来自 Snakemake 中 Docker 容器的权限被拒绝错误答案

【问题标题】：Permission denied error from Docker container in Snakemake来自 Snakemake 中 Docker 容器的权限被拒绝错误
【发布时间】：2020-11-04 06:10:55
【问题描述】：

我之前用这个Dockerfile 构建了一个 Docker 容器，它运行良好：

FROM perl:5.32

MAINTAINER Matthew Jordan Oldach, moldach686@gmail.com

WORKDIR /usr/local/bin

# Install cpan modules
RUN cpanm install --force Cwd Getopt::Long POSIX File::Basename List::Util Bio::DB::Fasta Bio::Seq Bio::SeqUtils Bio::SeqIO Set::IntervalTree Set::IntSpan

RUN apt-get install tar

# Download CooVar-v0.07
RUN wget http://genome.sfu.ca/projects/coovar/CooVar-0.07.tar.gz
RUN tar xvf CooVar-0.07.tar.gz
RUN cd coovar-0.07; chmod +x scripts/* coovar.pl

# Set WORKDIR to /data -- predefined mount location.
RUN mkdir /data
WORKDIR /data

# Set Entrypoint
ENTRYPOINT ["perl", "/usr/local/bin/coovar-0.07/coovar.pl"]

唯一的问题是我发现 repo 上的内容与我们服务器上的 coovar-0.07 之间存在细微差别（extract-cdna.pl 脚本存在细微差别）。

为了重现我们的管道，我需要将 COPY CooVar 本地化到容器中（而不是 wget）。

因此我尝试了以下Dockerfile：

FROM perl:5.32

MAINTAINER Matthew Jordan Oldach, moldach686@gmail.com

WORKDIR /usr/local/bin

# Install cpan modules
RUN cpanm install --force Cwd Getopt::Long POSIX File::Basename List::Util Bio::DB::Fasta Bio::Seq Bio::SeqUtils Bio::SeqIO Set::IntervalTree Set::IntSpan

# Download CooVar-v0.07
COPY coovar-0.07 /usr/local/bin/coovar-0.07
RUN cd coovar-0.07; chmod +x scripts/* coovar.pl

# Set WORKDIR to /data -- predefined mount location.
RUN mkdir /data
WORKDIR /data

# Set Entrypoint
ENTRYPOINT ["perl", "/usr/local/bin/coovar-0.07/coovar.pl"]

看来我可以从 Docker 运行主脚本 (coovar.pl)（没有 Permission Denied 错误）：

# pull the container
$ sudo docker pull moldach686/coovar-v0.07:latest

# force entry point of `moldach686/coovar-v0.07` to /bin/bash
## in order to investigate file system
$ sudo docker run -it --entrypoint /bin/bash moldach686/coovar-v0.07

root@c7459dbe216a:/data# perl /usr/local/bin/coovar-0.07/coovar.pl 
USAGE: ./coovar.pl -e EXONS_GFF -r REFERENCE_FASTA (-t GVS_TAB_FORMAT | -v GVS_VCF_FORMAT) [-o OUTPUT_DIRECTORY] [--circos] [--feature_source] [--feature_type]
Program parameter details provided in file README.

但是，当我尝试将其合并到我的 Snakemake 工作流程中时，我收到以下 Permission Denied 错误：

Workflow defines that rule get_vep_cache is eligible for caching between workflows (use the --cache argument to enable this).
Building DAG of jobs...
Using shell: /cvmfs/soft.computecanada.ca/nix/var/nix/profiles/16.09/bin/bash
Provided cores: 1 (use --cores to define parallelism)
Rules claiming more threads will be scaled down.
Job counts:
        count   jobs
        1       coovar
        1
[Tue Nov  3 21:56:51 2020]
rule coovar:
    input: variant_calling/varscan/MTG470.vcf, refs/c_elegans.PRJNA13758.WS265.genomic.fa
    output: annotation/coovar/varscan/MTG470/categorized-gvs.gvf, annotation/coovar/varscan/MTG470.annotated.vcf, annotation/coovar/varscan/filtration/MTG470_keep.tsv, annotation/coovar/varscan/filtration/MTG470_exclude.tsv
    jobid: 0
    wildcards: sample=MTG470
    resources: mem=4000, time=10
Activating singularity image /scratch/moldach/COOVAR/cbc22e3a26af1c31fb0e4fcae240baf8.simg
Can't open perl script "/usr/local/bin/coovar-0.07/coovar.pl": Permission denied

【问题讨论】：

我建议用奇点手动尝试容器。这也是 Snakemake 所做的。有时，奇点的行为可能与 docker 略有不同。

标签： docker permission-denied snakemake

【解决方案1】：

我发现可行的解决方案是以下行添加到Dockerfile：

RUN echo "user ALL=NOPASSWD: ALL" >> /etc/sudoers

这会将user 添加到授予权限的sudoers 文件中：

FROM perl:5.32

MAINTAINER Matthew Jordan Oldach, moldach686@gmail.com

USER root
WORKDIR /usr/local/bin

# Install cpan modules
RUN cpanm install --force Cwd Getopt::Long POSIX File::Basename List::Util Bio::DB::Fasta Bio::Seq Bio::SeqUtils Bio::SeqIO Set::IntervalTree Set::IntSpan
RUN echo "user ALL=NOPASSWD: ALL" >> /etc/sudoers

# Download CooVar-v0.07
COPY coovar-0.07 /usr/local/bin/coovar-0.07
RUN cd coovar-0.07; chmod a+rwx scripts/* coovar.pl
# Download Bedtools 2.27.1
ENV VERSION 2.27.1
ENV NAME bedtools2
ENV URL "https://github.com/arq5x/bedtools2/releases/download/v${VERSION}/bedtools-${VERSION}.tar.gz"
WORKDIR /tmp
RUN wget -q -O - $URL | tar -zxv && \
cd ${NAME} && \
make -j 4 && \
cd .. && \
cp ./${NAME}/bin/bedtools /usr/local/bin/ && \
strip /usr/local/bin/*; true && \
rm -rf ./${NAME}/


# Set WORKDIR to /data -- predefined mount location.
RUN mkdir /data
WORKDIR /data

# Set Entrypoint
ENTRYPOINT ["perl", "/usr/local/bin/coovar-0.07/coovar.pl"]

【讨论】：