No access permission error with npm global install on docker image

Question

I'm trying to build a docker image with a global install of firebase-tools and angular-cli. I'm building the same image for two versions of node: 6.x (LTS boron) and v8.x (latest alpine). Locally, both images build fine, but when I try to build in docker hub only the v6.x builds successfully. With the v8.x it gets trapped in the access permissions for undefined and nobody user. I'm already using the root user (USER root), since without this setting (or using USER node) both images fail to build.

This is my Dockerfile:

FROM node:latest  USER root  RUN npm install --quiet --no-progress -g @angular/cli@latest firebase-tools RUN npm cache clean --force 

And this is the output:

Step 4/5 : RUN npm install --quiet --no-progress -g @angular/cli@latest firebase-tools   ---> Running in fce3da11b04e   npm WARN deprecated [email protected]: Use uuid module instead  /usr/local/bin/firebase -> /usr/local/lib/node_modules/firebase-tools/bin/firebase  /usr/local/bin/ng -> /usr/local/lib/node_modules/@angular/cli/bin/ng  > [email protected] install /usr/local/lib/node_modules/@angular/cli/node_modules/node-sass > node scripts/install.js  Unable to save binary /usr/local/lib/node_modules/@angular/cli/node_modules/node-sass/vendor/linux-x64-57 : { Error: EACCES: permission denied, mkdir '/usr/local/lib/node_modules/@angular/cli/node_modules/node-sass/vendor'   at Object.fs.mkdirSync (fs.js:890:18)   at sync (/usr/local/lib/node_modules/@angular/cli/node_modules/mkdirp/index.js:71:13)   at Function.sync (/usr/local/lib/node_modules/@angular/cli/node_modules/mkdirp/index.js:77:24)   at checkAndDownloadBinary (/usr/local/lib/node_modules/@angular/cli/node_modules/node-sass/scripts/install.js:111:11)   at Object.<anonymous> (/usr/local/lib/node_modules/@angular/cli/node_modules/node-sass/scripts/install.js:154:1)   at Module._compile (module.js:569:30)   at Object.Module._extensions..js (module.js:580:10)   at Module.load (module.js:503:32)   at tryModuleLoad (module.js:466:12)   at Function.Module._load (module.js:458:3)  errno: -13, code: 'EACCES', syscall: 'mkdir', path: '/usr/local/lib/node_modules/@angular/cli/node_modules/node-sass/vendor' }  > [email protected] install /usr/local/lib/node_modules/firebase-tools/node_modules/grpc > node-pre-gyp install --fallback-to-build --library=static_library node-pre-gyp ERR! Tried to download(undefined): https://storage.googleapis.com/grpc-precompiled-binaries/node/grpc/v1.3.8/node-v57-linux-x64.tar.gz node-pre-gyp ERR! Pre-built binaries not found for [email protected] and [email protected] (node-v57 ABI) (falling back to source compile with node-gyp) gyp WARN EACCES user "undefined" does not have permission to access the dev dir "/root/.node-gyp/8.1.2" gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp" gyp WARN EACCES user "nobody" does not have permission to access the dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp/8.1.2" gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp" gyp WARN EACCES user "nobody" does not have permission to access the dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp/8.1.2" gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp" gyp WARN EACCES user "nobody" does not have permission to access the dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp/8.1.2" gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp" gyp WARN EACCES user "nobody" does not have permission to access the dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp/8.1.2" gyp WARN EACCES attempting to reinstall using temporary dev dir "/usr/local/lib/node_modules/firebase-tools/node_modules/grpc/.node-gyp" (infinite loop) 

Answer 1

Use the --unsafe-perm flag:

npm install --quiet --no-progress --unsafe-perm -g @angular/cli@latest firebase-tools 

I think that's still better than setting the npm user permanently to root. You can use --unsafe-perm only with the packages which cause problem

Answer 2

The problem is because while NPM runs globally installed module scripts as the nobody user, which kinds of makes sense, recent versions of NPM started setting the file permissions for node modules to root. As a result module scripts are no longer allowed to create files and directories in their module.

See discussion in NPM issue #3849, for some references.

A simple workaround, which makes sense in a docker environment, is to set the NPM default global user back to root, like so:

npm -g config set user root 

After which you shouldn't have any more EACCES errors.