From 69ce41d54f41ab66480f2864a870052cfe3df600 Mon Sep 17 00:00:00 2001 From: NixReaper Date: Sat, 5 Sep 2026 07:35:50 -0500 Subject: [PATCH] Fix media volume permission denied for the non-root worker/api user Neither Dockerfile created /app/media before switching to the non-root `aurora` user, so a fresh named volume mounted there (docker-compose.yml's aurora_media_data) defaulted to root ownership -- Docker only auto-populates a volume's initial content/ownership from the image the first time it's mounted, and nothing in the image owned that path yet. The worker's first artwork download then failed with a permission error trying to mkdir a subdirectory under it. Creating and chowning /app/media to aurora before USER aurora fixes this for any volume created fresh after this build; an already-created volume from a prior `up --build` needs a one-time manual fix (`docker compose exec -u root worker chown -R aurora:aurora /app/media`) since Docker won't retroactively re-populate an existing volume. Co-Authored-By: Claude Sonnet 5 --- docker/api.Dockerfile | 4 ++++ docker/worker.Dockerfile | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/docker/api.Dockerfile b/docker/api.Dockerfile index 2acb772..f67b71d 100644 --- a/docker/api.Dockerfile +++ b/docker/api.Dockerfile @@ -30,6 +30,10 @@ COPY --from=builder /usr/local/bin /usr/local/bin COPY app ./app COPY migrations ./migrations COPY alembic.ini ./alembic.ini +# Owned by aurora *before* the volume mount happens — see worker.Dockerfile +# for why (a fresh named volume otherwise defaults to root-owned, which the +# non-root `aurora` user below can't write into). +RUN mkdir -p /app/media && chown -R aurora:aurora /app/media USER aurora diff --git a/docker/worker.Dockerfile b/docker/worker.Dockerfile index 92b1e84..cac5154 100644 --- a/docker/worker.Dockerfile +++ b/docker/worker.Dockerfile @@ -31,6 +31,12 @@ RUN useradd --create-home --uid 1000 aurora COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages COPY --from=builder /usr/local/bin /usr/local/bin COPY app ./app +# Owned by aurora *before* the volume mount happens: Docker populates a +# fresh named volume (docker-compose.yml's aurora_media_data) from whatever +# already exists at its mount point in the image, ownership included. Skip +# this and a brand-new volume defaults to root-owned, which the non-root +# `aurora` user below can't write into. +RUN mkdir -p /app/media && chown -R aurora:aurora /app/media USER aurora