static assets are not readable?

[yev]

Hello

I'm using redmine:alpine3.21 on MacOS 15.1.1

I need to serve static files by Puma.

I'm running the container with the following command :

docker run  -d \
    -v /srv/redmine/config/database.yml:/usr/src/redmine/config/database.yml \
    -v /srv/redmine/config/configuration.yml:/usr/src/redmine/config/configuration.yml \
    -v /srv/redmine/config/files:/usr/src/redmine/files \
    -v /var/run/mysqld/mysqld.sock:/tmp/mysqld.sock \
    -v /srv/redmine/config/master.key:/usr/src/redmine/config/master.key \
    -v /srv/redmine/config/credentials.yml.enc:/usr/src/redmine/config/credentials.yml.enc \
    -p 3000:3000 \
    -e RAILS_SERVE_STATIC_FILES=true \
  redmine:alpine3.21

And rails does not serve the static assets:
I got 404 when issuing
wget http://127.0.0.1:3000/assets/tablesort-5.2.1.min-c6968762.js

I was debugging the static.rb middleware and I discovered that the assets generated when container starting are not readable.

1. docker exec -it --user redmine:redmine REDMINE sh
2. ruby -e "puts File.readable?('/usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js')" I got false

Could someone explain me why I got this behaviour, please?

[LaurentGoderre]

See the 'WHere to Store Data' from the docs here: https://hub.docker.com/_/redmine/

[yev]

@LaurentGoderre thank you for your feedback. I know about volumes.
IMHO the volume is not great choice for assets management. The assets it's internal stuff and should be kept inside container. Each time there will be new version of redmine there is a risk to have old artefacts.

One more reason why I've created the issue, if I run the same container with SQLite the assets are served correctly...

PS: by the way, even if I'm using volume to serve assets through Nginx, I have the same problem with attachments which are stored in volume, mounted to container but are not readable because of permission problem
ruby -e "puts File.readable?('/usr/src/redmine/files/2024/04/240405092521_photo1712319673.jpeg')"
Could you, please, advise me how to fix the permissions for existing files coming from external volume?

[tianon]

I think those asset files are created by Redmine during initial startup, not by our entrypoint/image. 🤔

In your example, if you start Redmine first, then run your "readable" check (or exec into an existing Redmine instance and run your readable check), it should succeed:

$ docker run --name foo -d --user redmine:redmine --pull=always redmine:alpine3.21
alpine3.21: Pulling from library/redmine
Digest: sha256:e36eb2d7b238eb2df867062e526afeb8898755ecb04bd26d706eae92bba9b800
Status: Image is up to date for redmine:alpine3.21
337fbd33883876acf32af064ef8914e67be3d2385526bada12583bbf4d9434a4
$ docker logs --tail=2 foo
* Listening on http://0.0.0.0:3000
Use Ctrl-C to stop
$ docker exec -it foo ruby -e "puts File.readable?('public/assets/tablesort-5.2.1.min-c6968762.js')"
true

[tianon]

If you use docker diff, you can also see that they're not stored in volumes:

$ docker diff foo | grep tablesort
A /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
A /usr/src/redmine/public/assets/tablesort-5.2.1.number.min-8a47560b.js

[yev]

ruby -e "puts File.readable?('public/assets/tablesort-5.2.1.min-c6968762.js')"

Yes, the assets are generated by Redmine RoR engine, not by the docker wrapper.

I just tested your hypothesis. Nope the check returns always false.

[tianon]

That's weird -- as you can see, it was successful for me, so I don't know what's different about your setup. 🙈

[yev]

That's weird -- as you can see, it was successful for me, so I don't know what's different about your setup. 🙈

One difference I see is that I attach volumes with configuration. Like
-v /srv/redmine/config/database.yml:/usr/src/redmine/config/database.yml \ -v /srv/redmine/config/configuration.yml:/usr/src/redmine/config/configuration.yml \
But I don't understand how it can interfere with permission problem.

[LaurentGoderre]

What happens if you check the permissions outside of ruby?

docker exec -it foo ls -lah /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
-rw-r--r--    1 redmine  redmine     3.0K Jan  9 14:19 /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js

[yev]

What happens if you check the permissions outside of ruby?

docker exec -it foo ls -lah /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
-rw-r--r--    1 redmine  redmine     3.0K Jan  9 14:19 /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js

the permissions is ok
-rw-r--r-- 1 redmine redmine 3.0K Jan 8 17:50 /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
I checked File.owner? and File.readable_real? - both return true
But File.readable? is still false ⚠️

[yev]

I was debugging the notion of effective user which causes the problem for our case. I saw the implementations of https://github.com/ruby/ruby/blame/master/file.c#L1558
And I noticed that rb_eaccess(VALUE fname, int mode) and rb_access(VALUE fname, int mode) have both exactly the same copy pasted implementation.
It is ok? Or I missed something?

[yev]

@tianon, I noticed that in docker file there is tool "gosu" and a method called _fix_permissions()

One more piece of puzzle :
I connected to the running docker container with docker exec -it --user redmine:redmine redmine sh
and executed those 2 commands:

/usr/src/redmine $ ruby -e "puts File.readable?('/usr/src/redmine/files/2021/11/211125023357_image-12.png')"
false
/usr/src/redmine $ ruby -e "puts File.owned?('/usr/src/redmine/files/2021/11/211125023357_image-12.png')"
true

Do you have any idea ?

[bragef]

Not sure if this is the problem here, but it looks like the Docker images for Redmine 6 does not update the permissions and ownership of the public/assets directory correctly.

According to https://www.redmine.org/projects/redmine/wiki/RedmineInstall#Step-8-File-system-permissions public/plugin_assets should be changed to public/assets in Redmine >= 6, but the current Dockerfile and docker-entrypoint.sh still use public/plugin_assets.

[yosifkit]

Thanks @bragef, I have opened a PR to add the assets directory: #369. Hopefully it might fix this issue as well.

[yev]

Hey, just tested my case with latest redmine image.
And it works !
Thank you very much @bragef and @yosifkit !