Docker find chmod fast readability

chmod smart in Docker (find -not -perm)

When to use

• You want world-readable app files inside a container so docker run --user $(id -u):$(id -g) works for arbitrary host users.
• Your /app has hundreds of thousands of files (node_modules - looking at you).
• chmod -R o+r /app takes minutes and explodes the layer size.

How it works

chmod -R walks every inode and writes the new mode unconditionally. find -not -perm only invokes chmod on files that actually need it:

RUN find /app -not -perm -o=r -exec chmod o+r {} + && \
    find /app -type d -not -perm -o=x -exec chmod o+x {} +

• -o=r / -o=x = "other has read/execute". -not -perm -o=r = "other is missing read".
• -exec chmod o+r {} + = batch up arguments (like xargs), one chmod per batch instead of per file.
• Directory pass is separate because you want o+x (traversability) not o+r on dirs if you're being precise.

Example

Slow:

RUN chmod -R o+r /app  # ~3 minutes on 300k files

Fast:

RUN find /app -not -perm -o=r -exec chmod o+r {} + && \
    find /app -type d -not -perm -o=x -exec chmod o+x {} +
# ~15 seconds, and the layer is tiny because most files didn't actually change

Gotchas

• Layer size: chmod -R rewrites every file even if mode didn't change, bloating the diff layer. The find approach writes only deltas.
• Don't forget BOTH passes - if you only o+r, dirs without o+x make files unreachable.
• -exec {} + > -exec {} \; by 10-100x because it batches.
• Symlinks: by default chmod follows, find doesn't; add -L if symlink targets matter.
• This trick is especially valuable for images that wrap Node/Bun monorepos.