search

mendhak / docker-http-https-echo

Docker image that echoes request data as JSON; listens on HTTP/S, useful for debugging.
https://code.mendhak.com/docker-http-https-echo/
MIT License
621 stars 136 forks source link

EACCES: permission denied, open 'privkey.pem' #53

Closed romans8 closed 9 months ago

romans8 commented 1 year ago

I am trying to use my own created certs.

docker run --user node -p 8080:8080 -p 8443:8443 -v /etc/ssl/certs/fullchain.pem:/app/fullchain.pem -v /etc/ssl/private/privkey.pem:/app/privkey.pem --rm -t mendhak/http-https-echo:26 node:internal/fs/utils:347 throw err; ^

Error: EACCES: permission denied, open 'privkey.pem' at Object.openSync (node:fs:590:3) at Object.readFileSync (node:fs:458:35) at Object. (/app/index.js:124:22) at Module._compile (node:internal/modules/cjs/loader:1155:14) at Object.Module._extensions..js (node:internal/modules/cjs/loader:1209:10) at Module.load (node:internal/modules/cjs/loader:1033:32) at Function.Module._load (node:internal/modules/cjs/loader:868:12) at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:81:12) at node:internal/main/run_main_module:22:47 { errno: -13, syscall: 'open', code: 'EACCES', path: 'privkey.pem'

romans8 commented 1 year ago

docker run --user node -e HTTP_PORT=8080 -e HTTPS_PORT=8443 -p 8080:8080 -p 8443:8443 -v /etc/ssl/certs/fullchain.pem:/app/fullchain.pem -v /etc/ssl/private/privkey.pem:/app/privkey.pem --rm mendhak/http-https-echo:issue-14-non-root internal/fs/utils.js:308 throw err; ^

Error: EACCES: permission denied, open 'privkey.pem' at Object.openSync (fs.js:476:3) at Object.readFileSync (fs.js:377:35) at Object. (/app/index.js:73:22) at Module._compile (internal/modules/cjs/loader.js:1063:30) at Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10) at Module.load (internal/modules/cjs/loader.js:928:32) at Function.Module._load (internal/modules/cjs/loader.js:769:14) at Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:72:12) at internal/main/run_main_module.js:17:47 { errno: -13, syscall: 'open', code: 'EACCES', path: 'privkey.pem' }

mendhak commented 1 year ago

This might be down to permissions. Ever since the container switched to running as a non-root user, the user doesn't map to the root user on the host, so it won't have permissions to read your newly generated private key if it's only readable by root.

You could try a chmod 755 on the new certificates, or copy it to local directory and do the chmod on it.