Update Best Practices to include note about chown on COPY#2271
Update Best Practices to include note about chown on COPY#2271mrjones-plip wants to merge 2 commits intonodejs:mainfrom
Conversation
There was a problem hiding this comment.
Pull Request Overview
Updates the Best Practices documentation to include guidance on file permissions when using the non-root node user. This addresses a common issue where users switching from root to the node user encounter permission problems accessing copied files.
- Adds explicit advice about using
chownandchmodflags withCOPYcommands - Provides a practical example showing how to set appropriate permissions for the
1000user - Helps users avoid permission-related issues when implementing the non-root user best practice
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| Also note that if your image was running as the default `root` user and you're now using user `1000`, you may need to update your `COPY` commands so that the files are fully accessible to the `1000` user. You can use the `chown` and `chmod` flags as seen here for the `node_modules` directory. The call ensures `root` remains the owner, but that the `1000` user can safely read (but not write) the files: | ||
|
|
||
| ```Dockerfile | ||
| COPY --chown=root:root --chmod=755 ./node_modules ./node_modules |
There was a problem hiding this comment.
The example shows setting ownership to root:root but the explanation states this is for the 1000 user to access files. This is contradictory - if the goal is to give the 1000 user access, the ownership should be --chown=1000:1000 or --chown=node:node, not root:root. Additionally, 755 permissions on node_modules may be overly permissive as it grants execute permissions to all users.
| COPY --chown=root:root --chmod=755 ./node_modules ./node_modules | |
| COPY --chown=1000:1000 --chmod=755 ./node_modules ./node_modules |
Description
When implementing the advice on the best practice page, I was struggling to get my code to execute. After some debugging I realized that the
nodeuser did not have enough permissions to access my files.Motivation and Context
We should include explicit advice to easily give
nodeuser access to the files which most users will do via aCOPYcommand in their Dockerfile. If they're doing it via a bind mount, the same advice will get them thinking about file permissions.Testing Details
As this is a docs change, no code tests are done, but I did confirm that the advice I'm adding does indeed work.
Note - I didn't run any of the tests (All new and existing tests passed) as I'm just making an edit to an
.mdfile.Example Output(if appropriate)
Types of changes
Checklist