How to fix chown: changing ownership of '/data': Operation not permitted in Docker

# docker-compose.yml - WRONG approach
services:
  mongodb:
    image: mongo:latest
    volumes:
      - ./data:/data/db  # Container can't chown /data/db

# docker-compose.yml - CORRECT approach
services:
  mongodb:
    image: mongo:latest
    volumes:
      - ./data:/data  # Mount to parent, container creates /data/db itself

services:
  mysql:
    image: mysql:8
    volumes:
      - ./mysql-data:/var/lib  # Instead of /var/lib/mysql

# docker-compose.yml
services:
  mongodb:
    image: mongo:latest
    volumes:
      - mongodb_data:/data/db  # Named volume works correctly

volumes:
  mongodb_data:  # Docker manages this volume

# Create a named volume
docker volume create mongodb_data

# Use the named volume
docker run -v mongodb_data:/data/db mongo:latest

# Create volume and copy data
docker volume create mongodb_data
docker run --rm -v ./data:/source -v mongodb_data:/dest alpine cp -a /source/. /dest/

# Find the UID/GID the container expects
# For MongoDB: 999:999 (mongodb user)
# For MySQL: 999:999 (mysql user)
# For PostgreSQL: 999:999 (postgres user)

# Set ownership on host directory
sudo chown -R 999:999 ./data

# Or make it writable by anyone (less secure, for development only)
chmod -R 777 ./data

# Inspect the image to find the user
docker inspect mongo:latest --format '{{.Config.User}}'

# Or run a command inside to check
docker run --rm mongo:latest id

services:
  myapp:
    image: myimage
    user: "1000:1000"
    volumes:
      - ./data:/app/data

sudo chown -R 1000:1000 ./data

# Create user first
FROM node:18-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

# Copy with correct ownership
COPY --chown=appuser:appgroup ./src /app/src
COPY --chown=appuser:appgroup package*.json /app/

WORKDIR /app
RUN npm install

USER appuser
CMD ["node", "src/index.js"]

FROM alpine
COPY --chown=1000:1000 ./files /app/files

# Check if user namespace remapping is enabled
cat /etc/docker/daemon.json | grep userns-remap

# Check the subuid/subgid mappings
cat /etc/subuid
cat /etc/subgid
# Output example: dockremap:100000:65536

# Set host directory ownership to the remapped UID range
sudo chown -R 100000:100000 ./data

docker run --userns=host -v ./data:/data myimage

services:
  myapp:
    image: myimage
    userns_mode: "host"
    volumes:
      - ./data:/data

# Check NFS share ownership
ls -ln /nfs/share

# Run container as that user
docker run --user 1000:1000 -v /nfs/share:/data myimage

# Edit /etc/exports on the NFS server
/shared/data  *(rw,sync,no_root_squash)  # Allows root operations

# Or use specific anonymous mapping
/shared/data  *(rw,sync,anonuid=999,anongid=999)

# Apply changes
sudo exportfs -ra

services:
  init-permissions:
    image: alpine
    user: root
    volumes:
      - nfs_data:/data
    command: chown -R 999:999 /data

  myapp:
    image: myimage
    depends_on:
      - init-permissions
    volumes:
      - nfs_data:/data

volumes:
  nfs_data:
    driver: local
    driver_opts:
      type: nfs
      o: addr=nfs-server,rw
      device: ":/shared/data"

services:
  mongodb:
    image: bitnami/mongodb:latest
    volumes:
      - ./data:/bitnami/mongodb
    environment:
      - MONGODB_ROOT_PASSWORD=secret

  mysql:
    image: bitnami/mysql:latest
    volumes:
      - ./mysql-data:/bitnami/mysql/data
    environment:
      - MYSQL_ROOT_PASSWORD=secret

  postgresql:
    image: bitnami/postgresql:latest
    volumes:
      - ./pg-data:/bitnami/postgresql
    environment:
      - POSTGRESQL_PASSWORD=secret

# For private volumes (single container access)
docker run -v ./data:/data:Z myimage

# For shared volumes (multiple containers)
docker run -v ./data:/data:z myimage

services:
  myapp:
    image: myimage
    volumes:
      - ./data:/data:Z

# Check SELinux status
getenforce

# Check for SELinux denials
sudo ausearch -m avc -ts recent

# Temporarily disable for testing (don't do in production)
sudo setenforce 0

# Set the correct context on the directory
sudo semanage fcontext -a -t svirt_sandbox_file_t "./data(/.*)?"
sudo restorecon -Rv ./data