Permission denied on startup

[hokascha]

Hi,

I get this when trying to start the container:

# docker-compose up
Creating network "validator_default" with the default driver
Creating occv ... done
Attaching to occv
occv    | Traceback (most recent call last):
occv    |   File "/code/./main.py", line 5, in <module>
occv    | Open Covid Certificate Validator
occv    | Certificate country: DE
occv    | Development mode: False
occv    |     uvicorn.run("occv:app", host="0.0.0.0", port=8000, log_level="info")
occv    |   File "/usr/local/lib/python3.10/site-packages/uvicorn/main.py", line 447, in run
occv    |     server.run()
occv    |   File "/usr/local/lib/python3.10/site-packages/uvicorn/server.py", line 68, in run
occv    |     return asyncio.run(self.serve(sockets=sockets))
occv    |   File "/usr/local/lib/python3.10/asyncio/runners.py", line 44, in run
occv    |     return loop.run_until_complete(main)
occv    |   File "/usr/local/lib/python3.10/asyncio/base_events.py", line 641, in run_until_complete
occv    |     return future.result()
occv    |   File "/usr/local/lib/python3.10/site-packages/uvicorn/server.py", line 76, in serve
occv    |     config.load()
occv    |   File "/usr/local/lib/python3.10/site-packages/uvicorn/config.py", line 448, in load
occv    |     self.loaded_app = import_from_string(self.app)
occv    |   File "/usr/local/lib/python3.10/site-packages/uvicorn/importer.py", line 21, in import_from_string
occv    |     module = importlib.import_module(module_str)
occv    |   File "/usr/local/lib/python3.10/importlib/__init__.py", line 126, in import_module
occv    |     return _bootstrap._gcd_import(name[level:], package, level)
occv    |   File "<frozen importlib._bootstrap>", line 1050, in _gcd_import
occv    |   File "<frozen importlib._bootstrap>", line 1027, in _find_and_load
occv    |   File "<frozen importlib._bootstrap>", line 1006, in _find_and_load_unlocked
occv    |   File "<frozen importlib._bootstrap>", line 688, in _load_unlocked
occv    |   File "<frozen importlib._bootstrap_external>", line 883, in exec_module
occv    |   File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
occv    |   File "/code/occv.py", line 47, in <module>
occv    |     validator = DCCValidator(CERT_COUNTRY)
occv    |   File "/code/validator.py", line 33, in __init__
occv    |     self._cert_loader = self._get_cert_loader(country)()
occv    |   File "/code/cert_loaders/de.py", line 23, in __init__
occv    |     self._build_certlist()
occv    |   File "/code/cert_loaders/de.py", line 140, in _build_certlist
occv    |     certs_str = self._load_certs()
occv    |   File "/code/cert_loaders/de.py", line 86, in _load_certs
occv    |     certs_str = self._download_certs()
occv    |   File "/code/cert_loaders/de.py", line 130, in _download_certs
occv    |     self._save_certs(certs_str, signature)
occv    |   File "/code/cert_loaders/de.py", line 55, in _save_certs
occv    |     with open("./data/" + self._cert_filename, 'wb') as f:
occv    | PermissionError: [Errno 13] Permission denied: './data/de.json'
occv exited with code 1

Maybe this has something to do with a version error on docker-compose.yml:

# docker-compose up -d
ERROR: Version in "./docker-compose.yml" is unsupported. You might be seeing this error because you're using the wrong Compose file version. Either specify a supported version (e.g "2.2" or "3.3") and place your service definitions under the `services` key, or omit the `version` key and place your service definitions at the root of the file to use version 1.
For more on the Compose file format versions, see https://docs.docker.com/compose/compose-file/

I changed the version entry to "3.3" which yields the above error.

System info:

# docker-compose -v
docker-compose version 1.25.0, build unknown

# docker -v
Docker version 20.10.7, build 20.10.7-0ubuntu5~20.04.2

[hokascha]

tried again with a newer docker and docker-compose. No version error now on startup but still permission denied.

[hokascha]

changing the permissions to data to 777 fixes the problem. Even while being root, this seems to be neccessary.