Cannot start container based on postgres:15.13 image

[nabheet]

Not sure if this repo is the correct spot for this issue, but we are getting this error when starting postgres with the latest image:

$ docker run -e POSTGRES_PASSWORD=password --rm -it ghcr.io/cloudnative-pg/postgresql:15.13
chmod: changing permissions of '/var/lib/postgresql/data': Operation not permitted
chmod: changing permissions of '/var/run/postgresql': Operation not permitted
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... initdb: error: could not change permissions of directory "/var/lib/postgresql/data": Operation not permitted

[dosubot]

Hi @nabheet! I'm Dosu and I’m helping the postgres-containers team.

This image inherits its startup logic from the official Postgres image, so permission errors like "Operation not permitted" on /var/lib/postgresql/data usually happen when the container runs as the postgres user (UID 26) and the data directory isn't writable by that user. This often occurs if you're mounting a host directory with -v and the ownership or permissions on the host don't match what the container expects.

Are you mounting any host directories or using special Docker flags (like user remapping, SELinux, or AppArmor)? If so, make sure the mounted directory on the host is owned by UID 26 or is world-writable. If you're not using any mounts, try running the container without extra security flags to see if the issue persists. If SELinux or AppArmor is enabled, check for denials or try running with relaxed --security-opt settings for testing.

There are no recent changes or known issues in this repo affecting permissions for this image, and all permission handling is inherited from the upstream Postgres image logic, not something CNPG-specific. For more details, you can check the Dockerfile and its user/permission setup here.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[nabheet]

As you can see from the docker command we are not mounting any directories or customizing anything.

Upstream postgresql works fine:

$ docker run -e POSTGRES_PASSWORD=password --rm -it postgres:15.13                         
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting dynamic shared memory implementation ... posix
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting default time zone ... Etc/UTC
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok

initdb: warning: enabling "trust" authentication for local connections
initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb.

Success. You can now start the database server using:

    pg_ctl -D /var/lib/postgresql/data -l logfile start

waiting for server to start....2025-07-14 16:14:42.141 UTC [48] LOG:  starting PostgreSQL 15.13 (Debian 15.13-1.pgdg120+1) on aarch64-unknown-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit
2025-07-14 16:14:42.142 UTC [48] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2025-07-14 16:14:42.144 UTC [51] LOG:  database system was shut down at 2025-07-14 16:14:42 UTC
2025-07-14 16:14:42.147 UTC [48] LOG:  database system is ready to accept connections
 done
server started

/usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*

waiting for server to shut down...2025-07-14 16:14:42.255 UTC [48] LOG:  received fast shutdown request
.2025-07-14 16:14:42.256 UTC [48] LOG:  aborting any active transactions
2025-07-14 16:14:42.257 UTC [48] LOG:  background worker "logical replication launcher" (PID 54) exited with exit code 1
2025-07-14 16:14:42.257 UTC [49] LOG:  shutting down
2025-07-14 16:14:42.258 UTC [49] LOG:  checkpoint starting: shutdown immediate
2025-07-14 16:14:42.261 UTC [49] LOG:  checkpoint complete: wrote 3 buffers (0.0%); 0 WAL file(s) added, 0 removed, 0 recycled; write=0.001 s, sync=0.001 s, total=0.004 s; sync files=2, longest=0.001 s, average=0.001 s; distance=0 kB, estimate=0 kB
2025-07-14 16:14:42.262 UTC [48] LOG:  database system is shut down
 done
server stopped

PostgreSQL init process complete; ready for start up.

2025-07-14 16:14:42.376 UTC [1] LOG:  starting PostgreSQL 15.13 (Debian 15.13-1.pgdg120+1) on aarch64-unknown-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit
2025-07-14 16:14:42.376 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
2025-07-14 16:14:42.376 UTC [1] LOG:  listening on IPv6 address "::", port 5432
2025-07-14 16:14:42.377 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2025-07-14 16:14:42.380 UTC [62] LOG:  database system was shut down at 2025-07-14 16:14:42 UTC
2025-07-14 16:14:42.383 UTC [1] LOG:  database system is ready to accept connections
2025-07-14 16:19:42.485 UTC [60] LOG:  checkpoint starting: time
2025-07-14 16:19:46.644 UTC [60] LOG:  checkpoint complete: wrote 43 buffers (0.3%); 0 WAL file(s) added, 0 removed, 0 recycled; write=4.147 s, sync=0.004 s, total=4.160 s; sync files=11, longest=0.003 s, average=0.001 s; distance=252 kB, estimate=252 kB

[AlexC]

There does appear to be a difference in the permissions of /var/lib/postgresql/data between 16.9-12 and 16.9-13, which would explain this:

$ docker run --rm -it --user 0 --entrypoint /bin/sh ghcr.io/cloudnative-pg/postgresql:16.9-12-bookworm -c 'ls -la /var/lib/postgresql/data'
total 8
drwxrwxrwt 2 postgres postgres 4096 Jul  1 06:10 .
drwxrwxrwt 1 postgres postgres 4096 Jul  1 06:10 ..
$ docker run --rm -it --user 0 --entrypoint /bin/sh ghcr.io/cloudnative-pg/postgresql:16.9-13-bookworm -c 'ls -la /var/lib/postgresql/data'
total 8
drwxr-xr-x 2 root     root     4096 Jul 15 15:41 .
drwxrwxrwt 1 postgres postgres 4096 Jul 15 15:41 ..

In -13 the directory is owned by root instead of postgres. I assume this is due to the addition of this line:

rm -fr /var/lib/postgresql/data; \

Removing the directory that may have had the correct permissions set, and then being recreated as the root user later on. See 53bbbac