Custom users do not set the volume permissions correctly

[shawb5]

Describe the problem

Rocky Linux 9.6 running Docker Engine 29.0.2

When using a non-standard user (e.g., 1010:1010) to run a container, the owner of the volumes directory is not set correctly (assumes 1000:1000 as the owner). If the owner of the data directory is changed, the container can run.

Steps to reproduce:
Create user: useradd -M -s /sbin/nologin -u 1010 minecraft
Check user is in /etc/passwd: minecraft:x:1010:1010::/home/minecraft:/sbin/nologin
Run container: docker compose up -d
Check folder permissions drwxr-x---. 2 1000 1000 6 Oct 26 04:02 _data

Steps to remedy:
Change owner of data folder: chown -R 1010:1010 _data/
Restart container: docker restart minecraft

Container definition

services:
  minecraft:
    container_name: minecraft
    image: itzg/minecraft-server:stable
    tty: true
    stdin_open: true
    ports:
      - "25565:25565"
    dns:
      - "9.9.9.9"
      - "149.112.112.112"
    environment:
      UID: 1010
      GID: 1010
      TZ: "Europe/London"
      ENABLE_ROLLING_LOGS: TRUE
      TYPE: PAPER
      EULA: TRUE
      VERSION: 1.21.10
      MOTD: "A Trusted Friend in Science"
      DIFFICULTY: NORMAL
      ICON: "https://upload.wikimedia.org/wikipedia/commons/e/ee/Aperture_Science.svg"
      MAX_PLAYERS: 10
      MODE: SURVIVAL
      ONLINE_MODE: TRUE
      SERVER_NAME: "Aperture Science Recreation Chamber"
      ENABLE_RCON: TRUE
    volumes:
      - "minecraft:/data"
    user: 1010:1010
    restart: always

volumes:
    minecraft:

Container logs

Logs in error:

{"log":"[init] Running as uid=1010 gid=1010 with /data as 'drwxr-x---. 2 1000 1000 6 Oct 26 04:02 /data'\r\n","stream":"stdout","time":"2025-12-13T14:12:19.314756087Z"}
{"log":"[init] Image info: buildtime=2025-10-27T11:41:32.665Z,version=2025.10.5,revision=d56efcd680bdbc8e3e31f6ec1e52d2076341f517\r\n","stream":"stdout","time":"2025-12-13T14:12:19.321906649Z"}
{"log":"/image/scripts/start-utils: line 356: /data/eula.txt: Permission denied\r\n","stream":"stdout","time":"2025-12-13T14:12:19.331346136Z"}
{"log":"[init] \u001b[31m[ERROR] Unable to write eula to /data. Please make sure attached directory is writable by uid=1010 \u001b(B\u001b[m\r\n","stream":"stdout","time":"2025-12-13T14:12:19.336308883Z"}

Logs after amending issue:

{"log":"[init] Running as uid=1010 gid=1010 with /data as 'drwxr-x---. 2 1010 1010 6 Oct 26 04:02 /data'\r\n","stream":"stdout","time":"2025-12-13T14:24:50.42112041Z"}
{"log":"[init] Image info: buildtime=2025-10-27T11:41:32.665Z,version=2025.10.5,revision=d56efcd680bdbc8e3e31f6ec1e52d2076341f517\r\n","stream":"stdout","time":"2025-12-13T14:24:50.424046043Z"}
{"log":"[init] Resolving type given PAPER\r\n","stream":"stdout","time":"2025-12-13T14:24:50.44476208Z"}
{"log":"\u001b[39m[mc-image-helper] 14:24:56.898 INFO  : Downloaded /data/paper-1.21.10-117.jar\r\n","stream":"stdout","time":"2025-12-13T14:24:56.905442196Z"}
{"log":"\u001b[0;39m[init] Copying any plugins from /plugins to /data/plugins\r\n","stream":"stdout","time":"2025-12-13T14:24:59.160452641Z"}
{"log":"[init] Copying any configs from /config to /data/config\r\n","stream":"stdout","time":"2025-12-13T14:25:00.87945141Z"}
{"log":"[init] Creating server properties in /data/server.properties\r\n","stream":"stdout","time":"2025-12-13T14:25:02.510257501Z"}
{"log":"[init] Disabling whitelist functionality\r\n","stream":"stdout","time":"2025-12-13T14:25:02.510971857Z"}
{"log":"[init] Setting mode\r\n","stream":"stdout","time":"2025-12-13T14:25:02.511853508Z"}
{"log":"\u001b[39m[mc-image-helper] 14:25:04.216 INFO  : Created/updated 10 properties in /data/server.properties\r\n","stream":"stdout","time":"2025-12-13T14:25:04.222868234Z"}

[itzg]

If you didn't have the user: 1010:1010 it would do a chown. Since you're defeating that mechanism, then yes, you have to correct the /data ownership yourself.

docker-minecraft-server/scripts/start

Line 44 in 55bc4fd

chown -R ${runAsUser}:${runAsGroup} /data

[shawb5]

I ran the docker compose file without the user 1010:1010 argument, which worked, but did find an oddity in the file ownership. Even with the GID variable set, the group owner of the volume remains 1000.

{"log":"[init] Changing uid of minecraft to 1010\r\n","stream":"stdout","time":"2025-12-20T23:41:19.403702497Z"}
{"log":"[init] Changing gid of minecraft to 1010\r\n","stream":"stdout","time":"2025-12-20T23:41:19.473748244Z"}
{"log":"[init] Running as uid=1010 gid=1010 with /data as 'drwxr-x---. 2 1010 1000 6 Dec 13 16:31 /data'\r\n","stream":"stdout","time":"2025-12-20T23:41:19.562607588Z"}

drwxr-x---. 12 1010 1000 4.0K Dec 20 23:41 _data

Although the file ownership inside of the volume is correct:

drwxr-x---. 12 1010 1000 4.0K Dec 20 23:41 .
drwx-----x.  3    0    0   19 Dec 20 23:41 ..
-rw-rw-r--.  1 1010 1010    2 Dec 20 23:41 banned-ips.json
-rw-rw-r--.  1 1010 1010    2 Dec 20 23:41 banned-players.json
-rw-rw-r--.  1 1010 1010 1.2K Dec 20 23:41 bukkit.yml

If you didn't have the user: 1010:1010 it would do a chown.

I prefer using the built-in user attribute in Docker Compose over relying on container environment variables, as containers will default to running as root if the image does not set the user.

[itzg]

Yes make sure everything matches. Container user needs to match the data directory ownership. It's up to you to manually chown those since the container can't when running non-root.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Please add a comment describing the reason to keep this issue open.