corepack enable "EACCES permission denied" - Fix Shim Install in CI

By Kaveh Alemi·Latchkey

corepack enable writes yarn/pnpm shims into Node’s install bin directory. If that directory is root-owned and the build runs as non-root, the symlink creation fails with EACCES.

What this error means

corepack enable errors with EACCES while creating shims in a Node bin path. It is common in Docker images where Node is installed as root but the build user is non-root.

Corepack output

Error: EACCES: permission denied, symlink '../lib/node_modules/corepack/dist/pnpm.js'
'/usr/local/bin/pnpm'

Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, .npmrc files at several levels, and environment variables all combine before a request is made.

Terminal

# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1

Common causes

The Node bin directory is owned by root

Corepack tries to symlink shims into e.g. /usr/local/bin, which the non-root build user cannot modify.

corepack enable run without sufficient privilege

In CI the step runs as the build user; without ownership or a writable install dir, shim creation is denied.

How to fix it

Enable Corepack with the right privilege or target

Either run enable as root in the image build, or point shims at a user-writable dir.

Dockerfile / Terminal

# in a Dockerfile, while still root:
RUN corepack enable

# or as non-root, install shims to a writable dir:
corepack enable --install-directory "$HOME/.local/bin"
export PATH="$HOME/.local/bin:$PATH"

Fix ownership of the bin path

In images, run corepack enable during the root-privileged build phase.
For ad hoc CI, use --install-directory pointing at a user-owned PATH entry.
Avoid sudo for per-run enabling; bake it into the image instead.

How to prevent it

Enable Corepack at image-build time as root.
Use a user-writable install directory for non-root runs.
Keep package-manager provisioning in the image, not per-job.

Frequently asked questions

What causes corepack enable "EACCES permission denied"?

There are 2 common causes: the node bin directory is owned by root and corepack enable run without sufficient privilege. Corepack tries to symlink shims into e.g.

How do I fix corepack enable "EACCES permission denied"?

There are 2 fixes depending on which cause you have: enable corepack with the right privilege or target and fix ownership of the bin path. Work through them in order, since the first is the most common.

What does corepack enable "EACCES permission denied" actually mean?

corepack enable errors with EACCES while creating shims in a Node bin path.

How do I stop corepack enable "EACCES permission denied" happening again?

Enable Corepack at image-build time as root. The prevention section lists 3 changes that keep it from recurring.