I use one over the other? COPY <src> <dest> The COPY instruction will copy new files from <src> …

Read More
How to set image name in Dockerfile?

You can set image name when building a custom image, like this: docker build -t dude/man:v2 . # Will be named dude/man:v2 Is there a way to define the name of the image in Dockerfile, so I don't …

Read More