I recently moved from Fedora to openSUSE and am trying to run a project that worked previously. Individual containers started with docker run can access their files, but the same paths mounted through Docker Compose produce permission errors:
- The auth container cannot open /app/app.py
- The web container gets EACCES when opening /web/package.json
- MongoDB cannot access /data/db or change its ownership
The files and directories exist, and their normal filesystem permissions appear correct. My Compose mounts include:
- ./.mounted/mongo:/data/db
- ./web:/web
- ./apis/auth-dev:/app
- ./config:/app/config
What could cause Compose bind mounts to be denied when the equivalent docker run setup works?
2 Answers
This looks like a mandatory access-control issue rather than ordinary Unix permissions. Check the system security logs while starting the containers; an AppArmor or SELinux denial should be visible there. Since changing SELinux to permissive mode makes the stack work, SELinux is very likely blocking access to the bind-mounted paths.
For SELinux systems, add a relabel option to each bind mount in the Compose file. Use :Z when the mount should be private to one container, or :z when the same host directory must be shared by multiple containers. For example: ./.mounted/mongo:/data/db:Z and ./web:/web:Z. This lets the container access the files without leaving SELinux permanently permissive.
After changing the mount options, recreate the containers so the directories receive the correct labels. Also make sure the host paths are the exact paths being mounted, since relabeling a different copy will not help.
The journal output shown only contains network and sudo messages, so it does not show a denial. Check the security audit logs as well, then restore enforcing mode after testing.