Skip to content

Conversation

mrjones-plip
Copy link

Description

When implementing the advice on the best practice page, I was struggling to get my code to execute. After some debugging I realized that the node user did not have enough permissions to access my files.

Motivation and Context

We should include explicit advice to easily give node user access to the files which most users will do via a COPY command in their Dockerfile. If they're doing it via a bind mount, the same advice will get them thinking about file permissions.

Testing Details

As this is a docs change, no code tests are done, but I did confirm that the advice I'm adding does indeed work.

Note - I didn't run any of the tests (All new and existing tests passed) as I'm just making an edit to an .md file.

Example Output(if appropriate)

Types of changes

  • Documentation
  • Version change (Update, remove or add more Node.js versions)
  • Variant change (Update, remove or add more variants, or versions of variants)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Other (none of the above)

Checklist

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING.md document.
  • All new and existing tests passed.

Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Updates the Best Practices documentation to include guidance on file permissions when using the non-root node user. This addresses a common issue where users switching from root to the node user encounter permission problems accessing copied files.

  • Adds explicit advice about using chown and chmod flags with COPY commands
  • Provides a practical example showing how to set appropriate permissions for the 1000 user
  • Helps users avoid permission-related issues when implementing the non-root user best practice

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Also note that if your image was running as the default `root` user and you're now using user `1000`, you may need to update your `COPY` commands so that the files are fully accessible to the `1000` user. You can use the `chown` and `chmod` flags as seen here for the `node_modules` directory. The call ensures `root` remains the owner, but that the `1000` user can safely read (but not write) the files:

```Dockerfile
COPY --chown=root:root --chmod=755 ./node_modules ./node_modules
Copy link

Copilot AI Oct 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The example shows setting ownership to root:root but the explanation states this is for the 1000 user to access files. This is contradictory - if the goal is to give the 1000 user access, the ownership should be --chown=1000:1000 or --chown=node:node, not root:root. Additionally, 755 permissions on node_modules may be overly permissive as it grants execute permissions to all users.

Suggested change
COPY --chown=root:root --chmod=755 ./node_modules ./node_modules
COPY --chown=1000:1000 --chmod=755 ./node_modules ./node_modules

Copilot uses AI. Check for mistakes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant