hasura / hasura/graphql-engine

v3: error while deploy step in GCP Cloud Run getting error rm: cannot remove 'TEMP_PROJECT_DIR': Permission denied

Open
#10,096 1 comment 0 reactions 0 assignees View on GitHub
c/migrations
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Component
cli-migrations/v3

### What is the current behaviour?
I am using the `hasura/graphql-engine:v2.36.0.cli-migrations-v3` Docker image for custom Hasura configuration. When deploying this custom image using Google Cloud Run service and attempting to run it as a **non-root** user, an error is occurring.

### What is the expected behaviour?
The Image should be deployed successfully using GCP Cloud Run service with custom metadata and migration provided during the build process of the image using Dockerfile.

### How to reproduce the issue?
Current Configuration of **Dockerfile**

```
# Use the official Hasura image as the base image
FROM hasura/graphql-engine:v2.36.0.cli-migrations-v3

# Set the working directory inside the container
WORKDIR /hasura

# Copy your migrations and metadata to the container
COPY /hasura/migrations /hasura-migrations
COPY /hasura/metadata /hasura-metadata

RUN chmod 755 /bin/docker-entrypoint.sh
# Change ownership before switching users
RUN chown -R 1001:1001 /hasura-metadata /hasura-migrations

# Switch to the non-root user
USER 1001

# Automatically apply migrations and metadata when the container starts
CMD ["graphql-engine", "serve"]
```
1. Using GCP Cloud Build to build an image using Dockerfile.
2. Store Image in GCP Artifactory.
3. Use GCP Cloud Run which points to artifactory image and deploys the image.

### Screenshots or Screencast
Screenshot 2024-01-11 at 12 41 53 PM

### Please provide any traces or logs that could help here.
Screenshot 2024-01-11 at 12 35 57 PM

### Any possible solutions/workarounds you're aware of?
1. Workaround or quick-fix that can help is replace `TEMP_PROJECT_DIR` with `$TEMP_PROJECT_DIR` in `docker-entrypoint.sh`
Reference Line: https://github.com/hasura/graphql-engine/blob/master/packaging/cli-migrations/v3/docker-entrypoint.sh#L72

Contributor guide

Open the contributing guide

Research direction

Start at packaging/cli-migrations/v3/docker-entrypoint.sh, especially line 72, and compare its temporary project directory handling with the reported non-root Dockerfile setup. Reproduce the image startup with user 1001 and verify that custom metadata and migrations deploy successfully on Cloud Run without the permission error.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, google-cloud, shell
Domain
cli, cloud, devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.