[Bug]: File permission issue when using other users than 1000 or root

[leondape]

What happened?

Issue:

I wanted to switch from root deployment to user deployment. During that I ran into several pitfalls.
My current user has gid/uid 1004. This is what I entered in the .env.
Many things did not work out well, but I think now I got it.

1. all mkdirs by docker compose are still owned by root. I don't know why. That might also be an issue from my side. manual Fix: chown -R to 1004:1004.
2. I tried uploading a file which lead to a permission issue again. /app in the lc container is owned by node (inherited from the Dockerfile creation process). now of course 1004 cannot write into /app owned by 1000.

Suggestions:

Make the node:1000 user work consistently:

1. Document that the only out-of the box working user is 1000 (caused by the dockerfile)
2. add chown -R 1000:1000 for ./data-node ./images ./logs ./meilidata_v1.7`

Alternative: Enable other users than 1000 to own the container:

1. add chown -R $UID:GID for ./data-node ./images ./logs ./meilidata_v1.7`

Steps to Reproduce

1. docker compose up with user 1000

What browsers are you seeing the problem on?

No response

Relevant log output

No response

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[lewayotte]

I've run into this same exact problem just now... had a user librechat (UID: 1002)... and was getting a bunch of permissions denied errors on docker compose up. Looking at the directories in the git repo (after the initial docker pull) there are a handful of directories that are owned by root:root.

data-node, images, logs, meili_data_v1.7.

I had this set in my .env file, fwiw:

UID=1002
GID=1002

[danny-avila]

Try following this: #1441 (reply in thread)

You will need to build your own image, for which you will need to make use of the docker-compose.override.yml file:

https://www.librechat.ai/docs/configuration/docker_override

There are examples in docker-compose.override.yml.example at project root.

You'll basically want it setup like this if you're using the default docker-compose.yml:

services:
  api:
    image: librechat
    build:
      context: .
      target: node
      args:
        UID: ${UID}
        GID: ${GID}

[immortaly007]

I'm also trying to get the non-default user to work, and I think I also need changes in the Dockerfile itself, even if I build my own image.
I'm getting the following error:

LibreChat  | 2024-10-14 09:41:03 error: There was an uncaught error: EACCES: permission denied, mkdir '/app/data'

sh-ing into the running container, we see that the data folder does not exist:

ls /app
LICENSE                              bun.lockb                            config                               docker-compose.override.yml.example  images                               node_modules                         packages                             rag.yml
README.md                            charts                               deploy-compose.yml                   docker-compose.yml                   index.html                           package-lock.json                    pgdata2                              utils
api                                  client                               docker-compose.override.yml          e2e                                  logs                                 package.json                         prettier.config.js

Also note that the whole /app folder is owned by the "node" user, which is user 1000, but I want to run it is my systems librechat user, who is user 1005.

I've worked around it by updating the Dockerfile to this:

# v0.7.5-rc2

# Base node image
FROM node:20-alpine AS node

ARG UID=1000
ARG GID=1000

RUN apk --no-cache add curl

RUN mkdir -p /app && chown node:node /app
WORKDIR /app

RUN mkdir -p /app/data /app/uploads && chown $UID:$GID /app/data /app/uploads
COPY --chown=node:node . .

USER node

RUN \
    # Allow mounting of these files, which have no default
    touch .env ; \
    # Create directories for the volumes to inherit the correct permissions
    mkdir -p /app/client/public/images /app/api/logs ; \
    npm config set fetch-retry-maxtimeout 600000 ; \
    npm config set fetch-retries 5 ; \
    npm config set fetch-retry-mintimeout 15000 ; \
    npm install --no-audit; \
    # React client build
    NODE_OPTIONS="--max-old-space-size=2048" npm run frontend; \
    npm prune --production; \
    npm cache clean --force

RUN mkdir -p /app/client/public/images /app/api/logs

# Node API setup
EXPOSE 3080
ENV HOST=0.0.0.0
CMD ["npm", "run", "backend"]

# Optional: for client with nginx routing
# FROM nginx:stable-alpine AS nginx-client
# WORKDIR /usr/share/nginx/html
# COPY --from=node /app/client/dist /usr/share/nginx/html
# COPY client/nginx.conf /etc/nginx/conf.d/default.conf
# ENTRYPOINT ["nginx", "-g", "daemon off;"]

Or, as a diff:

--- a/Dockerfile
+++ b/Dockerfile
@@ -3,15 +3,19 @@
 # Base node image
 FROM node:20-alpine AS node
 
+ARG UID=1000
+ARG GID=1000
+
 RUN apk --no-cache add curl
 
 RUN mkdir -p /app && chown node:node /app
 WORKDIR /app
 
-USER node
-
+RUN mkdir -p /app/data /app/uploads && chown $UID:$GID /app/data /app/uploads
 COPY --chown=node:node . .
 
+USER node
+
 RUN \
     # Allow mounting of thes

Notable changes:

• Added the UID and GID args, similar to #1441
• Added the line:

RUN mkdir -p /app/data /app/uploads && chown $UID:$GID /app/data /app/uploads

• Moved the USER node line to below the lines where the /app folder is created, because after that line, the chmod $UID:$GID no longer works, as the node user is not allowed to do that.

Alternatively, instead of making the node user own everything, the $UID and $GID user could also be used to own everything. I don't know if that is preferable/if there's a specific reason to use the node user.

Edit: Updated the Dockerfile; /app/uploads directory also needs to be writeable to the container user.
Edit2: I've now opted to mount the /app/data and /app/uploads folders as volumes, where the host filesystem permissions are matching those in the container. This also works, but I don't know if it has negative consequences as those folders are not volumes in de fault configuration.

[leondape]

the node image has 1000 as default user. I believe that is the source of the issue.

[immortaly007]

@leondape I think so too. But we could use the $UID and $GUID arguments for the Dockerfile build to change that.
But I am wondering if it's worth it, or if it is better to just mount the /app/data and /app/uploads folders as whichever user you want the run the app as. But I'm not sure why this is not the default recommendation for running the container anyway?

[leondape]

Currently the Dockerfile uses the node base image:

LibreChat/Dockerfile

Line 4 in 0870acd

FROM node:20-alpine AS node

You would need to build the node docker image as well and handle permission issues there probably as well..
I don't see the need to change that anymore. I run the app as 1000:1000.
The persistant volumes geht chowned to 1000:1000 and I let it work.
If I need to modify/delete anything there I sudo it.