How can I make python scripts write files in a docker container?

Question

I am building a flask webapp in a docker container with Azure AD authorization. When I use the code sample provided by microsoft they use the flask-session module.

The code I use works on my local machine. When I build a docker container there are permission errors when writing to the mounted docker volume.

I have tried to force permission on this directory, both using root and a custom user with same UID's on the host system. I can't figure out what I am doing wrong. I assume I have to force write permissions on this file system.

The core of my issue is that post-login session data is not cached properly in my docker container and you end up in a login loop.

Error when the directory doesn't exist:

Traceback (most recent call last):
  File "./main.py", line 1, in <module>
    from app import app
  File "/app/app/__init__.py", line 7, in <module>
    from app import views
  File "/app/app/views.py", line 22, in <module>
    Session(app)
  File "/usr/local/lib/python3.7/site-packages/flask_session/__init__.py", line 54, in __init__
    self.init_app(app)
  File "/usr/local/lib/python3.7/site-packages/flask_session/__init__.py", line 61, in init_app
    app.session_interface = self._get_interface(app)
  File "/usr/local/lib/python3.7/site-packages/flask_session/__init__.py", line 93, in _get_interface
    config['SESSION_USE_SIGNER'], config['SESSION_PERMANENT'])
  File "/usr/local/lib/python3.7/site-packages/flask_session/sessions.py", line 322, in __init__
    self.cache = FileSystemCache(cache_dir, threshold=threshold, mode=mode)
  File "/usr/local/lib/python3.7/site-packages/cachelib/file.py", line 41, in __init__
    os.makedirs(self._path)
  File "/usr/local/lib/python3.7/os.py", line 223, in makedirs
    mkdir(name, mode)

Errors when I pre-create the directory:

WARNING:root:Exception raised while handling cache file '/app/flask_session/2029240f6d1128be89ddc32729463129'
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/cachelib/file.py", line 196, in set
    suffix=self._fs_transaction_suffix, dir=self._path
  File "/usr/local/lib/python3.7/tempfile.py", line 340, in mkstemp
    return _mkstemp_inner(dir, prefix, suffix, flags, output_type)
  File "/usr/local/lib/python3.7/tempfile.py", line 258, in _mkstemp_inner
    fd = _os.open(file, flags, 0o600)
PermissionError: [Errno 13] Permission denied: '/app/flask_session/tmpdykbkzjx.__wz_cache'
 * Serving Flask app "app" (lazy loading)
 * Environment: production
   WARNING: This is a development server. Do not use it in a production deployment.
   Use a production WSGI server instead.
 * Debug mode: on
INFO:werkzeug: * Running on http://0.0.0.0:80/ (Press CTRL+C to quit)
INFO:werkzeug: * Restarting with stat
WARNING:root:Exception raised while handling cache file '/app/flask_session/2029240f6d1128be89ddc32729463129'
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/cachelib/file.py", line 196, in set
    suffix=self._fs_transaction_suffix, dir=self._path
  File "/usr/local/lib/python3.7/tempfile.py", line 340, in mkstemp
    return _mkstemp_inner(dir, prefix, suffix, flags, output_type)
  File "/usr/local/lib/python3.7/tempfile.py", line 258, in _mkstemp_inner
    fd = _os.open(file, flags, 0o600)
PermissionError: [Errno 13] Permission denied: '/app/flask_session/tmp2r6n8vby.__wz_cache'
WARNING:werkzeug: * Debugger is active!
INFO:werkzeug: * Debugger PIN: 187-625-763

Dockerfile:

  1 FROM python:3.7-slim-buster
  2 ARG UNAME=netpyth
  3 ARG UID=21268
  4 ARG GID=14625
  5 RUN groupadd -g $GID -o $UNAME
  6 RUN useradd -m -u $UID -g $GID -o -s /bin/bash $UNAME
  7 ENV STATIC_URL /static
  8 ENV STATIC_PATH /var/www/app/static
  9 WORKDIR /app
 10 COPY requirements.txt requirements.txt
 11 RUN pip3 install -r requirements.txt
 12 COPY . .
 13 RUN chmod +x ./main.py
 14 CMD ["python", "./main.py"]

Script for building the docker container:

1 #!/bin/bash
2 app="docker.wwwdev"
3 docker build -t ${app} .
4 docker run -it -d -p 56733:80 \
5   --name=${app} \
6   -v $PWD:/app ${app}

Host system version (RHEL):

NAME="Red Hat Enterprise Linux Server"
VERSION="7.6 (Maipo)"
ID="rhel"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="7.6"
PRETTY_NAME="Red Hat Enterprise Linux"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:7.6:GA:server"
HOME_URL="https://www.redhat.com/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
REDHAT_BUGZILLA_PRODUCT_VERSION=7.6
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="7.6"

Answer 1

You need to pass UID and GID to docker run

docker container run --rm -it \
  -v $(app):/app \                          # Mount the source code
  --workdir /app \                          # Set the working dir
  --user 1000:1000 \                        # Run as the given user
  my-docker/my-build-environment:latest \   # Our build env image
  make assets                               # ... and the command!

Example here