"permission denied" when running `docker compose up -d --build` (Golang microserivces)

Question

I am trying to run docker compose up -d --build an exisiting successfully built project (by docker-compose build), namely DeathStarBench which is a system for running multiple microservices to interact with each other (can be found in this Github repository). The following code shows the content of Dockerfile:

FROM golang:1.21 as builder

WORKDIR /workspace

COPY go.sum go.sum
COPY go.mod go.mod
COPY vendor/ vendor/

COPY cmd/ cmd/
COPY dialer/ dialer/
COPY registry/ registry/
COPY services/ services/
COPY tls/ tls/
COPY tracing/ tracing/
COPY tune/ tune/

COPY config.json config.json

RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go install -ldflags="-s -w" -mod=vendor ./cmd/...

Moreover, in the docker-compose.yaml, for each microservice in this repository, there is a record to determine its entrypoints and one record for its corresponding volume. For example, for recommendation microservice, we have the following records in the docker-compose.yaml file:

  # <other services configuration> 

  recommendation:
    configs:
      - source: server_config
        target: /config.json
    environment:
      - TLS
      - GC
      - JAEGER_SAMPLE_RATIO
      - LOG_LEVEL
    build: .
    image: deathstarbench/hotel-reservation:latest
    entrypoint: ./cmd/recommendation
    depends_on:
      - mongodb-recommendation
      - consul
    restart: always
    deploy:
      replicas: 1
      restart_policy:
        condition: any
  
  # ...

  volumes:
    # ...

    recommendation:

    # ...
  configs:
    server_config:
      file: ./config.json

For each service listed in cmd folder, the entry point in yaml file has been set to: entrypoint: ./cmd/<name of the service>, .e.g., for recommendation service it is entrypoint: ./cmd/recommendation. It seems that the entry points are correct here.

The running platform is Ubuntu 22.04 and Docker version 26.1.1, build 4cf5afa. Note that services are all in Golang.

When running docker compose up -d --build get the following error:

Error response from daemon: failed to create task for container: 
failed to create shim task: OCI runtime create failed: 
runc create failed: unable to start container process: 
exec: "./cmd/recommendation": is a directory: unknown: permission denied

Each time the name of the failed service can change (here is recommendation microservice).

To resolve the problem I have tried the following ways, but exactly get the same error.

Unsuccessful Trials

1. Give full permission to all services in ./cmd (from this post in Stackoverflow)

Like the following change:

# <remaining code in Dockerfile>

USER root
RUN chmod -R 777 ./cmd/*

RUN CGO_ENABLED=0 GOOS=linux GO111MODULE=on go install -ldflags="-s -w" -mod=vendor ./cmd/...

RUN chmod -R 777 ./cmd/*

Maybe part of the changes was enough, but the whole set of chnages was not successul, including USER root or changing permissions before and after RUN command (it should be after COPY by the way that it is).

Note: As David mentioned in comments: "chmod 0777 disables basic security controls and is never a best practice".

2. Running the command with sudo:

After applying the changes mentioned in trial #1, run the docker compose up using sudo command. Yet, the same problem exists.

3. Add current user to the docker group (as suggested in this post)

After adding the current user to a docker group, I get the same error again (I have also rebooted the system after adding the user to the group).

4. Changed permission of docker sockets (as suggested in this post)

Change the permission of the docker sockets using the following command before running the docker compose up:

sudo chmod 666 /var/run/docker.sock

Question

Now the question is how to approach to resolve the problem. Is there any problem with running the trials?

Answer 1

In your source tree, /workspace/cmd/recommendation is the directory containing your Go source files. You're trying to set that directory as the image's entrypoint override, and that won't work; it needs to be a command.

You're using go install to compile all of the embedded commands at once. That puts the packages in $GOPATH/bin or $HOME/go/bin. The golang Dockerfile sets $GOPATH to /go and adds it to the front of $PATH, so you should be able to directly run these go installed commands in your Compose file, without specifying any sort of path

services:
  recommendation:
    build: .
    command: recommendation