Docker · infra · fg-0266

Non-root container gets 'Permission denied' writing to a mounted volume

EACCES: permission denied, open '/data/app.db'

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

A new named volume takes the owner of the directory at that path in the image, so a path missing from the image, or left owned by root, gives a root-owned volume. Bind mounts keep the host's numeric owner and Docker does not remap it.

Fix

Create and chown the mount path in the Dockerfile before switching USER, then remove the old volume so it is recreated with the new owner. For bind mounts, run the container with the UID that owns the host directory.

Apply

RUN mkdir -p /data && chown -R node:node /data
USER node
# existing volume keeps old ownership: docker volume rm <name> and start again

Affects: Docker Engine local volume driver and bind mounts, as of October 2026

Sources

https://github.com/moby/moby/issues/2259
https://docs.docker.com/engine/storage/volumes/

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp