Docker "failed to register layer ... operation not permitted" in CI
Docker downloaded an image layer but could not unpack it onto disk because a filesystem operation was denied. Usually the storage driver or runtime restricts the chown/mknod/overlay operations layer extraction needs.
What this error means
A docker pull (or the implicit pull before a run) fails while extracting a layer with failed to register layer: ... operation not permitted. It is environment-specific - fine on a normal host, failing inside a constrained container-in-container runner.
failed to register layer: lchown /usr/bin/..: operation not permitted
# or: ApplyLayer ... operation not permitted during extractionCommon causes
Running Docker inside a restricted container
Docker-in-Docker without the right privileges, or a user-namespaced runtime, can forbid the chown/mknod operations that layer extraction performs, producing "operation not permitted".
Unsupported or mismatched storage driver
An overlay filesystem on top of another overlay, or a storage driver the kernel does not fully support in this environment, can fail to apply layers.
Filesystem mounted nosuid/nodev or otherwise constrained
A graph root on a filesystem that disallows special files or ownership changes blocks the operations a layer needs to be registered.
How to fix it
Run the Docker daemon with adequate privileges
- For Docker-in-Docker, run the dind service in privileged mode (or use the runner’s host daemon).
- Avoid stacking overlay-on-overlay; give the daemon a real backing filesystem for its graph root.
- If user namespaces are remapping ownership, align them with what the images expect.
Check and adjust the storage driver
Inspect which driver is in use and switch to a supported one for the environment.
docker info | grep -i 'Storage Driver'
# e.g. set a supported driver in /etc/docker/daemon.json and restartHow to prevent it
- Use a runner setup where the Docker daemon has the privileges layer extraction needs.
- Prefer the host Docker daemon over nested dind when possible.
- Keep the storage driver and backing filesystem supported and unstacked.