Cannot (force) remove directory in Docker build

Question

With this Dockerfile:

FROM php:5.4-fpm
RUN apt-get -qqy update \
 && apt-get -qqy install git \
                     libcurl4-gnutls-dev \
                     libmcrypt-dev \
                     libpng12-dev \
                     libxml2-dev \
                     libxslt-dev \
 && docker-php-ext-install curl \
                       bcmath \
                       gd \
                       mcrypt \
                       mysql \
                       soap \
                       xsl \
                       zip \
 && rm -rf /var/lib/apt/lists

I get the error

rm: cannot remove '/var/lib/apt/lists': Directory not empty

But if I separate out the rm into another RUN statement, suddenly the error goes away.

FROM php:5.4-fpm
RUN apt-get -qqy update \
 && apt-get -qqy install git \
                     libcurl4-gnutls-dev \
                     libmcrypt-dev \
                     libpng12-dev \
                     libxml2-dev \
                     libxslt-dev \
 && docker-php-ext-install curl \
                       bcmath \
                       gd \
                       mcrypt \
                       mysql \
                       soap \
                       xsl \
                       zip
RUN rm -rf /var/lib/apt/lists

rm is just /bin/rm in the php:5.4-fpm container. Why is docker build unable to remove /var/lib/apt/lists in the first case, and why is it exiting with a nonzero exit status even with the -f flag?

Answer 1

According to the Docker development discussion this is the number 1 known issue in the Docker docs. Here is the current release note reference.

Unexpected File Permissions in Containers An idiosyncrasy in AUFS prevents permissions from propagating predictably between upper and lower layers. This can cause issues with accessing private keys, database instances, etc. For complete information and workarounds see Github Issue 783.

The mentioned workaround can be found on Github here