Media directory permissions problem using Docker (Sylius 1.12.1)

[valentin-harrang]

Sylius version affected: 1.12.1

Description

I just installed Sylius 1.12.1 via Docker (following the documentation) and when I want to upload an image to a product from the admin panel, I get this permissions error:

2022/12/16 13:26:12 [crit] 32#32: *843 stat() "/srv/sylius/public/media/cache/sylius_small/50/09/d7acd0e47c4b6c598e5fd25fd206.jpg" failed (13: Permission denied), client: 172.18.0.1, server: , request: "GET /media/cache/sylius_small/50/09/d7acd0e47c4b6c598e5fd25fd206.jpg HTTP/1.1", host: "localhost", referrer: "http://localhost/admin/products/22/edit"

However, there are these lines in the docker/php/docker-entrypoint.sh file which is supposed to define the rights on the public/media folder :

setfacl -R -m u:www-data:rwX -m u:"$(whoami)":rwX var public/media
setfacl -dR -m u:www-data:rwX -m u:"$(whoami)":rwX var public/media

media directory in php container:

By the way, I think that if you install Sylius via Docker, the product images (generated by fixtures) will not be displayed on the website because of the permissions.

@nicolalazzaro has the same problem and he didn’t have this problem in the past, so I think the problem is not my setup.

Steps to reproduce

1. Login to admin panel
2. Go to Products > Media
3. Upload a media

I tried with 1.12.0 version and same problem.. 😕

I use Docker Desktop 4.15.0 on MacOS Monterey.

Possible Solution

?

[umpirsky]

/srv/sylius # ls -l public/media/cache/sylius_shop_product_thumbnail/
total 8
drwxrwx---    3 www-data www-data      4096 May 10 18:22 af

chmod -R +x public/media/cache/ makes them work:

/srv/sylius # ls -l public/media/cache/sylius_shop_product_thumbnail/
total 8
drwxrwx--x    3 www-data www-data      4096 May 10 18:22 af

but as soon as you upload new image, it will not work.

[umpirsky]

Trying with:

liip_imagine:
    resolvers:
        default:
            web_path:
                web_root: "%kernel.project_dir%/public"
                cache_prefix: "media/cache"
    loaders:
        product_images:
            flysystem:
                filesystem_service: oneup_flysystem.product_images_filesystem
    data_loader: product_images

oneup_flysystem:
    adapters:
        product_images:
            local:
                location: "%kernel.project_dir%/public/media/image"
                permissions:
                    file:
                        public: 0777
                        private: 0777
                    dir:
                        public: 0777
                        private: 0777

    filesystems:
        product_images:
            adapter: product_images

But still no luck, it creates dirs without x on others...

[TalkMarc]

Still an issue.

The image folder only has permissions for root or www-data. The cache folder only has permission for the owner. Since the nginx container runs with a different user (nginx) it cannot read any cache or no-cached image. The cached image files themselves are not the problem but the folder permissions are the too restrictive ones.

Edit:
There is an open PR #887

[lecajer]

Any update in the 1.13 branch ?

Somehow my media/cache folder content is readeable by Nginx but not media/image, using 1.12

In my case Sylius is used as an API for Next js app
The Next JS app has it's own image proxy/cache that also changes images size on the fly

I also have some trouble having Sylius generating all the necessary thumbnails sizes when an image is added
I found a workaround using the "resolve" endpoint :

GET /media/cache/resolve/sylius_small/50/09/d7acd0e47c4b6c598e5fd25fd206.jpg
Instead of
GET /media/cache/sylius_small/50/09/d7acd0e47c4b6c598e5fd25fd206.jpg

It would be better in this case to use the original image that gets into the Nginx permission issue
GET /media/image/50/09/d7acd0e47c4b6c598e5fd25fd206.jpg