"Operation not permitted" while deploying an app with containerized Dokku 0.36.3

[baobaab]

I encountered this error during step Adding shared deployment-keys to build environment. It seems that dokku (run as container) cannot remove a Docker-created temporary file.

remote: -----> Adding shared deployment-keys to build environment
remote:        Creating .ssh folder for deployment-keys
remote: 23e58405e44ce2f491a8a5c540c5d8e5b84e767c2c577253ebc1276e3e7d55e9
remote: rm: cannot remove '/tmp/dokku-5639-trigger-deployment-keys-pre-build.h5snIO': Operation not permitted
remote:  !     Removing invalid image tag dokku/ruby-getting-started:latest
remote:  !     App build failed
To ssh://localhost:3022/ruby-getting-started
 ! [remote rejected] main -> main (pre-receive hook declined)
error: failed to push some refs to 'ssh://localhost:3022/ruby-getting-started'

Info:

• OS: Ubuntu 22.04.5 LTS
• Docker: 28.3.3, build 980b856
• Dokku: 0.36.3
• dokku-deployment-keys: 0.4.3

Steps to reproduce

• Run Docker-based Dokku :

ubuntu@test:~$ sudo docker run \
--rm -d \
--name dokku \
--volume /var/run/docker.sock:/var/run/docker.sock \
--publish 3022:22 \
dokku/dokku:0.36.3
Unable to find image 'dokku/dokku:0.36.3' locally
0.36.3: Pulling from dokku/dokku
2726e237d1a3: Pull complete
f06b1310da8a: Pull complete
bd4846dab7c8: Pull complete
00c4ebc1e57d: Pull complete
275a3eddc0f5: Pull complete
d30f0afba1a7: Pull complete
51cbd1568ea8: Pull complete
4f4fb700ef54: Pull complete
c6c3e7fa6dd3: Pull complete
769af116815d: Pull complete
Digest: sha256:cb145a54a3dc2bdd0694da58ba6a8d982a9b69a03a1810a3b53ed1039ae485ff
Status: Downloaded newer image for dokku/dokku:0.36.3
9659f8721408db0e6e2a95272f614c6aabd67195921f7e0f1b874d3afd71b381

• Configure SSH key :

ubuntu@test:~$ ssh-keygen -q -t rsa -b 2048 -N ''
Enter file in which to save the key (/home/ubuntu/.ssh/id_rsa):
ubuntu@test:~$ cat /home/ubuntu/.ssh/id_rsa.pub | sudo docker exec -i dokku dokku ssh-keys:add test
SHA256:GtiD0Li5HzmS4ZYuNBHkHvao2x6wJ4FPVZANhnLaUTg

• Install plugin :

ubuntu@test:~$ sudo docker exec -it dokku dokku plugin:install https://github.com/cedricziel/dokku-deployment-keys.git --committish 0.4.3 --name deployment-keys
-----> Cloning plugin repo https://github.com/cedricziel/dokku-deployment-keys.git to /var/lib/dokku/plugins/available/deployment-keys
Cloning into 'deployment-keys'...
remote: Enumerating objects: 380, done.
remote: Counting objects: 100% (198/198), done.
remote: Compressing objects: 100% (132/132), done.
remote: Total 380 (delta 140), reused 104 (delta 62), pack-reused 182 (from 1)
Receiving objects: 100% (380/380), 91.73 KiB | 3.99 MiB/s, done.
Resolving deltas: 100% (224/224), done.
-----> Plugin deployment-keys enabled
Plugin (deployment-keys) updated and pinned to 0.4.3
 !     You haven't deployed any applications yet
Adding user dokku to group adm
-----> Priming bash-completion cache

• Prepare app to deploy :

ubuntu@test:~$ git clone https://github.com/heroku/ruby-getting-started
Cloning into 'ruby-getting-started'...
remote: Enumerating objects: 695, done.
remote: Counting objects: 100% (261/261), done.
remote: Compressing objects: 100% (132/132), done.
remote: Total 695 (delta 209), reused 129 (delta 129), pack-reused 434 (from 2)
Receiving objects: 100% (695/695), 182.96 KiB | 6.10 MiB/s, done.
Resolving deltas: 100% (315/315), done.
ubuntu@test:~$ sudo docker exec dokku dokku apps:create ruby-getting-started
-----> Creating ruby-getting-started...
-----> Creating new app virtual host file...
ubuntu@test:~$ cd ruby-getting-started/
ubuntu@test:~/ruby-getting-started$ git remote add dokku ssh://dokku@localhost:3022/ruby-getting-started

• (Try to) deploy app :

ubuntu@test:~/ruby-getting-started$ git push dokku main
The authenticity of host '[localhost]:3022 ([127.0.0.1]:3022)' can't be established.
ED25519 key fingerprint is SHA256:ZnX0WzzmKrNPPkugM99OjMysNDm+Okf5yfZNpfpCA18.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:3022' (ED25519) to the list of known hosts.
Enumerating objects: 654, done.
Counting objects: 100% (654/654), done.
Delta compression using up to 8 threads
Compressing objects: 100% (317/317), done.
Writing objects: 100% (654/654), 174.80 KiB | 174.80 MiB/s, done.
Total 654 (delta 303), reused 651 (delta 302), pack-reused 0
remote: Resolving deltas: 100% (303/303), done.
-----> Set main as deploy-branch
remote: -----> Cleaning up...
remote: -----> Building ruby-getting-started from herokuish
remote: -----> Setting config vars
remote:        CURL_CONNECT_TIMEOUT:  90
remote: -----> Setting config vars
remote:        CURL_TIMEOUT:  600
remote: -----> Adding BUILD_ENV to build environment...
remote:        BUILD_ENV added successfully
remote: -----> Adding shared deployment-keys to build environment
remote:        Creating .ssh folder for deployment-keys
remote: 23e58405e44ce2f491a8a5c540c5d8e5b84e767c2c577253ebc1276e3e7d55e9
remote: rm: cannot remove '/tmp/dokku-5639-trigger-deployment-keys-pre-build.h5snIO': Operation not permitted
remote:  !     Removing invalid image tag dokku/ruby-getting-started:latest
remote:  !     App build failed
To ssh://localhost:3022/ruby-getting-started
 ! [remote rejected] main -> main (pre-receive hook declined)
error: failed to push some refs to 'ssh://localhost:3022/ruby-getting-started'