Dockerfile "chmod: Operation not permitted" in CI

By Kaveh Alemi·Latchkey

A RUN chmod or RUN chown could not change the file because the current user lacks the privilege. This typically happens after a USER switch, when the build tries to modify a root-owned file as a non-root user.

What this error means

A RUN step fails with "chmod: changing permissions of '/app/entrypoint.sh': Operation not permitted" (BusyBox prints the shorter "chmod: /app/entrypoint.sh: Operation not permitted").

docker build

chmod: changing permissions of '/app/entrypoint.sh': Operation not permitted
The command '/bin/sh -c chmod +x /app/entrypoint.sh' returned a non-zero code: 1

Common causes

A non-root USER changing a root-owned file

The Dockerfile dropped to a non-root USER and then tried to chmod or chown a file owned by root, which the kernel refuses.

A read-only or special filesystem

The file sits on a mount whose permissions are fixed, so even an otherwise valid change is rejected.

How to fix it

Change permissions before dropping privileges

Do the chmod/chown while still root, then switch user.

Dockerfile

RUN chmod +x /app/entrypoint.sh
USER node

Set mode and owner at copy time

Apply the mode during COPY so no later chmod is needed (this uses BuildKit).

Dockerfile

COPY --chown=node:node --chmod=755 entrypoint.sh /app/entrypoint.sh

How to prevent it

Order the Dockerfile so privileged file changes happen before USER.
Prefer COPY --chmod/--chown over post-copy permission edits.
Avoid changing files on read-only or special mounts.

Frequently asked questions

What causes ""chmod: ... Operation not permitted""?

The Dockerfile dropped to a non-root USER and then tried to chmod or chown a file owned by root, which the kernel refuses.

How do I fix "chmod: ... Operation not permitted"?

Do the chmod/chown while still root, then switch user.