docker cp "A required privilege is not held by the client." error(gcp)

Question

I was trying to download a project file from Google cloud sdk environment and got a docker command from Google cloud support.

I fallowed these instructions:

[![enter image description here][1]][1]

I was able to run almost all the commands, but the docker cp command encountered an error "A required privilege is not held by the client." Here's what I did:

    C:\Users\*\AppData\Local\Google\Cloud SDK>gcloud auth login
    Your browser has been opened to visit:

    https://accounts.google.com/o/oauth2/auth---


    You are now logged in as [*@gmail.com].
    Your current project is [nodejs-301100].  You can change this setting by running:
    $ gcloud config set project PROJECT_ID

    C:\Users\*\AppData\Local\Google\Cloud SDK>gcloud auth configure-docker
    WARNING: Your config file at [C:\Users\*\.docker\config.json] contains these credential helper entries:

    {
      "credHelpers": {
        "gcr.io": "gcloud",
        "us.gcr.io": "gcloud",
        "eu.gcr.io": "gcloud",
        "asia.gcr.io": "gcloud",
        "staging-k8s.gcr.io": "gcloud",
        "marketplace.gcr.io": "gcloud"
      }
    }
    Adding credentials for all GCR repositories.
    WARNING: A long list of credential helpers may cause delays running 'docker build'. We recommend passing the registry name to configure only the registry you are using.
    gcloud credential helpers already registered correctly.

    C:\Users\*\AppData\Local\Google\Cloud SDK>docker pull asia.gcr.io/nodejs 301100/appengine/default.20210108t204554:latest
    latest: Pulling from nodejs-301100/appengine/default.20210108t204554
    Digest: sha256:a1bf8c73e54a357b9aa3d251e73deb0f8ffba4eecef9c6767efa666f3781c600
    Status: Image is up to date for asia.gcr.io/nodejs-301100/appengine/default.20210108t204554:latest
    asia.gcr.io/nodejs-301100/appengine/default.20210108t204554:latest

    C:\Users\*\AppData\Local\Google\Cloud SDK>docker images
    REPOSITORY                                                    TAG       IMAGE ID       CREATED       SIZE
    asia.gcr.io/nodejs-301100/appengine/default.20210108t204554   latest    b0c9100e95b4   4 weeks ago   741MB

    C:\Users\*\AppData\Local\Google\Cloud SDK>docker run -d b0c9100e95b4
    34600f7b8b20238c816a53c8dd08e19fcc0496628139d9c9251e7ad5683ef837

    C:\Users\*\AppData\Local\Google\Cloud SDK>docker ps -a
    CONTAINER ID   IMAGE          COMMAND                  CREATED          STATUS          PORTS     NAMES
    34600f7b8b20   b0c9100e95b4   "/bin/sh -c 'npm sta…"   41 seconds ago   Up 40 seconds  angry_einstein
    77bcc0536ac9   b0c9100e95b4   "/bin/sh -c 'npm sta…"   20 minutes ago   Up 20 minutes             goofy_feistel

    C:\Users\*\AppData\Local\Google\Cloud SDK>docker exec -it goofy_feistel pwd
    /app

    C:\Users\*\AppData\Local\Google\Cloud SDK>docker cp goofy_feistel:app/ google-cloud-sdk
    symlink ..\ejs\bin\cli.js C:\Users\*\AppData\Local\Google\Cloud SDK\google-cloud sdk\app\node_modules\.bin\ejs: A required privilege is not held by the client.

What should I do?

Try [running the commands as the "administrator"](https://www.howtogeek.com/194041/how-to-open-the-command-prompt-as-administrator-in-windows-8.1/) - running it as a "regular" user may cause such issues. — Wojtek_B, Feb 08 '21 at 17:14
Add your username to the group `docker-users`. 1) Open Computer Management. under `Local Users and Group` find `docker-users`. 2) Double-click on `docker-users`. Add your user name. — John Hanley, Feb 08 '21 at 19:56
@g_know please take a look at the [github](https://github.com/markshust/docker-magento/issues/50#issue-204959785) and [workaround is](https://github.com/markshust/docker-magento/issues/50#issuecomment-316209501) — Mahboob, Feb 08 '21 at 20:24
As @Wojtek_B said, the error disappeared when I ran shell in admin mode! Thanks all ! — g_know, Feb 09 '21 at 10:41
I've posted my suggestion as an reply with some more info "around" to make some context - please accept it :) — Wojtek_B, Feb 09 '21 at 11:24
@Wojtek_B - Running the command in an Administrators prompt is not a good solution and has security implications. The correct solution is to add the user to the correct group removing the requirement for administrator rights. — John Hanley, Feb 09 '21 at 19:27
Hi @JohnHanley what can I do if I uninstalled Docker Desktop and don't have this group? BTW "Local users and Group" is not available on my Win 10. — WesternGun, Sep 11 '22 at 14:42
@WesternGun - Are you running Windows 10 Home? Some features are disabled on that version. I don't know the answer. — John Hanley, Sep 11 '22 at 19:32

Wojtek_B · Answer 1 · 2021-02-10T07:43:50.130

This is OS permissions issue - Docker can't access some files;

Fix A Required Privilege Is Not Held By The Client Error: The Error 0x80070522 means that you are trying to copy or create a file inside a directory where you don’t have the required permission or privilege. Generally, you get this error when you try to copy, paste, or modify something inside Windows folders and Microsoft doesn’t allow unauthorized access to the Windows installation. Even the users are prompted with the error “A Required Privilege Is Not Held By The Client Error” because these files are strictly accessible to the only System.

Quick way is to open the command prompt as "administrator" and run the commands again.

Some clues can be found in similar questions:

and in the "workaround" github discussion @Mahboob linked in the comments.

And here's a proper way to do this as John Hanley suggested:

Running the command in an Administrators prompt is not a good solution and has security implications. The correct solution is to add the user to the correct group removing the requirement for administrator rights

Here's how to do this; here's another example.

docker cp "A required privilege is not held by the client." error(gcp)

1 Answers1

Linked