Skip to content

Revert file_processor in .dev mode to use image:node#83

Open
johnny-hausman wants to merge 3 commits intomasterfrom
jh/backToNode
Open

Revert file_processor in .dev mode to use image:node#83
johnny-hausman wants to merge 3 commits intomasterfrom
jh/backToNode

Conversation

@johnny-hausman
Copy link
Collaborator

With the recent security updates to our Docker packages, our services no longer run as root.

In a development environment, if our api_sails not using our docker image, it will run as the default user in the node container.

If we force file_processor to use our Docker image, it will default to a different "user" in unix. Since api_sails and file_processor are sharing the same file system, then one package will not be able to access and read the uploaded files the other one is creating due to file permissions.

So in a dev environment, let's make sure they both use the default : image:node so they user permissions are the same.

[fix] revert file_processor in .dev mode to use image:node

@johnny-hausman johnny-hausman added the bug Something isn't working label Mar 17, 2026
Copy link

@elephanteleven elephanteleven left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, the image:file_processor has some extra tools are installed https://github.com/CruGlobal/ab_service_file_processor/blob/master/Dockerfile#L28 including the image compressor we use for file-get. I think using image:node are missing those tools.

My idea (You can correct me if I am wrong.):
Should we force to use the api_sails image in dev instead?
We now default the USER node https://github.com/CruGlobal/ab_service_api_sails/blob/a389ad8c9d07c49ce85141e33e38b31075c360ec/Dockerfile#L42.
We modify the sharing volume /data permission to node:node https://github.com/CruGlobal/ab_service_file_processor/blob/0bc32b385b2f140fffbed3602fc8b9d43ecfddd3/Dockerfile#L53.
I think it should be fine for permission sharing file system since it will point to the same identity USER node user and the file system is extended from the root image:node.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we delete this line, Then
we use ENTRYPOINT ["bash", "/app/docker-entrypoint.sh"] in https://github.com/CruGlobal/ab_service_api_sails/blob/a389ad8c9d07c49ce85141e33e38b31075c360ec/Dockerfile#L46 or make this https://github.com/CruGlobal/ab_service_api_sails/blob/master/docker-entrypoint.sh file executable by default? we now don't need https://github.com/CruGlobal/ab_service_api_sails/blob/a389ad8c9d07c49ce85141e33e38b31075c360ec/Dockerfile#L45 that make our local dev file system different from the original one in the docker image.
So, the script can mount our local dev file system to the container image normally and start the container correctly in dev mode.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants