Docker and Golang permission denied : "can't create log directory" - docker

Question

Hello,
I'm here today because I'm stuck on a permission problem of my application.
I have set up a "lumberjack" log system to keep track of everything that happens on my application and rotate logs. In local I don't have any problem... but when I go in production it's not the same.
My error appear here when I want to access at "/var/log/app:
if err := os.MkdirAll(config.Directory, 0755); err != nil {
log.Error().Err(err).Str("path", config.Directory).Msg("can't create log directory")
return nil
}
A part of my docker-compose.yml:
(maybe missing a volumes in this container ?)
app:
container_name: app
image: app
restart: always
depends_on:
- postgres
networks:
- app
- web
environment:
- xxx_USERNAME=xxxxx
- xxx_PASSWORD=xxxxx
- xxx_HOST=xxxxx
- xxx_NAME=xxxxx
- xxx_DEBUG=1
- xxx_CONSOLELOGGING_LOG=TRUE
- xxx_ENCODELOGJSON_LOG=TRUE
- xxx_FILELOGGING_LOG=FALSE
- xxx_DIRECTORY_LOG=/var/log/app
- xxx_FILENAME_LOG=file.log
- xxx_MAXSIZE_LOG=100
- xxx_MAXBACKUPS_LOG=5
- xxx_MAXAGE_LOG=30
ports:
- 443:443
labels:
- #TRAEFIK CONFIG
Makebuild for Docker:
CGO_ENABLED=0 go build -ldflags "-X main.gitCommit=$(GIT_COMMIT) -X main.buildDate=$(BUILD_DATE) -X main.version=$(VERSION) -linkmode external -extldflags '-static' -s -w" -a -installsuffix cgo -o web
Dockerfile for my production app:
############################
# STEP 1 build executable binary
############################
FROM golang:alpine as builder
# Install git + SSL ca certificates.
# Ca-certificates is required to call HTTPS endpoints.
RUN apk update && apk add --no-cache git ca-certificates gcc g++ make && update-ca-certificates
# Create appuser
RUN adduser -D -g '' appuser
WORKDIR /usr/src/app
COPY . .
RUN go mod download
RUN go mod verify
WORKDIR /usr/src/app/cmd/web
# Build the binary static link
RUN make docker
############################
# STEP 2 build a small image
############################
FROM scratch
WORKDIR /
# Import from builder.
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /etc/passwd /etc/passwd
# Copy our static executable and resources
COPY --from=builder /usr/src/app/cmd/web/web /web
COPY --from=builder /usr/src/app/cmd/web/views /views
COPY --from=builder /usr/src/app/cmd/web/static /static
# Use an unprivileged user.
USER appuser
ENTRYPOINT ["./web"]
CMD [":443"]

Answer 1

Did you forgot to map volume to /var/log/ ?
app:
container_name: app
image: app
restart: always
depends_on:
- postgres
networks:
- app
- web
environment:
- xxx_USERNAME=xxxxx
- xxx_PASSWORD=xxxxx
- xxx_HOST=xxxxx
- xxx_NAME=xxxxx
- xxx_DEBUG=1
- xxx_CONSOLELOGGING_LOG=TRUE
- xxx_ENCODELOGJSON_LOG=TRUE
- xxx_FILELOGGING_LOG=FALSE
- xxx_DIRECTORY_LOG=/var/log/app
- xxx_FILENAME_LOG=file.log
- xxx_MAXSIZE_LOG=100
- xxx_MAXBACKUPS_LOG=5
- xxx_MAXAGE_LOG=30
ports:
- 443:443
labels:
- #TRAEFIK CONFIG
volumes:
- ./:/var/log/
See the last line of docker compose snippet...
FROM scratch is empty... and you not creating new directory it with provided instructions. Add settings to map directory to your container.