Composer fails due to permission issues

[mbrodala]

When running composer install I see some permission issues:

/app $ composer inst
You are running composer with xdebug enabled. This has a major impact on runtime performance. See https://getcomposer.org/xdebug
Gathering patches for root package.
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Gathering patches for root package.
Gathering patches for dependencies. This might take a minute.
  - Installing typo3/cms (6.2.27)
    Downloading: 100%
    Failed to download typo3/cms from dist: Could not delete /app/typo3_src/6e2e4a4c969f6e0c1ba198d6ebaa60a3:
    Now trying to download from source
  - Installing typo3/cms (6.2.27)
    Cloning d3b7196b87163fb7ab7dc877287883a5df042d4a from cache

On a subsequent composer install the error becomes a bit more verbose:

/app $ composer inst
You are running composer with xdebug enabled. This has a major impact on runtime performance. See https://getcomposer.org/xdebug
Gathering patches for root package.
Loading composer repositories with package information
Installing dependencies (including require-dev) from lock file
Gathering patches for root package.
Gathering patches for dependencies. This might take a minute.
  - Installing typo3/cms (6.2.27)
    Failed to download typo3/cms from dist: Could not delete /app/typo3_src/.git/objects/pack/pack-4289f6325eeeff681eb235e9d8713a4122b49027.idx:
    Now trying to download from source
  - Installing typo3/cms (6.2.27)


  [RuntimeException]
  Could not delete /app/typo3_src/.git/objects/pack/pack-4289f6325eeeff681eb235e9d8713a4122b49027.idx:


install [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--no-custom-installers] [--no-autoloader] [--no-scripts] [--no-progress] [--no-suggest] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--ignore-platform-reqs] [--] [<packages>]...

I am not able to manually delete the mentioned directory:

$ rm -rf typo3_src
rm: cannot remove 'typo3_src/.git/objects/pack/pack-4289f6325eeeff681eb235e9d8713a4122b49027.idx': Operation not permitted
rm: cannot remove 'typo3_src/.git/objects/pack/pack-4289f6325eeeff681eb235e9d8713a4122b49027.pack': Operation not permitted
<hangs for a while>

Only removing it on the host system allows me to remove the directory and brings me back to the state before the first Composer installation.