Fix frontend directory permissions in omnibus image (COPY --chmod=644 strips directory search bit) - #1035
Open
schainks wants to merge 1 commit into
Open
Fix frontend directory permissions in omnibus image (COPY --chmod=644 strips directory search bit)#1035schainks wants to merge 1 commit into
schainks wants to merge 1 commit into
Conversation
COPY --chmod=644 applies mode 644 to directories as well as files (BuildKit --chmod does not distinguish), so /opt/scrutiny/web ships without execute/search bits. Containers running with default root capabilities never notice because CAP_DAC_OVERRIDE bypasses the check, but hardened deployments (cap_drop: ALL) get EACCES on every file: /web/ renders a raw directory listing instead of index.html, static routes return 403, and HEAD /api/health 403s, which also hangs the omnibus collector-once wait loop. Use --chmod=755 so directories are traversable; file execute bits on static assets are harmless.
Author
schainks
changed the title
schainks
marked this pull request as ready for review
July 22, 2026 20:35
kaysond
requested changes
Jul 22, 2026
|
|
||
| COPY --link --from=backendbuild --chmod=755 /go/src/github.com/analogj/scrutiny/scrutiny /opt/scrutiny/bin/ | ||
| COPY --link --from=backendbuild --chmod=755 /go/src/github.com/analogj/scrutiny/scrutiny-collector-metrics /opt/scrutiny/bin/ | ||
| COPY --link --from=frontendbuild --chmod=644 /go/src/github.com/analogj/scrutiny/dist /opt/scrutiny/web |
Collaborator
There was a problem hiding this comment.
We dont need +x on files. just dirs. thats why there was a separate chmod in the web container
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1037 (accepted from discussion #1036; maintainer go-ahead for an AI-authored PR here).
AI disclosure (per AI_POLICY.md): diagnosis, this fix, and the PR text were produced with Claude Code. I (schainks) reviewed and edited the output, and verified the root cause and the fix's effect on my own hardware (Ubuntu 24.04, v0.9.2-omnibus, hardened compose with
cap_drop: ALL). Nothing here is hypothetical-untested code.Problem
docker/Dockerfilecopies the frontend with--chmod=644. BuildKit applies--chmodto directories as well as files, so/opt/scrutiny/webships without execute/search bits:Default-root deployments mask this via
CAP_DAC_OVERRIDE. Hardened ones (cap_drop: ALL) get EACCES on everything under that directory:/web/renders a raw directory listing (FileServer can't openindex.html), static routes return 403, andHEAD /api/health403s — which also hangs the omnibuscollector-oncewait loop ("scrutiny api not ready" forever), so the boot-time collector run never happens.This is a regression of #502: the fix in #520 (
chmod -R a+rX /opt/scrutinyin the oldDockerfile.web) was lost when consolidating into the omnibus Dockerfile.Fix
One line:
--chmod=644→--chmod=755on the frontend COPY, restoring directory traversal. Execute bits on the static asset files are harmless. If you'd rather keep files at 644 exactly, the alternative is dropping--chmod/--linkand addingRUN chmod -R u=rwX,go=rX /opt/scrutiny/webat the cost of the--linklayer optimization — happy to switch the PR if preferred.Verification
On the affected deployment, restoring directory readability (validated with
CAP_DAC_READ_SEARCH, which has the same read-side effect as this fix) resolves all three symptoms:/web/serves the app, routes return 200, andcollector-oncecompletes on boot.