docker config_error ai_generated true

Error response from daemon: error while mounting volume '/host/path': permission denied

ID: docker/volume-bind-mount-permission-denied

Also available as: JSON · Markdown · 中文
82%Fix Rate
88%Confidence
1Evidence
2023-08-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Docker 20.10.22 active — — —
Docker 24.0.6 active — — —
RHEL 8 active — — —
Ubuntu 22.04 active — — —

Root Cause

The host directory or file being bind-mounted has restrictive permissions or SELinux labels that prevent the Docker container from accessing it.

generic

中文

被绑定挂载的主机目录或文件具有限制性权限或 SELinux 标签，阻止 Docker 容器访问。

Official Documentation

https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label

Workarounds

  1. 90% success Add `:Z` or `:z` suffix to the bind mount to relabel SELinux context: `docker run -v /host/path:/container/path:Z myimage` 
    Add `:Z` or `:z` suffix to the bind mount to relabel SELinux context: `docker run -v /host/path:/container/path:Z myimage`
  2. 80% success Ensure the host directory has at least 755 permissions (`chmod 755 /host/path`) and the Docker daemon has read access. Then retry the mount. 
    Ensure the host directory has at least 755 permissions (`chmod 755 /host/path`) and the Docker daemon has read access. Then retry the mount.

中文步骤

  1. Add `:Z` or `:z` suffix to the bind mount to relabel SELinux context: `docker run -v /host/path:/container/path:Z myimage`
  2. Ensure the host directory has at least 755 permissions (`chmod 755 /host/path`) and the Docker daemon has read access. Then retry the mount.

Dead Ends

Common approaches that don't work:

  1. 85% fail

    Even root inside the container may not bypass host SELinux or AppArmor policies; the mount itself is denied at the daemon level.

  2. 75% fail

    The permission denied error occurs before the container process runs; it's a mount-time check, not a runtime access issue.