Docker npm errno -13 - docker

Question

I'm running a very simple Node.js Koa "hello world" application on Docker 2.4.0 on Windows. If the base image is node:10-alpine, it works well:
FROM node:10-alpine
RUN mkdir -p /home/node/app/node_modules && chown -R node:node /home/node/app
WORKDIR /home/node/app
COPY package*.json ./
USER node
RUN npm install
COPY --chown=node:node . .
EXPOSE 8080
CMD [ "node", "index.js" ]
But if I change the version to FROM node:15.0.1-alpine3.10
Step 6/9 : RUN npm install
Removing intermediate container 6ff212db1484
---> bfde467f103d
Step 6/9 : RUN npm install
---> Running in 37ef90ef4039
npm ERR! code EACCES
npm ERR! syscall open
npm ERR! path /home/node/app/package-lock.json
npm ERR! errno -13
npm ERR! Error: EACCES: permission denied, open '/home/node/app/package-lock.json'
npm ERR! [Error: EACCES: permission denied, open '/home/node/app/package-lock.json'] {
npm ERR! errno: -13,
npm ERR! code: 'EACCES',
npm ERR! syscall: 'open',
npm ERR! path: '/home/node/app/package-lock.json'
npm ERR! }
........

Answer 1

npm install will try to update the package-lock.json file with the current actual versions of the packages it's installed. For installation in a Docker image, you don't really want this; use npm ci instead to avoid this.
The other problem you're encountering is that COPY by default makes files owned by the root user, but you've switched to an alternate "node" user. You probably want the application code in your image to be owned by root, and then run as an alternate user: if there's some sort of security issue, this gives you an extra layer of protection against the code in the container getting modified.
If you do both of these things, the corrected Dockerfile would roughly look like:
FROM node:15.0.1-alpine3.10
# WORKDIR also creates the directory. It will be owned by root,
# which is probably what you want. (So no `RUN mkdir ...`.)
WORKDIR /home/node/app
# Stay as the root user for now.
# Install packages:
COPY package*.json ./
RUN npm ci # not `npm install`
# Copy in the rest of the application (still owned by root):
COPY . .
# Declare runtime metadata. Only now switch to the "node" user.
# This will not be able to modify the source code (good).
USER node
EXPOSE 8080
CMD ["node", "index.js"]