Permission denied: '/srv/app/.local' on custom image build

[rantoniuk]

while trying to build a custom Docker image with just enabled the example scheming plugin installation, it fails with permission denied.

docker compose -f docker-compose.dev.yml build

[+] Building 4.2s (14/18)                                                                                                                             docker:default
 => [db internal] load build definition from Dockerfile                                                                                                         0.0s
 => => transferring dockerfile: 195B                                                                                                                            0.0s
 => [db internal] load metadata for docker.io/library/postgres:12-alpine                                                                                        0.5s
 => [db internal] load .dockerignore                                                                                                                            0.0s
 => => transferring context: 2B                                                                                                                                 0.0s
 => [db internal] load build context                                                                                                                            0.0s
 => => transferring context: 316B                                                                                                                               0.0s
 => [db 1/2] FROM docker.io/library/postgres:12-alpine@sha256:154b5962b6dc5cab57fbcb7045b1faa5c48ae98d1734479b8d070369ce3d194c                                  0.0s
 => CACHED [db 2/2] COPY --chown=postgres:postgres docker-entrypoint-initdb.d /docker-entrypoint-initdb.d                                                       0.0s
 => [db] exporting to image                                                                                                                                     0.0s
 => => exporting layers                                                                                                                                         0.0s
 => => writing image sha256:8a269978f89767619ceb6cb283f5b7298ba3668812589587d385b6e3d660bb94                                                                    0.0s
 => => naming to docker.io/library/ckan-docker-db                                                                                                               0.0s
 => [db] resolving provenance for metadata file                                                                                                                 0.0s
 => [ckan-dev internal] load build definition from Dockerfile.dev                                                                                               0.0s
 => => transferring dockerfile: 2.28kB                                                                                                                          0.0s
 => [ckan-dev internal] load metadata for docker.io/ckan/ckan-dev:2.11                                                                                          0.7s
 => [ckan-dev internal] load .dockerignore                                                                                                                      0.0s
 => => transferring context: 2B                                                                                                                                 0.0s
 => CACHED [ckan-dev 1/6] FROM docker.io/ckan/ckan-dev:2.11@sha256:5d146efa09eb5e3f4f4af3595c48eb0f6d45094061167e93c79c352fcb4d8938                             0.0s
 => [ckan-dev internal] load build context                                                                                                                      0.0s
 => => transferring context: 224B                                                                                                                               0.0s
 => ERROR [ckan-dev 2/6] RUN  pip3 install -e 'git+https://github.com/ckan/ckanext-scheming.git@master#egg=ckanext-scheming'                                    2.8s
------
 > [ckan-dev 2/6] RUN  pip3 install -e 'git+https://github.com/ckan/ckanext-scheming.git@master#egg=ckanext-scheming':
0.527 WARNING: The directory '/srv/app/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
0.528 Defaulting to user installation because normal site-packages is not writeable
0.663 Obtaining ckanext-scheming from git+https://github.com/ckan/ckanext-scheming.git@master#egg=ckanext-scheming
0.664   Cloning https://github.com/ckan/ckanext-scheming.git (to revision master) to ./src/ckanext-scheming
0.667   Running command git clone --filter=blob:none --quiet https://github.com/ckan/ckanext-scheming.git /srv/app/src/ckanext-scheming
1.678   Resolved https://github.com/ckan/ckanext-scheming.git to commit 5ce30cf2856aee97fa7b49de46847f8119dad355
1.678   Preparing metadata (setup.py): started
2.041   Preparing metadata (setup.py): finished with status 'done'
2.060 Requirement already satisfied: pyyaml in /usr/local/lib/python3.10/site-packages (from ckanext-scheming) (6.0.1)
2.112 Collecting ckanapi (from ckanext-scheming)
2.156   Downloading ckanapi-4.8-py3-none-any.whl.metadata (618 bytes)
2.214 Requirement already satisfied: ckantoolkit>=0.0.7 in /usr/local/lib/python3.10/site-packages (from ckanext-scheming) (0.0.7)
2.215 Requirement already satisfied: pytz in /usr/local/lib/python3.10/site-packages (from ckanext-scheming) (2024.1)
2.215 Requirement already satisfied: six in /usr/local/lib/python3.10/site-packages (from ckanext-scheming) (1.16.0)
2.218 Requirement already satisfied: setuptools in /usr/local/lib/python3.10/site-packages (from ckanapi->ckanext-scheming) (65.5.1)
2.218 Requirement already satisfied: docopt in /usr/local/lib/python3.10/site-packages (from ckanapi->ckanext-scheming) (0.6.2)
2.219 Requirement already satisfied: requests in /usr/local/lib/python3.10/site-packages (from ckanapi->ckanext-scheming) (2.32.3)
2.219 Requirement already satisfied: simplejson in /usr/local/lib/python3.10/site-packages (from ckanapi->ckanext-scheming) (3.19.2)
2.220 Requirement already satisfied: python-slugify>=1.0 in /usr/local/lib/python3.10/site-packages (from ckanapi->ckanext-scheming) (8.0.4)
2.224 Requirement already satisfied: text-unidecode>=1.3 in /usr/local/lib/python3.10/site-packages (from python-slugify>=1.0->ckanapi->ckanext-scheming) (1.3)
2.227 Requirement already satisfied: charset-normalizer<4,>=2 in /usr/local/lib/python3.10/site-packages (from requests->ckanapi->ckanext-scheming) (3.3.2)
2.228 Requirement already satisfied: idna<4,>=2.5 in /usr/local/lib/python3.10/site-packages (from requests->ckanapi->ckanext-scheming) (3.7)
2.228 Requirement already satisfied: urllib3<3,>=1.21.1 in /usr/local/lib/python3.10/site-packages (from requests->ckanapi->ckanext-scheming) (2.2.2)
2.229 Requirement already satisfied: certifi>=2017.4.17 in /usr/local/lib/python3.10/site-packages (from requests->ckanapi->ckanext-scheming) (2024.7.4)
2.249 Downloading ckanapi-4.8-py3-none-any.whl (46 kB)
2.455 Installing collected packages: ckanapi, ckanext-scheming
2.458 ERROR: Could not install packages due to an OSError: [Errno 13] Permission denied: '/srv/app/.local'
2.458 Check the permissions.
2.458
------
failed to solve: process "/bin/sh -c pip3 install -e 'git+https://github.com/ckan/ckanext-scheming.git@master#egg=ckanext-scheming'" did not complete successfully: exit code: 1

Same for dcat:

2.768 Installing collected packages: ckanext-dcat
2.769   DEPRECATION: Legacy editable install of ckanext-dcat from git+https://github.com/ckan/ckanext-dcat.git@v0.0.6#egg=ckanext-dcat (setup.py develop) is deprecated. pip 25.0 will enforce this behaviour change. A possible replacement is to add a pyproject.toml or enable --use-pep517, and use setuptools >= 64. If the resulting installation is not behaving as expected, try using --config-settings editable_mode=compat. Please consult the setuptools documentation for more information. Discussion can be found at https://github.com/pypa/pip/issues/11457
2.769   Running setup.py develop for ckanext-dcat
3.143     error: subprocess-exited-with-error
3.143
3.143     × python setup.py develop did not run successfully.
3.143     │ exit code: 1
3.143     ╰─> [6 lines of output]
3.143         /usr/local/lib/python3.10/site-packages/setuptools/dist.py:286: SetuptoolsDeprecationWarning: The namespace_packages parameter is deprecated, consider using implicit namespaces instead (PEP 420).
3.143           warnings.warn(msg, SetuptoolsDeprecationWarning)
3.143         running develop
3.143         /usr/local/lib/python3.10/site-packages/setuptools/command/easy_install.py:144: EasyInstallDeprecationWarning: easy_install command is deprecated. Use build and pip and other standards-based tools.
3.143           warnings.warn(
3.143         error: [Errno 13] Permission denied: '/srv/app/.local'
3.143         [end of output]

[rantoniuk]

Workaround in ckan/Dockerfile:

FROM ckan/ckan-dev:2.11

USER root
RUN mkdir /srv/app/.local && chown ckan /srv/app/.local
USER ckan

# then install plugins, e.g.
RUN pip3 install -e git+https://github.com/ckan/ckanext-excelforms.git@main#egg=ckanext-excelforms && \
    pip3 install -r https://github.com/ckan/ckanext-excelforms/raw/refs/heads/main/requirements.txt

then:

docker compose build
docker compose up -d

Reference:
https://github.com/ckan/ckan-docker-base/blob/main/ckan-master/Dockerfile#L125