kobotoolbox / kpi / 18758367484

81%

master: 76%

push

github

fix(docker): start `runserver_plus` as non-root; assign filesystem permissions early DEV-1192 (#6404)

### 💭 Notes

Fix discrepancy between `python manage.py runserver_plus` running as
`root` (in development mode only) while Celery workers ran as user
`kobo`. Reorder commands in the Docker `entrypoint.sh` script so that
filesystem permission assignments happen as early as possible, to reduce
the time other containers spend in restart loops while they cannot write
to logs etc.

### 👀 Preview steps

:warning: The reviewer should read the entirety of `entrypoint.sh` and
look for unforeseen consequences from moving permission assignment
commands to the top of the file.

Basic testing:

1. Use base branch (`release/2.025.37`)
2. Start from a completely fresh installation, or at least entirely
remove `kobo-docker/.vols/kobocat_media_uploads`
3. Bring up an instance using `kobo-install`'s developer mode
4. Notice that `python manage.py runserver_plus` runs as root in the
`kpi` container
5. Bonus: try to create a project with form media
1. See that `kobo-docker/.vols/kobocat_media_uploads/<username>` is
owned by `root`
2. See that `PermissionError: [Errno 13] Permission denied:
'/srv/src/kobocat/media/<username>/form-media'` is written to
`celery.log`
[(xref)](https://linear.app/kobotoolbox/issue/DEV-1189/in-kobo-install-form-media-files-are-not-syncing-on-deployment)
6. Check out this PR's branch `start-runserver-as-non-root`
7. See that `python manage.py runserver_plus` runs as `kobo` in the
`kpi` container
8. Bonus: remove `kobo-docker/.vols/kobocat_media_uploads/<username>`
and try the form media file again. If you do not remove it,
`runserver_plus` will fail to access it and cause a 500 error on
(re)deployment

6928 of 10934 branches covered (63.36%)

26735 of 32950 relevant lines covered (81.14%)

1.6 hits per line