hasura / hasura/graphql-engine
v3: error while deploy step in GCP Cloud Run getting error rm: cannot remove 'TEMP_PROJECT_DIR': Permission denied
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Component
cli-migrations/v3
### What is the current behaviour?
I am using the `hasura/graphql-engine:v2.36.0.cli-migrations-v3` Docker image for custom Hasura configuration. When deploying this custom image using Google Cloud Run service and attempting to run it as a **non-root** user, an error is occurring.
### What is the expected behaviour?
The Image should be deployed successfully using GCP Cloud Run service with custom metadata and migration provided during the build process of the image using Dockerfile.
### How to reproduce the issue?
Current Configuration of **Dockerfile**
```
# Use the official Hasura image as the base image
FROM hasura/graphql-engine:v2.36.0.cli-migrations-v3
# Set the working directory inside the container
WORKDIR /hasura
# Copy your migrations and metadata to the container
COPY /hasura/migrations /hasura-migrations
COPY /hasura/metadata /hasura-metadata
RUN chmod 755 /bin/docker-entrypoint.sh
# Change ownership before switching users
RUN chown -R 1001:1001 /hasura-metadata /hasura-migrations
# Switch to the non-root user
USER 1001
# Automatically apply migrations and metadata when the container starts
CMD ["graphql-engine", "serve"]
```
1. Using GCP Cloud Build to build an image using Dockerfile.
2. Store Image in GCP Artifactory.
3. Use GCP Cloud Run which points to artifactory image and deploys the image.
### Screenshots or Screencast
### Please provide any traces or logs that could help here.
### Any possible solutions/workarounds you're aware of?
1. Workaround or quick-fix that can help is replace `TEMP_PROJECT_DIR` with `$TEMP_PROJECT_DIR` in `docker-entrypoint.sh`
Reference Line: https://github.com/hasura/graphql-engine/blob/master/packaging/cli-migrations/v3/docker-entrypoint.sh#L72
Contributor guide
Research direction
Start at packaging/cli-migrations/v3/docker-entrypoint.sh, especially line 72, and compare its temporary project directory handling with the reported non-root Dockerfile setup. Reproduce the image startup with user 1001 and verify that custom metadata and migrations deploy successfully on Cloud Run without the permission error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, google-cloud, shell
- Domain
- cli, cloud, devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100