docker-compose - ADD failed: Forbidden path outside the build context

问题

I have such folder structure

project
    - config
        -docker
           Dockerfile
           docker-compose.yml
    - src
       here_is_code
    requirements.txt

Dockerfile

FROM python:3
ENV PYTHONUNBUFFERED 1
RUN mkdir /code
WORKDIR /code
ADD ../../requirements.txt /code/
RUN pip install -r requirements.txt
ADD src /code/

docker-compose.yml

version: '3'

services:
  web:
    build:
      context: ../../
      dockerfile: config/docker/Dockerfile
    command:
        bash -c "ls"
    volumes:
      - .:/code
    expose:
      - "8000"
  nginx:
    image: nginx
    ports:
    - "8000:8000"
    volumes:
      - .:/code
      - ./config/nginx:/etc/nginx/conf.d
    depends_on:
    - web

When I run docker-compose build I get following error:

Service 'web' failed to build: ADD failed: Forbidden path outside the build context: ../../requirements.txt ()

Is it possible to add requirements.txt or I'll have to copy this file into docker directory? Or maybe I need to use any entrypoint (entrypoint.sh)?

UPDATE

After docker build -f config/docker/Dockerfile . and docker-compose up I can't see my code there. Here is the output of ls -R /code

web_1    | /code:
web_1    | Dockerfile
web_1    | config
web_1    | docker-compose.yml
web_1    | src
web_1    | static
web_1    | 
web_1    | /code/config:
web_1    | nginx
web_1    | 
web_1    | /code/config/nginx:
web_1    | 
web_1    | /code/src:
web_1    | static
web_1    | 
web_1    | /code/src/static:
web_1    | 
web_1    | /code/static:

回答1:

context

It's all about context. Specify context and dockerfile in your build and you can plant your Dockerfile anywhere. Play a round with it (that's what she said).

I would at least keep the docker-compose.yaml in a root directory.


build:
  context: .
  dockerfile: dockerfiles/project-one/Dockerfile

回答2:

You cannot get outside of build context (which is normally the working directory) of Docker when building an image.

The reason is pretty simple - Docker consists of command line client and daemon, when you call docker build ... first thing happening is that your client packs entire folder (build context) into single archive and sends it to daemon together with your Dockerfile. Daemon gets an archive and instructions from Dockerfile and that means daemon does not access your local filesystem when building an image and cannot walk through ../.. references.

What you need to to set the build context to your root folder and specify Dockerfile explicitly.

You build command will look like

docker build -f config/docker/Dockerfile .

And inside Dockerfile you have to remember that all paths are relative to the project root.

So finally you come to following compose file:

docker-compose.yml

version: '3'
services:
  web:
    build:
      context: .  # here changed
      dockerfile: config/docker/Dockerfile
    command: ["bash", "-c", "ls"]
    expose:
      - "8000"
  nginx:
    image: nginx
    ports:
      - "8000:8000"
    depends_on:
      - web

You go to project root and run

docker-compose -f config/docker/docker-compose.yml up

回答3:

Hope, my answer will help somebody (it is based on many GitHub repositories, I have looked though)

I have wrong project structure. If you need to separate docker files and application code, it's better to put the code in any folder (called app for example) in the root folder. Docker files should also be in the root folder. Such structure will avoid a lot of problems and it will be easy to use docker/docker-compose

来源：https://stackoverflow.com/questions/54287298/docker-compose-add-failed-forbidden-path-outside-the-build-context

标签

Docker

docker-compose