How to fix cannot open '/etc/passwd': Permission denied in Docker

# Check current user
docker exec <container_name> whoami

# Run command as root
docker exec -u root <container_name> useradd newuser

# Or enter an interactive shell as root
docker exec -u 0 -it <container_name> /bin/sh

FROM ubuntu:22.04

# Run user operations as root (default)
RUN useradd -m appuser

# Then switch to non-root user
USER appuser

CMD ["./app"]

# This causes problems:
docker run -v /etc/passwd:/etc/passwd:ro myimage

# The passwd command creates a temp file and tries to rename it,
# which fails on a mount point

docker run -v /etc:/etc myimage

RUN useradd -u 1000 -m appuser

# Use libnss-extrausers or similar for dynamic user databases

# Check if you're running rootless Docker
docker info | grep -i rootless

# Check user namespace mappings
cat /etc/subuid
cat /etc/subgid

docker run --userns=host myimage
# Note: This reduces security isolation

# Check your user has enough subordinate UIDs
grep $USER /etc/subuid
# Should show: username:100000:65536 (or similar)

# If missing, add them:
sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER

podman run -v ./data:/app/data:U myimage
# :U tells Podman to chown the volume to match the container user

# Check SELinux status
getenforce

# Check for SELinux denials
sudo ausearch -m avc -ts recent
# Or check the audit log
sudo grep denied /var/log/audit/audit.log | tail

# :z allows the volume to be shared between containers
docker run -v ./data:/app/data:z myimage

# :Z makes the volume private to this container
docker run -v ./data:/app/data:Z myimage

sudo chcon -Rt svirt_sandbox_file_t /path/to/volume

# Generate a policy module from denials
sudo ausearch -m avc -ts recent | audit2allow -M mycontainer
sudo semodule -i mycontainer.pp

# Check if filesystem is read-only
docker inspect <container> | grep -A5 ReadonlyRootfs

docker run --read-only --tmpfs /etc myimage

docker run --read-only \
  -v passwd-data:/etc/passwd \
  -v shadow-data:/etc/shadow \
  myimage

FROM alpine

# Create all users while filesystem is writable
RUN adduser -D appuser

# Application can run read-only since users exist
USER appuser
CMD ["./app"]

# Find your host user's UID/GID
id -u  # e.g., 1000
id -g  # e.g., 1000

FROM node:20

# Create user with specific UID matching host user
ARG UID=1000
ARG GID=1000

RUN groupadd -g $GID appgroup \
    && useradd -u $UID -g appgroup -m appuser

USER appuser

# Build with your UID/GID
docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) -t myapp .

# Or pass at runtime
docker run --user $(id -u):$(id -g) myapp

# Test reading /etc/passwd
docker exec <container> cat /etc/passwd

# Test user lookup
docker exec <container> id
docker exec <container> whoami

# Test user modification (if needed)
docker exec -u root <container> useradd testuser
docker exec <container> grep testuser /etc/passwd

# For volume mounts, test file creation
docker exec <container> touch /app/data/testfile