title: Permission issues with Apache inside Docker
body: <p>I'm using Docker to run an Apache instance. My docker file goes something like this:</p>
  
  <pre><code>FROM ubuntu
  
  MAINTAINER your.face@gmail.com
  
  RUN cat /etc/passwd
  RUN cat /etc/group
  
  RUN apt-get update &amp;&amp; apt-get install -yq apache2 php5 libapache2-mod-php5 php5-mysql
  RUN apt-get install -yq openssh-server
  RUN mkdir /var/run/sshd
  
  ENV APACHE_RUN_USER www-data
  ENV APACHE_RUN_GROUP www-data
  ENV APACHE_LOG_DIR /var/log/apache2
  
  EXPOSE 80
  
  ADD config/apache2/000-default.conf /etc/apache2/sites-available/000-default.conf
  ADD config/php5/php.ini /etc/php5/apache2/php.ini
  ADD config/start.sh /tmp/start.sh
  ADD src /var/www
  
  RUN chown -R root:www-data /var/www
  RUN chmod u+rwx,g+rx,o+rx /var/www
  RUN find /var/www -type d -exec chmod u+rwx,g+rx,o+rx {} +
  RUN find /var/www -type f -exec chmod u+rw,g+rw,o+r {} +
  
  #essentially: CMD ["/usr/sbin/apache2ctl", "-D", "FOREGROUND"]
  CMD ["/tmp/start.sh"]
  </code></pre>
  
  <p>However, when I build the container and run it, I only ever get 403 errors.</p>
  
  <p>Notice that I've specified that Apache should run as <code>www-data</code> in <code>www-data</code> group, and that /var/www has been recursively <code>chown</code>d to belong to <code>root:www-data</code>.</p>
  
  <p>Also, all directories are searchable and readable, and all files are readable and writeable by the www-data group (well, according to ls -la and namei -m they are anyways).</p>
  
  <p>How do I fix these permissions issues? I cant figure it out.</p>
  
  <p>Actual error from the Apache error.log:</p>
  
  <pre><code>[Fri May 23 18:33:27.663087 2014] [core:error] [pid 14] (13)Permission denied: [client 11.11.11.11:61689] AH00035: access to /index.php denied (filesystem path '/var/www/index.php') because search permissions are missing on a component of the path
  </code></pre>
  
  <p><strong><em>EDIT</em></strong>:</p>
  
  <p>output of <code>ls -laR /var/www</code> at the end of the Dockerfile:</p>
  
  <pre><code>Step 21 : RUN ls -laR /var/www
   ---&gt; Running in 74fd3609dfc8
  /var/www:
  total 1036
  drwxr-xr-x 67 root www-data  4096 May 23 18:38 .
  drwxr-xr-x 26 root root      4096 May 23 18:38 ..
  -rw-rw-r--  1 root www-data    28 May 23 12:22 .gitignore
  -rw-rw-r--  1 root www-data   501 May 23 12:22 .htaccess
  -rw-rw-r--  1 root www-data  7566 May 23 12:22 index.php
  </code></pre>
  
  <p>Output of <code>namei -m /var/www/index.php</code> at the end of the Dockerfile:</p>
  
  <pre><code>Step 22 : RUN namei -m /var/www/index.php
   ---&gt; Running in 1203f0353090
  f: /var/www/index.php
   drwxr-xr-x /
   drwxr-xr-x var
   drwxr-xr-x www
   -rw-rw-r-- index.php
  </code></pre>
  
  <p><strong><em>EDIT2</em></strong></p>
  
  <p>After trying a whole bunch of things, including <code>chmod -R 777</code> just to see if I could get <em>anything</em> to work, I tried putting the source files added from the Dockerfile into <code>/var/www/html</code>, the default location for Apache files to be served.</p>
  
  <p>I matched the default file permissions exactly (I think), and it still isn't working. The default index.html that comes with Apache loads just fine, but the added <code>src</code> folder still have a <code>403</code> access denied error.</p>
  
  <p>I changed the Dockerfile to <code>ADD src /var/www/html/src</code> and the permissions were set using:</p>
  
  <pre><code>RUN find /var/www/html -type d -exec chmod u+rwx,g+rx,o+rx {} +
  RUN find /var/www/html -type f -exec chmod u+rw,g+r,o+r {} +
  </code></pre>
  
  <p>No luck. Below is some of the output of <code>ls -laR</code> on <code>/var/www</code>. Notice that the permissions for the <code>html</code> folder and <code>index.html</code> that come with an <code>apache2</code> install match those of the added <code>src</code> folder:</p>
  
  <pre><code>Step 19 : RUN ls -laR /var/www/
   ---&gt; Running in 0520950d0426
  /var/www/:
  total 12
  drwxr-xr-x  6 root root 4096 May 23 19:23 .
  drwxr-xr-x 24 root root 4096 May 23 19:23 ..
  drwxr-xr-x  5 root root 4096 May 23 19:23 html
  
  /var/www/html:
  total 24
  drwxr-xr-x  5 root root  4096 May 23 19:23 .
  drwxr-xr-x  6 root root  4096 May 23 19:23 ..
  -rw-r--r--  1 root root 11510 May 23 18:28 index.html
  drwxr-xr-x 47 root root  4096 May 23 19:23 src
  
  /var/www/html/src:
  total 1032
  drwxr-xr-x 47 root root  4096 May 23 19:23 .
  drwxr-xr-x  5 root root  4096 May 23 19:23 ..
  -rw-r--r--  1 root root    28 May 23 12:22 .gitignore
  -rw-r--r--  1 root root   501 May 23 12:22 .htaccess
  -rw-r--r--  1 root root  7566 May 23 12:22 index.php
  </code></pre>
  
  <p>Perhaps <code>chmod</code> doesn't work quite the way I thought it does??</p>
  
  <p><strong><em>EDIT3</em></strong></p>
  
  <p>A final bit of information. The Docker container is being built by buildbot, which I've been assuming runs as root. I haven't been able to reproduce this scenario without using buildbot to do the building.</p>
  
  <p>Building everything via <code>sudo docker build -t apache .</code> type commands on my laptop works fine, but the problems arise when buildbot does it. No idea why :^/</p>