error "permission for /opt/config nodebb" in installing with Docker compose

control1390

@phenomlab said in error "permission for /opt/config nodebb" in installing with Docker compose:

@control1390 said in error "permission for /opt/config nodebb" in installing with Docker compose:

panic: no write permission for /opt/config nodebb

This says it all. You'll need to ensure that your nodebb user has sufficient permission to that path

So do you think there is a problem with Dockerfile in GitHub?
Because this is happening inside the container and the container is based on the image made from the docker file.

docker file content:
FROM --platform=$BUILDPLATFORM node:lts as npm

RUN mkdir -p /usr/src/build &&
chown -R node:node /usr/src/build
WORKDIR /usr/src/build

ARG NODE_ENV
ENV NODE_ENV $NODE_ENV

COPY --chown=node:node install/package.json /usr/src/build/package.json

USER node

RUN npm install --omit=dev

FROM node:lts as rebuild

ARG BUILDPLATFORM
ARG TARGETPLATFORM

RUN mkdir -p /usr/src/build &&
chown -R node:node /usr/src/build

COPY --from=npm /usr/src/build /usr/src/build

RUN if [ $BUILDPLATFORM != $TARGETPLATFORM ]; then
npm rebuild &&
npm cache clean --force; fi

FROM node:lts-slim as run

ARG NODE_ENV
ENV NODE_ENV=$NODE_ENV
daemon=false
silent=false

RUN mkdir -p /usr/src/app &&
chown -R node:node /usr/src/app

COPY --chown=node:node --from=rebuild /usr/src/build /usr/src/app

WORKDIR /usr/src/app

USER node

COPY --chown=node:node . /usr/src/app

EXPOSE 4567
VOLUME ["/usr/src/app/node_modules", "/usr/src/app/build", "/usr/src/app/public/uploads", "/opt/config"]
ENTRYPOINT ["./install/docker/entrypoint.sh"]

douglasparker

My nodebb docker installation randomly broke and the logs are showing the same error.

There is definitely something wrong with the docker image.

ernstki

I wish I had better Docker comprehension to establish what the original author of the Dockerfile in the repo was trying to accomplish, with regards to all the USER nodes and chmods. Don't Docker services normally just run as the root user inside the container?

In any event, if you remove all the chown -R node:nodes, --chown=node:nodes, and USER nodes from the Dockerfile, then docker-compose build, then docker-compose up, you might have yourself a workaround. That's what I did. Granted, I'm not running a Docker image in production, just trying NodeBB out for the first time. A bad time to run into a problem like this, to be honest—fortunately I'm stubborn/persistent. :)

If you need more of a nudge than the above, I'd encourage you to wait until someone with more experience weighs in on the discussion here, in the PR that originated these changes to the Dockerfile.

douglasparker

@ernstki It’s best practice to drop down to a non root user for docker images for security purposes.

I could submit a PR but what bothers me most is breaking changes that don’t get resolved for months.

I like nodebb but I am afraid to run it in production for a community due to breaking changes like this that go unnoticed / ignored.

ernstki

@douglasparker said in error "permission for /opt/config nodebb" in installing with Docker compose:

@ernstki It’s best practice to drop down to a non root user for docker images for security purposes.

Agreed, in any other context. My Docker daemon is already running non-root, which I thought was the actual best practice.

I get that container security is complex, and the topic of countless blog posts and conference talks, but the fact remains I've not (yet!) seen many other examples of popular containerized software in the wild doing this in their Dockerfiles, and that incongruity is what made me wonder.

nhl.pl

You can see how it works in Podman (lightweight alternative to Docker).

Nobbic (NodeBB In a Container) GitHub repository:

chown -R node:node search returns 3 files:
https://github.com/search?q=repo%3Aahwayakchih%2Fnobbic+"node%3Anode"&type=code

and one file for USER node search:
https://github.com/search?q=repo%3Aahwayakchih%2Fnobbic+"USER+node"&type=code

ernstki

@nhl-pl At first I didn't know what I was looking at, and just thought, well, that's what the Dockerfile in the NodeBB repo already does, so why is this interesting?

But they're similar enough that maybe there was some cross-pollination of the NodeBB Dockerfile with the setup scripts for the Podman rendition, from the nobbic repo. Things were copy-pasted because they worked, not because they were needed. That's relatable though.

The nobbic maintainers helpfully commented the script(s), which is really the only way to let other people inside your head about decisions like this. The why of it is probably still not clear to me just due to my relative inexperience with running production web applications in containers.

nhl.pl

You have answered your own question. Reason for making it like this is to secure Node.js from abuse. You can find more by reading about Node.js disadvantages and maybe a little about Deno (runtime environment for JavaScript and TypeScript).

ernstki

@nhl-pl OK, thanks.

ernstki

@nhl-pl Since the Dockerfile in the NodeBB is currently misbehaving as stated above, or at the very least the documentation is lacking in that it doesn't tell you you must create a local node user*, do you have a recommendation of how to move forward?

* …at least I think that's the problem/solution

nhl.pl

You can experiment with some other guides and projects.

As you probably seen before:

https://hub.docker.com/r/nibrev/nodebb

One more option is to make your own modified Dockerfile. For example Nobbic works on Alpine Linux based Docker images and most of the NodeBB guides are Ubuntu/Debian based. So first thing is to check the host machine/hosting provider and what is going on when you execute Dockerfile. Including Docker version which was mentioned many times on this forum.