Docker error "Mounts denied" running example workflows from CWL User Guide on Mac OS X

Question

[Kevin Ernst]

On Mac OS X 10.11 (El Capitan) with Docker CE 17.03 installed, I get the following error when attempting to run the workflow from Section 2.6 ("Running tools inside Docker") of the CWL User Guide.

$ cwl-runner docker.cwl docker-job.yml
/Users/kernst/devel/WRL/cwl-workshop-20170614/venv/bin/cwl-runner 1.0.20170525215327
Resolved 'docker.cwl' to 'file:///Users/kernst/devel/WRL/cwl-workshop-20170614/2.6/docker.cwl'
[job docker.cwl] /var/folders/wd/mxmxhy7d0k3g5jj7fq3qqxsr0000gn/T/tmp67GTcz$ docker \
    run \
    -i \
    --volume=/private/var/folders/wd/mxmxhy7d0k3g5jj7fq3qqxsr0000gn/T/tmp67GTcz:/private/var/spool/cwl:rw \
    --volume=/private/var/folders/wd/mxmxhy7d0k3g5jj7fq3qqxsr0000gn/T/tmpjGKOQx:/tmp:rw \
    --volume=/Users/kernst/devel/WRL/cwl-workshop-20170614/2.6/hello.js:/private/var/lib/cwl/stg86aa3704-7174-4ba9-8498-39e973dcc709/hello.js:ro \
    --workdir=/private/var/spool/cwl \
    --read-only=true \
    --user=501 \
    --rm \
    --env=TMPDIR=/tmp \
    --env=HOME=/private/var/spool/cwl \
    node:slim \
    node \
    /private/var/lib/cwl/stg86aa3704-7174-4ba9-8498-39e973dcc709/hello.js
docker: Error response from daemon: Mounts denied:  known to Docker.
You can configure shared paths from Docker -> Preferences... -> File Sharing.
See https://docs.docker.com/docker-for-mac/osxfs/#namespaces for more info.
.
el/WRL/cwl-workshop-20170614/2.6/hello.js
are not shared from OS X and are not.
ERRO[0000] error getting events from daemon: net/http: request canceled
[job docker.cwl] completed permanentFail
{}
Final process status is permanentFail

Is this just a problem with my Docker setup, or might the --tmpdir-prefix or --tmp-outdir-prefix command-line options to cwl-runner somehow help me resolve this issue?

Answer 1

[Kevin Ernst]

This is an issue of the Docker daemon not having appropriate permissions to the host filesystem. Bind mounds and filesystem sharing have changed quite a bit with the new (native) Docker for Mac, as compared to the old Boot2Docker and Docker Toolbox. Directories on the host which Docker instances may access ("bind mount") must be explicitly defined.

In this particular case, the Docker daemon needed permission to my home directory under /Users, where I had saved the CWL User Guide exercise files. After a fresh installation, the "File sharing" section of the Docker preferences should look like this:

In my case, I thought I knew better than the default settings, and I said "pfff, Docker doesn't need access to anything!" This was a mistake.

Deleting the Docker app, removing old preferences files, and re-installing the Docker package solved my problem.