Why does my Docker container say permission denied for mkdir?

This usually happens when the container process (running as "node" user) attempts to write to a volume mounted with root-only permissions.

How do I fix volume permissions?

You can use "chown" on the host machine directory or set the correct "user" flag in your docker-compose.yml.

Fix Docker "EACCES" Permission Errors

Filesystem Lockout

If your Docker logs show EACCES: permission denied, mkdir /home/node/.openclaw, the OpenClaw process inside the container doesn't have rights to create its own workspace.

This commonly occurs when mounting local folders as volumes. Docker often maps these as owned by root, but the OpenClaw image runs as the node user (UID 1000).

Next Step

Fix now, then reduce repeat incidents

If this issue keeps coming back, validate your setup in Doctor first, then harden your config.

Open Doctor Harden Config

Need proactive alerts? Join Monitor early access.

Symptoms

Error: EACCES: permission denied, mkdir '/home/node/.openclaw/agents/main/agent'

Fix 1: Host Directory Permissions (Easiest)

Run this command on your Host Machine (the one running Docker) to grant the container's user ownership of the mapped folder.

Fix permissions on host

sudo chown -R 1000:1000 ./.openclaw

Fix 2: Docker Compose User Mapping

You can explicitly tell Docker to run the container using your current host user's ID. This ensures files created by the container match your host permissions.

Update docker-compose.yml

services:
  openclaw:
    image: openclaw/gateway:latest
    user: "1000:1000"  # Force match host UID/GID
    volumes:
      - ./.openclaw:/home/node/.openclaw

Fix 3: Using a Docker Volume (Recommended for Cloud)

If you don't need to edit the config files manually from the host, using a named volume avoids permission issues entirely as Docker manages the permissions automatically.

volumes:
  openclaw_data:

services:
  openclaw:
    volumes:
      - openclaw_data:/home/node/.openclaw

Verification

Restart the container and check the logs. If you see 🚀 OpenClaw gateway listening instead of the EACCES error, the permissions are correctly set.

Did this guide solve your problem?