Fix "permission denied" on a Bind Mount

A container that runs as a normal user tries to write to a mounted folder and gets "Permission denied". The container is fine. The folder belongs to somebody else, usually root. This page reproduces the error, shows how to read it and gives the fixes in the order I try them.

Reproduce it

On Windows, a folder from your own disk is shown to the container as open to everybody, so this error rarely appears there. It appears on Linux, in CI, and on a server. To get the Linux behaviour on Windows, bind-mount a path that lives inside Docker's own Linux environment. A path starting with /tmp does that. It is not your Windows C:\tmp.

docker run --rm -v /tmp/perm-bind:/data alpine:3.24 stat -c "%A %u:%g %n" /data
docker run --rm --user 1000:1000 -v /tmp/perm-bind:/data alpine:3.24 sh -c "echo saved > /data/note.txt"

drwxr-xr-x 0:0 /data
sh: can't create /data/note.txt: Permission denied

The first line is the clue. The folder is owned by user and group 0:0, which is root, and the mode drwxr-xr-x lets only the owner write. The program runs as 1000:1000, so it can read the folder and cannot write to it. Docker created the missing folder as root.

Fix 1: give the folder to the container's user

Find out which user the container runs as, then change the owner to match. A throwaway root container can do the chown, so you do not need to be root on the host.

docker run --rm -v /tmp/perm-bind:/data alpine:3.24 chown 1000:1000 /data
docker run --rm --user 1000:1000 -v /tmp/perm-bind:/data alpine:3.24 sh -c "echo saved > /data/note.txt && stat -c '%u:%g %n' /data/note.txt"

1000:1000 /data/note.txt

On a real Linux computer the equivalent is sudo chown 1000:1000 ./folder. I ran this version inside Docker Desktop's Linux environment, not on a separate Linux computer.

Fix 2: run the container as your own user

When the folder is yours, make the container match you. On Linux, docker run --user "$(id -u):$(id -g)" does that, and in Compose it is user: "1000:1000" with your own numbers. Files the container creates are then yours, and you can edit and delete them without sudo.

docker run --rm -v /tmp/perm-bind:/data alpine:3.24 chown 4242:4242 /data
docker run --rm --user 4242:4242 -v /tmp/perm-bind:/data alpine:3.24 sh -c "echo saved > /data/mine.txt && stat -c '%u:%g %n' /data/mine.txt"

4242:4242 /data/mine.txt

I used 4242 here to show that the number only has to match the folder. Use the real numbers of the user who owns the folder.

If the message is different

• "Read-only file system" is not an ownership problem. The mount has :ro at the end. Remove it, or write somewhere else.
• "Permission denied" on a Linux server with SELinux (Fedora, RHEL) can come from a security label on the folder, and then the owner is not the cause. Docker's documentation adds :z to the mount for this. I could not run that case, so check it against the documentation for your system.

Clean up

docker run --rm -v /tmp:/t alpine:3.24 rm -rf /t/perm-bind

Never "fix" this with chmod 777 or by running the app as root. Those make the error disappear and leave a hole behind. Pick the user on purpose and match the folder to it.

Related course: Docker Intermediate.