Permission denied errors on ghost image

[shrikrishnaholla]

Ghost tags tried: latest, 0.11.7 (equivalent tags)
Docker version: v17.03.0-ce
OS: macOS
Type: docker-machine

Failing cases

All cases start with an empty directory

$ docker run --rm --name myblog -p 8080:2368 -it -v $(pwd):/var/lib/ghost:rw ghost:latest
mkdir: cannot create directory '/var/lib/ghost/apps/': Permission denied

$ docker run --rm --name myblog -p 8080:2368 -it -v $(pwd):/var/lib/ghost:rw ghost:0.11.7 bash
root@9acbe98bd181:/usr/src/ghost# npm start
npm info it worked if it ends with ok
npm info using npm@2.15.11
npm info using node@v4.8.0
...

> ghost@0.11.7 start /usr/src/ghost
> node index
...


ERROR: SQLITE_CANTOPEN: unable to open database file

 Error: SQLITE_CANTOPEN: unable to open database file
    at Error (native)

npm info poststart ghost@0.11.7
npm info ok

3. [Continued from (2)]. Still empty directory

root@9acbe98bd181:/usr/src/ghost# /entrypoint.sh npm start
mkdir: cannot create directory '/var/lib/ghost/apps/': Permission denied

4. Passing --user. As per Dockerfile, ghost image uses a user called user

$ docker run --rm --name myblog -p 8080:2368 -it --user="user" -v $(pwd):/var/lib/ghost:rw ghost:0.11.7
mkdir: cannot create directory '/var/lib/ghost/apps/': Permission denied

Passing cases

1. Without mounting volumes. Useless, but oh well

$ docker run --rm --name myblog -p 8080:2368 -it ghost:0.11.7
npm info it worked if it ends with ok
...

> ghost@0.11.7 start /usr/src/ghost
> node index
...

Migrations: Creating tables...
...
Migrations: Creating owner
Ghost is running in development...
...
Ctrl+C to shut down

2. [Basically copy-pasting entrypoint.sh]

$ docker run --rm --name myblog -p 8080:2368 -it -v $(pwd):/var/lib/ghost:rw ghost:0.11.7 bash
root@cfe4b0069a1a:/usr/src/ghost# baseDir="$GHOST_SOURCE/content"
root@cfe4b0069a1a:/usr/src/ghost#     for dir in "$baseDir"/*/ "$baseDir"/themes/*/; do
>         targetDir="$GHOST_CONTENT/${dir#$baseDir/}"
>         mkdir -p "$targetDir"
>         if [ -z "$(ls -A "$targetDir")" ]; then
>             tar -c --one-file-system -C "$dir" . | tar xC "$targetDir"
>         fi
>     done
root@cfe4b0069a1a:/usr/src/ghost#
root@cfe4b0069a1a:/usr/src/ghost#     if [ ! -e "$GHOST_CONTENT/config.js" ]; then
>         sed -r '
>             s/127\.0\.0\.1/0.0.0.0/g;
>             s!path.join\(__dirname, (.)/content!path.join(process.env.GHOST_CONTENT, \1!g;
>         ' "$GHOST_SOURCE/config.example.js" > "$GHOST_CONTENT/config.js"
>     fi
root@cfe4b0069a1a:/usr/src/ghost# npm start
npm info it worked if it ends with ok
npm info using npm@2.15.11
npm info using node@v4.8.0
...

> ghost@0.11.7 start /usr/src/ghost
> node index
...
Migrations: Creating tables...
...
Ghost is running in development...
Listening on 0.0.0.0:2368
Url configured as: http://localhost:2368
Ctrl+C to shut down

3. Subsequent runs of (2). All the content folders, themes etc are now in pwd

$ docker run --rm --name myblog -p 8080:2368 -it -v $(pwd):/var/lib/ghost:rw ghost:0.11.7 bash
root@fc4a80a12525:/usr/src/ghost# npm start
npm info it worked if it ends with ok
...

> ghost@0.11.7 start /usr/src/ghost
> node index

WARNING: Ghost is attempting to use a direct method to send email.
...

Ghost is running in development...
...
Ctrl+C to shut down

Note: Running

$ docker run --rm --name myblog -p 8080:2368 -it -v $(pwd):/var/lib/ghost:rw ghost:0.11.7 npm start

(or without any args) instead of (3) doesn't work. I have to run bash and then run npm start

I am at loss for an explanation as to why the cases that work do work, and the cases that don't, don't. This is voodoo stuff.

[yosifkit]

Failing cases:

1. doesn't work on docker-machine/boot2docker since the shared folder from the host is owned by 1000:50 and ghost entrypoint process drops to "user" which is 1001:1001.
2. not quite the same as a default run since things need to be copied like in the entrypoint
3. not sure I see what is different here from 2.
4. that is basically the same as 1, that user still cannot access the shared folder.

Successful:

1. no comment
2. this work because you skip the drop down to "user", but makes node run as root and thus all you files in the shared folder will be root owned.
3. yup, skipping the entrypoint to run as root is one workaround

For boot2docker/docker-machine on OSX (or Windows), you should be able to just run as 1000:50 and everything will be owned properly since the entrypoint script only switches to "user" if the command is npm start and the current user is root.

$ docker run --rm --name myblog -p 8080:2368 -it -v $(pwd):/var/lib/ghost:rw --user 1000:50 ghost:latest

[shrikrishnaholla]

Thank you so much @yosifkit ! That makes sense. You're awesome! 🎉
I'm going to close this as this answers my query