Business Edition - 403 forbidden when 'Environment Administrator' tries to re-create any container

[zyuhel]

Before you start please confirm the following.

• Yes, I've searched similar issues on GitHub.
• Yes, I've checked whether this issue is covered in the Portainer documentation or knowledge base.

Problem Description

Users that have the Environment Administrator role are unable to recreate containers. Although can create/start/stop/delete any container.
This problem is on containers that were created by other users and also for containers created by this user.

Expected Behavior

Users have re-create button for containers and they should be able to re-create it.

Actual Behavior

It shows 403 error, and doesn't do anything. Nothing in logs.

Steps to Reproduce

1. Use the Portainer GUI
2. Login with Environment Administrator
3. Select any running container
4. Try to re-create container (either with re-pull image or not)
5. See the error.

Portainer logs or screenshots

Portainer version

2.19.5

Portainer Edition

Business Edition (BE/EE) with 5NF / 3NF license

Platform and Version

Docker 25.0.3

OS and Architecture

Ubuntu 22.04.3 LTS, AMD64

Browser

Google Chrome 124.0

What command did you use to deploy Portainer?

docker run -d -p 8000:8000 -p 9443:9443 --name portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ee:latest

Additional Information

I use custom registry for container sources and disabled docker hub registry for non admin users.

[jamescarppe]

Thanks for this - I've been able to reproduce this here and have opened an internal issue.

Internal Ref: EE-7073

[pcarranza-taag]

For those who have this problem and need to recreate the container, they can enable the webhook inside the container to execute the container recreation remotely.

[zyuhel]

@jamescarppe , Any information about the time it would take to fix this issue? Or the ACL won't correctly work in near future?

[jamescarppe]

My understanding is that this should have been fixed in 2.21.0 - are you able to update and confirm this?

[zyuhel]

I would make a bit more testing, but it seems to be fine with 2.21.1

[jamescarppe]

As we included a fix for this in 2.21.0 and have had no further reports of issues, I'm closing this issue as completed.