Error starting container: container id XYZ cannot be mapped to a host id about docker-python-nodejs

[david-fortini]

I had the same problem, setting USER is not an option as I just want to use this image in circleci without rebuilding it myself.

The workaround I found is to pull with an old digest and it works as usual.
like
image: nikolaik/python-nodejs@sha256:bc965872c98c5da6464688cb0eb4ea19bbce2ca01a6d17362c882d71fc8487a7

instead of
image: nikolaik/python-nodejs:python3.8-nodejs12

[nikolaik]

I also encountered the same issue in Circle CI. I think I was able to find the file which is not owned by the root, but was possibly skipped by your grep command, because it contains root in file path docker run nikolaik/python-nodejs:python3.8-nodejs12 ls -ln /root/.poetry/lib/poetry/_vendor/py2.7/backports/entry_points_selectable.py. Could you check it @nikolaik?

Of course! I'll have a look. Thanks for pointing it out @szdziedzic

I had the same problem, setting USER is not an option as I just want to use this image in circleci without rebuilding it myself.

We would add the USER thing to these images, but since it is a breaking change we should probably add it conditionally when a new major version is released. F.ex along with python 3.10 and/or with node.js v17

[nikolaik]

I've rebuilt all images now with updated poetry, which does not include the file with too high uid/gid. This should now be fixed

[szdziedzic]

I also encountered the same issue in Circle CI. I think I was able to find the file which is not owned by the root, but was possibly skipped by your grep command, because it contains root in file path docker run nikolaik/python-nodejs:python3.8-nodejs12 ls -ln /root/.poetry/lib/poetry/_vendor/py2.7/backports/entry_points_selectable.py. Could you check it @nikolaik?

[nikolaik]

Did a quick check with docker run nikolaik/python-nodejs:python3.8-nodejs14-slim find / -ls | grep -v root and all files in the image is owned by root (uid=0) .

I think this is happening because your are unpacking a tar archive which includes files with too high uid/guids (over 65535 ?).

Since this image Dockerfile has no USER set, the tar command is run as root. This means tar defaults to preserving file ownerships/permissions ie. (according to man tar). Setting USER is probably the best long term fix for this ref.

If my thinking is not way off you should be able to work around this by adding the --no-same-owner parameter to your tar command.

[nikolaik]

So I made an attempt here in #30 Do anyone want to help verify the fix?
You could do something like this to test:

git clone https://github.com/nikolaik/docker-python-nodejs && cd docker-python-nodejs && git checkout fix/poetry-install
pipenv install --dev
python build_versions.py --dry-run --debug -d slim --force
docker build -t testy -f debug-python3.9-nodejs16-slim.Dockerfile .
docker run -it testy find / -uid +65535 -ls

[szdziedzic]

It looks all good! Thank you very much for quick reaction and your help 🙂 .

[jonathanmach]

Thanks @nikolaik!