Docker "OCI runtime exec failed: permission denied" (entrypoint not +x) in CI

When the entrypoint is a script without the executable bit, the OCI runtime cannot exec it and fails with permission denied. This commonly happens when a script is COPYed from a checkout whose mode bits were not preserved, or on a Windows-authored file.

What this error means

A container fails to start with OCI runtime exec failed: exec: "...": permission denied. The named entrypoint script is not marked executable.

docker: Error response from daemon: OCI runtime create failed: runc create failed: unable to start container process: exec: "/entrypoint.sh": permission denied

Common causes

The entrypoint script is not +x

A COPYed script that lost its executable bit cannot be exec'd by the runtime.

Mode bits not preserved on checkout

Files checked out on some platforms or archives can drop the executable bit.

How to fix it

chmod the entrypoint in the Dockerfile

1. Copy the script, then mark it executable in a build step.

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

Invoke via the interpreter to sidestep the mode bit

1. Run the script through sh/bash so the executable bit is not required.

ENTRYPOINT ["sh", "/entrypoint.sh"]

How to prevent it

• chmod +x entrypoint scripts during the build.
• Keep executable bits in version control (git update-index --chmod=+x).
• Prefer invoking via an interpreter when mode bits are unreliable.

Related guides