ckan / ckan/ckan-docker-base

Fix Permission denied: '/var/lib/ckan/storage/uploads/group'

Open
#41 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
35
Forks
41
PR merge metrics
No merged PRs in 30d

Description

## Expected Behavior
After editing the organization and click `create`, the organization is correctly persisted.

## Current Behavior
After editing the organization, when `create` is clicked, 500 is thrown, and the following log is printed:

```
gdi-userportal-ckan-deployment-ckan-1 | 2023-12-27 20:11:46,577 INFO [ckan.config.middleware.flask_app] 200 /api/i18n/en render time 0.010 seconds
gdi-userportal-ckan-deployment-ckan-1 | 2023-12-27 20:12:11,074 ERROR [ckan.config.middleware.flask_app] [Errno 13] Permission denied: '/var/lib/ckan/storage/uploads/group'
gdi-userportal-ckan-deployment-ckan-1 | Traceback (most recent call last):
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/app.py", line 1516, in full_dispatch_request
gdi-userportal-ckan-deployment-ckan-1 | rv = self.dispatch_request()
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/app.py", line 1502, in dispatch_request
gdi-userportal-ckan-deployment-ckan-1 | return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args)
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/views.py", line 84, in view
gdi-userportal-ckan-deployment-ckan-1 | return current_app.ensure_sync(self.dispatch_request)(*args, **kwargs)
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/site-packages/flask/views.py", line 158, in dispatch_request
gdi-userportal-ckan-deployment-ckan-1 | return current_app.ensure_sync(meth)(*args, **kwargs)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/config/middleware/../../views/group.py", line 862, in post
gdi-userportal-ckan-deployment-ckan-1 | group = _action(u'group_create')(context, data_dict)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/logic/__init__.py", line 580, in wrapped
gdi-userportal-ckan-deployment-ckan-1 | result = _action(context, data_dict, **kw)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/logic/action/create.py", line 946, in organization_create
gdi-userportal-ckan-deployment-ckan-1 | return _group_or_org_create(context, data_dict, is_org=True)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/logic/action/create.py", line 739, in _group_or_org_create
gdi-userportal-ckan-deployment-ckan-1 | upload = uploader.get_uploader('group')
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/lib/uploader.py", line 61, in get_uploader
gdi-userportal-ckan-deployment-ckan-1 | upload = Upload(upload_to, old_filename)
gdi-userportal-ckan-deployment-ckan-1 | File "/srv/app/src/ckan/ckan/lib/uploader.py", line 129, in __init__
gdi-userportal-ckan-deployment-ckan-1 | os.makedirs(self.storage_path)
gdi-userportal-ckan-deployment-ckan-1 | File "/usr/lib/python3.10/os.py", line 225, in makedirs
gdi-userportal-ckan-deployment-ckan-1 | mkdir(name, mode)
gdi-userportal-ckan-deployment-ckan-1 | PermissionError: [Errno 13] Permission denied: '/var/lib/ckan/storage/uploads/group'
gdi-userportal-ckan-deployment-ckan-1 | 2023-12-27 20:12:11,111 INFO [ckan.config.middleware.flask_app] 500 /organization/new render time 0.061 seconds
```

## Possible Solution
The folder `/var/lib/ckan/storage/uploads/group` does not exist when the exception happens. So I tested two things:
- `mkdir /var/lib/ckan/storage/uploads/group`
- `chmod u+rwx /var/lib/ckan`

I believe there is some inconsistence with user permissions. The second command seems more reasonable to me, but I am not aware of other possible implications, that is why I oppened this bug.

## Steps to Reproduce

1. Build a custom CKAN docker image (e.g. https://github.com/GenomicDataInfrastructure/gdi-userportal-ckan-docker).
2. Run docker image using docker compose v2 (e.g. https://github.com/GenomicDataInfrastructure/gdi-userportal-ckan-deployment).
3. Add organization
4. Click `create`

## Context (Environment)

OS: `Darwin 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:55:06 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T6020 arm64`
Docker: `Docker version 24.0.6, build ed223bc820`
Colima: `colima version 0.5.5`

## Detailed Description
On line 94, the user `ckan` is set as owner of the folder `${CKAN_STORAGE_PATH}`. On top of it, we could ensure the owner has rights to read, write and execute files.

## Possible Implementation
Replace line 93 and 94 from ckan-base [Dockerfile](
https://github.com/ckan/ckan-docker-base/blob/cbd8878de7a234d4187fd8669b40f4bce80f6692/ckan-2.10/base/Dockerfile#L93C1-L94C44) by the following command?
```
RUN mkdir -p ${CKAN_STORAGE_PATH} && \
chown -R ckan:ckan ${CKAN_STORAGE_PATH} && \
chmod u+rwx ${CKAN_STORAGE_PATH}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with lines 93–94 of the ckan-base Dockerfile linked in the issue and review how ${CKAN_STORAGE_PATH} is created and owned. Reproduce with the listed Docker Compose steps, then verify that creating an organization does not return a 500 and that the CKAN user can create the uploads/group directory.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.