Why golang/x/crypto/acme/autocert with DirCache throw permission denied? - docker

Question

My goal is to share the cert in a docker volume. I create the docker volume with $ docker volume create secret-dir. So, I can stop and remove the container without worrying that autocert did ACME challenge every time I restart the container.
In the Dockerfile, I use USER 10001:10001, a non-root user.
I mounted the docker volume with docker run ... -v secret-dir:/secret-dir.
I make sure that USER 10001:10001 have access to the mounted volume by adding mkdir /secret-dir && chown 10001:10001 /secret-dir && chmod 750 /secret-dir.
I double check it and ls -l shows that the mounted folder is owned by USER 10001:10001 with folder permission of 0750, later I chmod it to 777, but the same issue persist.
main.go
m := &autocert.Manager{
Cache: autocert.DirCache("secret-dir"), // removing this will solve the issue but it will do ACME challenge every time I restart the container. `crt.sh` shows that I created new cert after I restarted the container.
Prompt: autocert.AcceptTOS,
HostPolicy: autocert.HostWhitelist(*host),
}
Dockerfile
FROM golang:1.19-alpine3.16 AS stage0
...
FROM alpine:3.16 AS stage1
WORKDIR /
RUN apk add --no-cache ca-certificates
RUN adduser \
-h "/dev/null" \
-g "" \
-s "/sbin/nologin" \
-D \
-H \
-u 10001 \
playerone
RUN mkdir /secret-dir && chown 10001:10001 /secret-dir && chmod 777 /secret-dir
FROM scratch
WORKDIR /
COPY --from=stage0 /main /main
COPY --from=stage1 /secret-dir/ /secret-dir/
COPY --from=stage1 /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=stage1 /etc/passwd /etc/passwd
USER 10001:10001
EXPOSE 80/tcp 443/tcp
The error:
2022/10/08 22:27:32 server.go:3230: http: TLS handshake error from **my external ip**:**my external port**: open secret-dir/acme_account+key2164117716: permission denied
2022/10/08 22:59:26 server.go:3230: http: TLS handshake error from ip**:**my external port**: acme/autocert: missing certificate