R3ap3r/Aurora-Core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix media volume permission denied for the non-root worker/api user
CI / lint (push) Canceled after 0s
Details
CI / typecheck (push) Canceled after 0s
Details
CI / unit-tests (push) Canceled after 0s
Details
CI / integration-tests (push) Canceled after 0s
Details
CI / container-build (push) Canceled after 0s
Details
CI / dependency-audit (push) Canceled after 0s
Details

Browse Source 
Neither Dockerfile created /app/media before switching to the
non-root `aurora` user, so a fresh named volume mounted there
(docker-compose.yml's aurora_media_data) defaulted to root ownership
-- Docker only auto-populates a volume's initial content/ownership
from the image the first time it's mounted, and nothing in the image
owned that path yet. The worker's first artwork download then failed
with a permission error trying to mkdir a subdirectory under it.

Creating and chowning /app/media to aurora before USER aurora fixes
this for any volume created fresh after this build; an already-created
volume from a prior `up --build` needs a one-time manual fix
(`docker compose exec -u root worker chown -R aurora:aurora /app/media`)
since Docker won't retroactively re-populate an existing volume.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
NixReaper
2026-09-05 07:35:50 -05:00
co-authored by Claude Sonnet 5
parent 7c4bfe6cf4
commit 69ce41d54f
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/api.Dockerfile
+4
View File
@@ -30,6 +30,10 @@ COPY --from=builder /usr/local/bin /usr/local/bin
COPY app ./app
COPY migrations ./migrations
COPY alembic.ini ./alembic.ini
# Owned by aurora *before* the volume mount happens — see worker.Dockerfile
# for why (a fresh named volume otherwise defaults to root-owned, which the
# non-root `aurora` user below can't write into).
RUN mkdir -p /app/media && chown -R aurora:aurora /app/media
USER aurora
docker/worker.Dockerfile
+6
View File
@@ -31,6 +31,12 @@ RUN useradd --create-home --uid 1000 aurora
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin
COPY app ./app
# Owned by aurora *before* the volume mount happens: Docker populates a
# fresh named volume (docker-compose.yml's aurora_media_data) from whatever
# already exists at its mount point in the image, ownership included. Skip
# this and a brand-new volume defaults to root-owned, which the non-root
# `aurora` user below can't write into.
RUN mkdir -p /app/media && chown -R aurora:aurora /app/media
USER aurora