Container exits with permission denied error

Oct 13, 2025 by wbrum.org 37 views

🐛 Bug Report: Scripts inside /app/scripts/docker are non-executable

In this article, we will be discussing a bug report related to scripts inside the /app/scripts/docker directory being non-executable. This issue has been encountered while working with Docker containers, specifically with the Pocket-ID v0.39.0 and Podman v5.4.0. We will delve into the reproduction steps, expected behavior, actual behavior, and log output to understand the problem and its implications.

To reproduce this issue, follow these steps:

Launch container as user: Launch the container with a specific user ID, for example, 1001:1001.
Change entrypoint: Modify the entrypoint to /app/scripts/docker/entrypoint.sh.
Container exits with permission denied error: The container will exit with a permission denied error.

The expected behavior is that the container should start up successfully.

However, the actual behavior is that the container exits with a /bin/sh: /app/scripts/docker/entrypoint.sh: Permission denied error.

The versions and environment used to reproduce this issue are:

Podman: v5.4.0 (Quadlet)
Pocket-ID: v0.39.0
User: set to 1001:1001
Exec: /bin/sh -c /app/scripts/docker/entrypoint.sh

The log output from the container is as follows:

mar 12 20:57:04 systemd[694]: Starting POCKETID.service - PocketID - OIDC...
(...)
mar 12 20:57:05 systemd[694]: Started POCKETID.service - PocketID.
(...)
mar 12 20:57:05 pocket-id[1077427]: /bin/sh: /app/scripts/docker/entrypoint.sh: Permission denied
(...)
mar 12 20:57:05 systemd[694]: POCKETID.service: Main process exited, code=exited, status=126/n/a

The issue is caused by the scripts inside the /app/scripts/docker directory not being executable. This is despite the fact that the Dockerfile contains a command to make the scripts executable using chmod +x /scripts/*.sh. However, this command only affects one of the scripts, which is the token generation one.

To resolve this issue, we can use a workaround by mounting the entrypoint script over /sbin/su-exec. This will allow the script to be executed successfully.

However, this workaround is not ideal, as it uses su-exec under the hood. A better solution would be to modify the Dockerfile to make all the scripts inside the /app/scripts/docker directory executable.

In conclusion, the issue of scripts inside the /app/scripts/docker directory being non-executable is a bug that needs to be addressed. The workaround of mounting the entrypoint script over /sbin/su-exec is not ideal, and a better solution would be to modify the Dockerfile to make all the scripts executable. This will ensure that the container starts up successfully and the scripts are executed as expected.

Based on the analysis and solution, we recommend the following:

Modify the Dockerfile: Modify the Dockerfile to make all the scripts inside the /app/scripts/docker directory executable using chmod +x /scripts/*.sh.
Use a better workaround: Instead of using su-exec under the hood, use a better workaround that does not involve modifying the entrypoint script.
Test the container: Test the container with the modified Dockerfile and the better workaround to ensure that it starts up successfully and the scripts are executed as expected.

By following these recommendations, we can resolve the issue of scripts inside the /app/scripts/docker directory being non-executable and ensure that the container starts up successfully.
🐛 Bug Report: Scripts inside /app/scripts/docker are non-executable - Q&A

In our previous article, we discussed a bug report related to scripts inside the /app/scripts/docker directory being non-executable. We analyzed the issue, provided a solution, and made recommendations to resolve the problem. In this article, we will answer some frequently asked questions (FAQs) related to this issue.

A: The cause of the issue is that the scripts inside the /app/scripts/docker directory are not executable. This is despite the fact that the Dockerfile contains a command to make the scripts executable using chmod +x /scripts/*.sh. However, this command only affects one of the scripts, which is the token generation one.

A: The chmod +x command is not working because it only affects the scripts in the /scripts directory, not the scripts in the /app/scripts/docker directory.

A: The workaround to resolve the issue is to mount the entrypoint script over /sbin/su-exec. This will allow the script to be executed successfully.

A: No, the workaround is not ideal because it uses su-exec under the hood. A better solution would be to modify the Dockerfile to make all the scripts inside the /app/scripts/docker directory executable.

A: To modify the Dockerfile to make all the scripts executable, you can use the following command:

RUN chmod +x /app/scripts/docker/*.sh

This will make all the scripts inside the /app/scripts/docker directory executable.

A: The benefits of modifying the Dockerfile are:

The container will start up successfully.
The scripts will be executed as expected.
The workaround of mounting the entrypoint script over /sbin/su-exec is not needed.

A: To test the container with the modified Dockerfile, you can use the following command:

docker run -it --rm -v /app/scripts/docker:/app/scripts/docker:ro <image_name>

This will run the container with the modified Dockerfile and test the scripts.

In conclusion, the issue of scripts inside the /app/scripts/docker directory being non-executable is a bug that needs to be addressed. By modifying the Dockerfile to make all the scripts executable, we can resolve the issue and ensure that the container starts up successfully and the scripts are executed as expected.

Based on the analysis and solution, we recommend the following:

Modify the Dockerfile to make all the scripts inside the /app/scripts/docker directory executable.
Test the container with the modified Dockerfile to ensure that it starts up successfully and the scripts are executed as expected.
Use the modified Dockerfile in production to resolve the issue.