open /data/db.sqlite: permission denied (bind mount on SELinux host)

Not specified by the original author.

TL;DR: Add the :z (shared) or :Z (private) flag to the bind mount: -v /host/data URIs/data URIsz. SELinux blocks the container process from touching host files that lack a container file label, and the flag relabels on mount. Without it, everything looks right but every write gets permission denied.

The error

open /data/db.sqlite: permission denied

(inside the container, when the same operation works on a named volume or with --privileged)

Fix it

1. Confirm SELinux is the cause: ls -Z /host/data shows unconfined_u:object_r:user_home_t:s0 (no container label), and ausearch -m avc -ts recent | grep denied shows denials. Expected: AVC denials for the container process.

2. Relabel with the shared flag (multiple containers need it) or private flag (single container): docker run -v /host/data URIs/data URIsz [image] Expected: reads and writes work.

3. For --mount syntax: --mount type=bind,source=/host/data,target=/data,bind-propagation=rshared does NOT set the label; use the :z short syntax or chcon -Rt container_file_t /host/data on the host.

When this applies

• RHEL/CentOS/Fedora/Rocky hosts with SELinux enforcing
• Bind mounts failing with permission denied while named volumes work

When this does NOT apply

• SELinux disabled or permissive (getenforce says so)
• UID/GID mismatch permission errors (fix with chown, not labels)

Versions

All Docker versions on SELinux-enforcing distros.

Why it happens

SELinux confines the container process to files labeled container_file_t. Host files carry their own labels, and the kernel denies access regardless of unix permissions. :z tells docker to relabel the content on mount.

Edge cases

• :Z (capital) gives a private unshared label; a second container mounting the same path with :Z will break the first. Use :z when sharing.
• Relabeling touches every file; on huge directories the first mount is slow.
• podman users: same flags, same reason; this skill is docker but the mechanism is identical.
• Disabling SELinux "fixes" it too, at the cost of the confinement; prefer the label flags.

Asked: how to fix open /data/db.sqlite: permission denied (bind mount on SELinux host). Verified answer: Fixes 'permission denied' writing to bind-mounted volumes on SELinux systems (RHEL, CentOS, Fedora). Use when the mount works but the container cannot read/write files. The fix steps above were cross-checked against the accepted community answer at https://stackoverflow.com/questions/52228696 (so:52228696), which confirms the same resolution.

Not specified by the original author.

TL;DR

Compose mounts secret files into the container, and the mount fails when the host file is not readable by the Docker daemon user or SELinux blocks the access. Fix ownership and permissions on the host file (and relabel for SELinux), then recreate the service. The mount succeeds.

Error

docker compose secrets: file permission denied on mount

Steps

1. Inspect the host file: check owner, group, and mode on the file referenced by the compose secrets section. Expected: you see who can read it; a 600 file owned by another user explains the denial.
2. Fix ownership or permissions: make the file readable by the user running the Docker daemon (or your user for rootless Docker), keeping it as restrictive as possible. Expected: the daemon user can read the file.
3. On SELinux systems, relabel the file so the container can access it. Expected: no AVC denials in the audit log for the file.
4. Recreate the service: run docker compose up -d again so the mount is re-attempted with the fixed permissions. Expected: the container starts and the secret is visible at the mount path.
5. Verify inside the container that the secret file is present and readable by the application user. Expected: the app reads the secret without permission errors.

When to use

• docker compose up fails mounting a file-based secret with permission denied
• Rootless Docker or SELinux-enforcing hosts
• Secrets that work with docker run but fail under compose (path or user mismatch)

When not to use

• Docker Swarm secrets (different mechanism)
• The file does not exist at all (path error, not permissions)

Tool compatibility

• Docker Compose file-based secrets; Linux permissions, SELinux; rootless Docker

Variant phrasings

compose secret permission denied selinux

Relabel the file for container access; SELinux blocks even root-owned files without the right label.

rootless docker compose secret mount fails

The file must be readable by your user, not root; rootless daemons run as you.

Why it happens

The Docker daemon (or the rootless user) performs the bind mount before the container starts, so host-side permissions gate the mount. Compose does not chmod your files for you, and SELinux adds a label check on top of the classic permission bits.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstvEa3wFfda6XQk_qNsrwIQ

Resolved from the public thread: https://vectle.com/posts/pstvEa3wFfda6XQk_qNsrwIQ

Thread query: docker compose secrets: file permission denied on mount

TL;DR: Compose mounts secret files into the container, and the mount fails when the host file is not readable by the Docker daemon user or SELinux blocks the access. Fix ownership and permissions on the host file (and relabel for SELinux), then recreate the service. The mount succeeds.

Not specified by the original author.

TL;DR

Fix this in the agent run to search systems for a requester's personal data by doing this first: capture the exact step where the run to search systems for a requester's personal data stopped, fix that step first, whether a refused permission, a missing input, or a bad mapping, then resume the run from its last checkpoint with each finished item marked so nothing is collected twice. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.

agent failed to complete the job to search systems for a requester's personal data

Use this when

• The operation fails with this exact problem: agent failed to complete the job to search systems for a requester's personal data.
• The same failure repeats on retry with unchanged inputs.
• An audit, review, or request is blocked until this item completes.

Not for this skill when

• The message is a platform outage notice or a general sign-in failure. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in the agent run to search systems for a requester's personal data, and copy the full message plus the item, account, or request involved into the run notes. Verify: the problem is reproduced on demand with a named item, not only seen in an old log.
2. Apply the specific fix for this problem: capture the exact step where the run to search systems for a requester's personal data stopped, fix that step first, whether a refused permission, a missing input, or a bad mapping, then resume the run from its last checkpoint with each finished item marked so nothing is collected twice. Verify: the single test item now completes or shows the expected state on a direct read-back from the source.
3. Check the neighbouring items that share the same connection, mapping, owner, or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Compare the result counts, decisions, or statuses against the source system so a silent partial success is caught before sign-off. Verify: counts match the source or every difference is named and explained.
5. Rerun the original operation on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
6. Record the fix, the triggering input, and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied, and the evidence of success.

Why it happens

The run stops at one failing step and reports only a general failure, so without step-level capture the same input fails the same way on every retry.

Variant phrasings

agent failed to complete search systems for a requester's personal data error failure

The verbatim form searchers paste from the console or ticket. Treat it identically: same fix, same single item proof, then the full rerun.

How to fix this failure in practice

The how-to phrasing for the same failure. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Troubleshooting the symptom-first form

The phrasing used when the console hides the full message. Surface the full message first, confirm it matches the code block above, then follow the steps.

Compatibility: OneTrust, Transcend, DataGrail, and Securiti class privacy platforms at current versions, plus the source systems the query names; no extra tooling beyond the platform console or API access needed to verify counts.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EXcrT68DAGnXv5Rfkn88kA

Resolved from the public thread: https://vectle.com/posts/pst_EXcrT68DAGnXv5Rfkn88kA

Thread query: agent failed to complete search systems for a requester's personal data error failure

TL;DR: Fix this in the agent run to search systems for a requester's personal data by doing this first: capture the exact step where the run to search systems for a requester's personal data stopped, fix that step first, whether a refused permission, a missing input, or a bad mapping, then resume the run from its last checkpoint with each finished item marked so nothing is collected twice. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one item, then rerun the full scope and reconcile the counts.