"Unable to create the directory [/usr/local/tomcat/webapps/myapp]" error when running as non-root user

[rcsilva83]

When I run my application's container as a non-root user (id 1000) I get the error below on startup. I couldn't find any documentation on the best solution for this. I guess a chmod 777 /usr/local/tomcat/webapps/ isn't a great solution. I found some comments on the Internet (Stackoverflow etc) indicating changing ownership of the whole Tomcat Home folder (chown -R 1000 /usr/local/tomcat/) which I don't know if would be the best approach.

What the maintainers indicate?

09-Apr-2026 13:25:18.213 SEVERE [main] org.apache.catalina.startup.ContextConfig.beforeStart Exception fixing docBase for context [/myapp]
 java.io.IOException: Unable to create the directory [/usr/local/tomcat/webapps/myapp]
  at org.apache.catalina.startup.ExpandWar.expand(ExpandWar.java:107)
  at org.apache.catalina.startup.ContextConfig.fixDocBase(ContextConfig.java:811)
  at org.apache.catalina.startup.ContextConfig.beforeStart(ContextConfig.java:947)
  at org.apache.catalina.startup.ContextConfig.lifecycleEvent(ContextConfig.java:290)
  at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:109)
  at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:389)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:163)
  at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:597)
  at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:569)
  at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:665)
  at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:962)
  at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1900)
  at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
  at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
  at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:81)
  at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:123)
  at org.apache.catalina.startup.HostConfig.deployWARs(HostConfig.java:766)
  at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:417)
  at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1618)
  at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:300)
  at org.apache.catalina.util.LifecycleBase.fireLifecycleEvent(LifecycleBase.java:109)
  at org.apache.catalina.util.LifecycleBase.setStateInternal(LifecycleBase.java:389)
  at org.apache.catalina.util.LifecycleBase.setState(LifecycleBase.java:336)
  at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:774)
  at org.apache.catalina.core.StandardHost.startInternal(StandardHost.java:783)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:164)
  at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1201)
  at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1191)
  at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
  at org.apache.tomcat.util.threads.InlineExecutorService.execute(InlineExecutorService.java:81)
  at java.base/java.util.concurrent.AbstractExecutorService.submit(AbstractExecutorService.java:145)
  at org.apache.catalina.core.ContainerBase.startInternal(ContainerBase.java:747)
  at org.apache.catalina.core.StandardEngine.startInternal(StandardEngine.java:201)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:164)
  at org.apache.catalina.core.StandardService.startInternal(StandardService.java:410)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:164)
  at org.apache.catalina.core.StandardServer.startInternal(StandardServer.java:868)
  at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:164)
  at org.apache.catalina.startup.Catalina.start(Catalina.java:758)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
  at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.base/java.lang.reflect.Method.invoke(Method.java:569)
  at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:342)
  at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:473)

[tianon]

I don't think chown on the entire Tomcat home is the right granularity -- maybe just /usr/local/tomcat/webapps? Inside a container, chmod 1777 /usr/local/tomcat/webapps would be mostly reasonable for this - any new directory created inside would then be owned by the user who created it exclusively (just like /tmp), but chown is probably better (and pre-baking in your webapps in an image and keeping the entire directory read-only is likely "best").