Error: could not create directory mkdir /.ollama: permission denied is the ollama/ollama container stopping at start because it runs as a user that has no writable home. Ollama keeps its key and its models under $HOME/.ollama; run the container as a user that owns that folder, and if you mount a volume there, give the volume to that user once with chown.

In the test, --user 1000:1000 (the image's ubuntu user) with a named volume at /home/ubuntu/.ollama, chowned to 1000:1000, started and pulled a model. Two related messages from the same mistake are shown below.

The error

PS> docker run -d --name fix10-ol-u2 --user 2000:2000 -p 127.0.0.1:15191:11434 ollama/ollama
5d2058005ad4fb625c661bc0282cf1d9734f17c03c968e8962d5c47670180b27
PS> docker logs fix10-ol-u2
Couldn't find '/.ollama/id_ed25519'. Generating new private key.
Error: could not create directory mkdir /.ollama: permission denied

The container's status four seconds later was Exited (1).

Why it happens

The first line of the log shows where Ollama looks: /.ollama, because user 2000 has no entry in the image: getent passwd 2000 found nothing (exit 2), while getent passwd 1000 printed ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash. ls -ld / showed / owned by root with drwxr-xr-x, so the directory cannot be made and the server exits before it listens. The same image run with --user 1000:1000 and no volume started fine, because uid 1000 is the image's ubuntu user with the home /home/ubuntu.

A new named volume mounted over that home gives the second message, because a fresh named volume came up owned by root (ls -ldn on a new one showed 0 0 and drwxr-xr-x): 

Couldn't find '/home/ubuntu/.ollama/id_ed25519'. Generating new private key.
Error: open /home/ubuntu/.ollama/id_ed25519: permission denied

And a models volume mounted read-only (-v fix10-ol-models:/root/.ollama:ro) gives the third, even as root, because the key file is written to the same folder: 

Couldn't find '/root/.ollama/id_ed25519'. Generating new private key.
Error: open /root/.ollama/id_ed25519: read-only file system

The fix

PS> docker rm -f -v fix10-ol-ok
PS> docker run --rm --name fix10-ol-chown -v fix10-ol-data:/data alpine chown -R 1000:1000 /data
PS> docker run -d --name fix10-ol-ok --user 1000:1000 -v fix10-ol-data:/home/ubuntu/.ollama -p 127.0.0.1:15193:11434 ollama/ollama
0f17572a6fefebe28760d45520e125cf68bae485c82d7add3fd2ac9d0d9a67f7
...
PS> docker exec fix10-ol-ok id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu)
PS> docker exec fix10-ol-ok ollama pull all-minilm
success
...
PS> docker exec fix10-ol-ok ls -ln /home/ubuntu/.ollama
total 16
drwxr-xr-x 2 1000 1000 4096 Nov 13 05:26 cache
-rw------- 1 1000 1000  387 Nov 13 05:26 id_ed25519
-rw-r--r-- 1 1000 1000   81 Nov 13 05:26 id_ed25519.pub
drwxr-xr-x 6 1000 1000 4096 Nov 13 05:26 models

The one-off alpine container runs as root, changes the owner of the volume to 1000, and exits. After that the server starts, writes its key and pulls into the volume. The container, volume and port names are the test's own; use your own names and the mount path that matches the user you choose. For the read-only case, drop :ro from the mount: in the test the server wrote to that folder at start. Leaving out --user runs the image as root with /root/.ollama, as the read-only test's log shows, and is the other way out.

How it was reproduced

On Windows 11 with Docker Desktop and the cached ollama/ollama:latest image, whose log reported version 0.40.8. Each container was started detached on a loopback port, its status read after four seconds and its log saved: user 1000 without a volume, user 2000, user 1000 with a new named volume, and root with a read-only volume. The volume was then chowned with alpine and the user-1000 container started again and pulled all-minilm.

Frequently asked

Why does the Ollama container say mkdir /.ollama permission denied?
It was started with a --user id that has no entry in the image's passwd file (uid 2000 in the test), so Ollama tried to create /.ollama in the root folder and was refused. Run it as uid 1000, the image's ubuntu user, or as root.
How do I run the ollama/ollama image as a non-root user with a volume?
Chown the volume to that user once, for example with a throwaway alpine container running chown -R 1000:1000, then mount it at /home/ubuntu/.ollama and start with --user 1000:1000.
Can I mount the Ollama models folder read-only in Docker?
Not the whole .ollama folder. In the test with a read-only mount the server stopped at start with read-only file system, because it writes its id_ed25519 key file there.

More decoded errors in the Fixes category. If the container runs but answers slowly, check the GPU flags; see Ollama in Docker at 100% CPU.