docker run -d -p 8080:8080 -p 50000:50000 -v $(pwd)/data:/var/jenkins_home --name jenkins
docker logs jenkins

Can not write to /var/jenkins_home/copy_reference_file.log. Wrong volume permissions?
touch: cannot touch ‘/var/jenkins_home/copy_reference_file.log’: Permission denied
 

执行如下命令

docker@default:~$ docker run -ti --rm --entrypoint="/bin/bash" jenkins -c "whoami && id"
jenkins
uid=1000(jenkins) gid=1000(jenkins) groups=1000(jenkins)

docker@default:~$ docker run -ti --rm --entrypoint="/bin/bash" jenkins -c "ls -la /var/jenkins_home"
total 20
drwxr-xr-x  2 jenkins jenkins 4096 Jun  5 08:39 .
drwxr-xr-x 28 root    root    4096 May 24 16:43 ..
-rw-r--r--  1 jenkins jenkins  220 Nov 12  2014 .bash_logout
-rw-r--r--  1 jenkins jenkins 3515 Nov 12  2014 .bashrc
-rw-r--r--  1 jenkins jenkins  675 Nov 12  2014 .profile

而当映射本地数据卷时，/var/jenkins_home目录的拥有者变成了root用户

docker run -ti --rm -v $(pwd)/data:/var/jenkins_home --entrypoint="/bin/bash" jenkins -c "ls -la /var/jenkins_home"
total 4
drwxr-sr-x  2 root staff   40 Jun  5 08:32 .
drwxr-xr-x 28 root root  4096 May 24 16:43 ..

这就解释了为什么当"jenkins"用户的进程访问"/var/jenkins_home"目录时，会出现 Permission denied 的问题

我们再检查一下宿主机上的数据卷目录，当前路径下"data"目录的拥有者是"root"，这是因为这个目录是Docker进程缺省创建出来的。

docker@default:~$ ls -la data
total 0
drwxr-sr-x    2 root     staff           40 Jun  5 08:32 ./
drwxr-sr-x    5 docker   staff          160 Jun  5 08:32 ../

发现问题之后，相应的解决方法也很简单：把当前目录的拥有者赋值给uid 1000，再启动"jenkins"容器就一切正常了。

 

sudo chown -R 1000 data
docker start jenkins

如果还不行（重点！！！！！！！）

如果按照上面做还是出现Permission denied错误，那么可以检查一下selinux状态，开启的情况下会导致一些服务安装、使用不成功。

查看selinux状态，

[root@localhost ~]# sestatus  
SELinux status:                 enabled  
SELinuxfs mount:                /sys/fs/selinux  
SELinux root directory:         /etc/selinux  
Loaded policy name:             targeted  
Current mode:                   enforcing  
Mode from config file:          enforcing  
Policy MLS status:              enabled  
Policy deny_unknown status:     allowed  
Max kernel policy version:      28

临时关闭，

[root@localhost ~]# setenforce 0
1
永久关闭,可以修改配置文件/etc/selinux/config,将其中SELINUX设置为disabled，如下，

[root@localhost ~]# cat /etc/selinux/config   

# This file controls the state of SELinux on the system.  
# SELINUX= can take one of these three values:  
#     enforcing - SELinux security policy is enforced.  
#     permissive - SELinux prints warnings instead of enforcing.  
#     disabled - No SELinux policy is loaded.  
#SELINUX=enforcing  
SELINUX=disabled  
# SELINUXTYPE= can take one of three two values:  
#     targeted - Targeted processes are protected,  
#     minimum - Modification of targeted policy. Only selected processes are protected.   
#     mls - Multi Level Security protection.  
SELINUXTYPE=targeted

[root@rdo ~]# sestatus  
SELinux status:                 disabled