Change umask in Docker containers

Problem

You’re mounting volumes into Docker containers and running into permission issues while accessing volume from other Docker containers.

$ docker version
Client: Docker Engine - Community
 Version:           19.03.5
 API version:       1.40
 Go version:        go1.12.12
 Git commit:        633a0ea
 Built:             Wed Nov 13 07:22:34 2019
 OS/Arch:           darwin/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.5
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.12.12
  Git commit:       633a0ea
  Built:            Wed Nov 13 07:29:19 2019
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          v1.2.10
  GitCommit:        b34a5c8af56e510852c35414db4c1f4fa6172339
 runc:
  Version:          1.0.0-rc8+dev
  GitCommit:        3e425f80a8c931f88e6d94a8c831b9d5aa481657
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

umask

umask is set to 0022 on most linux sytems by default. This umask allows group and others to read but not write your files, see below:

$ umask 0022
$ touch a-file
$ ls -l
-rw-r--r--  1 daniel  staff     0 25 Jan 19:13 a-file

In computing, umask is a command that determines the settings of a mask that controls how file permissions are set for newly created files.

Docker containers do not share user uids so this may be an issue, if you want to write into this files from another docker container. By setting umask to 0000 new files are created with another permission mask, so group and others may write into these new files, see below:

$ umask 0000
$ touch another-file
$ ls -l
-rw-r--r--  1 daniel  staff     0 25 Jan 19:13 a-file
-rw-rw-rw-  1 daniel  staff     0 25 Jan 19:14 another-file

Dockerfile

To set umask for a Docker container you have to setup an entrypoint script for your image. This script will be executed once your container gets started:

FROM ubuntu:14.04
COPY ./docker-entrypoint.sh /
ENTRYPOINT ["/docker-entrypoint.sh"]

The entrypoint script has to be part of the docker image:

#!/bin/bash
umask 0000
/bin/bash

Included in gitlab-runner

If you used automated testing in GitLab with gitlab-runner < v1.0 you ran into the umask issue. After my merge request was merged this is no issue any more, because repository is cloned with umask 0000 now.