nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)

Question

I am currently running into a problem trying to set up a new user rather than using root in my docker file. The image builds fine, however when I run the container I get the following error:

nginx: [emerg] mkdir() "/var/lib/nginx/tmp/client_body" failed (13: Permission denied)

Below is my dockerfile. I am using redhat UBi image build my dockerfile :

USER root
RUN microdnf --setopt=tsflags=nodocs install -y nginx procps shadow-utils net-tools ca-certificates dirmngr gnupg wget vim\
            && microdnf clean all \
            && rpm -q procps-ng

ENV NGINX_USER="api-gatway" \
    NGINXR_UID="8987" \
    NGINX_GROUP="api-gatway" \
    NGINX_GID="8987"     

RUN set -ex; \
  groupadd -r --gid "$NGINX_GID" "$NGINX_GROUP"; \
  useradd -r --uid "$NGINXR_UID" --gid "$NGINX_GID" "$NGINX_USER" 


COPY nginx.conf /etc/nginx/nginx.conf


#To start up NGINX 
EXPOSE 80
RUN mkdir -p /var/lib/nginx/
RUN mkdir -p /var/log/nginx/

RUN mkdir -p /var/lib/nginx/tmp/


RUN chmod 755  api-gatway:api-gatway /var/lib/nginx/
RUN chmod 755  api-gatway:api-gatway /var/log/nginx/

EXPOSE 80
USER api-gatway
CMD ["nginx", "-g", "daemon off;"]

Any ideas why this is still not working?

Answer 1

There are different issues in this image:

• chmod is used incorrectly
• no chown is present
• you plan to use a privileged port (80) with a non-root user

IMO this Dockerfile portion should fix part of your troubles:

RUN mkdir -p /var/lib/nginx/tmp /var/log/nginx \
    && chown -R api-gatway:api-gatway /var/lib/nginx /var/log/nginx \
    && chmod -R 755 /var/lib/nginx /var/log/nginx

EXPOSE 1080
USER api-gatway
CMD ["nginx", "-g", "daemon off;"]

Remember to change the port in the nginx configuration as well.

Last but not least, I think you're trying to map the a folder to /var/lib/nginx/tmp/client_body since I don't see any content being copied in the image. In this case, you have to make sure that the folder on the host can be read by the user in the docker container.

Personal opinion: you're better off with the official nginx docker image.