Docker ADD and COPY leave files owned by root by default

By trial and error I worked this out while building a container running Weblogic Portal 10.3.6 (see my Dockerfiles in the 10.3.6updates branch of my fork of oracle/docker: https://github.com/kevinhooke/weblogic-docker/tree/10.3.6updates).

Even if you do a ‘USER oracle’ followed by a COPY or ADD, the files transferred into the image are still owned by root. This was causing me issues as the WLST script could not read the files owned by root (as you’d expect).

This issue and the justification is described in issue 6119. It doesn’t seem that this will be fixed, it seems like it’s ‘working as designed’.

Docker and docker-machine usage notes

I’ve been playing on and off with Docker but not frequently enough to remember what I did last time, so here’s a few random unstructured notes (running on Mac OS X):

docker ps : list running containers (this shows a container id which is used in most other commands)

docker ps -a : show all containers including those that are stopped

If you see this:

Get http:///var/run/docker.sock/v1.20/containers/json: dial unix /var/run/docker.sock: no such file or directory.
* Are you trying to connect to a TLS-enabled daemon without TLS?
* Is your docker daemon up and running?

Then your docker-machine is not running.

Start it up with:

docker-machine start default

After starting, run this to set env vars:

eval "$(docker-machine env default)"

Also see this post, and recommendation to use ‘Docker Quickstart Terminal’ on Mac.

Managing containers and images:

docker images : list created images

docker rm containerid : delete a container

docker rmi imageid : delete an image

Create a new container from an image, in interactive mode, grab the tty, and execute bash in the container (get a command line into the container):

docker run -it imageid bash

Run as background daemon: -d

To start a shell into a running container:

docker exec -it containerid sh (or bash)

Stop a running container:

docker stop containerid

To get the IP address of a container:

docker inspect containername | grep IPAddress

Accessing a container from the host

Each running container has it’s own IP address. When a container restarts, it gets a new IP. To access a container running in a docker-machine, find the IP of the docker-machine vm:

docker-machine ls

.. this will list the IP for the VM.

When creating a new container, forward the port in the container to the host with -p, for example for a Weblogic server:

docker run -d –expose:7001 -p 7001:7001 –name=containername imagename

Setting a root password for a Docker image created with USER

If you have a Docker image created with a non-root user using USER in your Dockerfile, but you need to su to root to install or update something owned by root, without setting a root password you won’t be able to su to root.

Instead, add a password for root in your Dockerfile (this is described here):

RUN echo "root:Docker!" | chpasswd

This is probably not a good idea for security reasons (especially if you are sharing your Dockerfile), but I needed to create something in a container to reuse when creating other new containers, so did this one-time to get the file I needed and then reused the file in containers with another image without the root user/password.