Permission error running latest container image #6480

jakeceballos · 2021-06-24T15:38:36Z

jakeceballos
Jun 24, 2021

If the above steps do not resolve your issue, please complete the following:

The issue and what you expected to happen
Endpoint /server/health is returning an error instead of 200.
Exact steps to reproduce this issue

Using Directus v9.0.0-rc.69 container image, initialize system tables and run application.
Upgrade Directus container image to latest version (v9.0.0-rc.80).
Recreate containers and start application.
Attempt GET request to /server/health

Your environment:
v9.0.0-rc.69 and v9.0.0-rc.80 container images
Postgres
Docker and docker-compose

Any other relevant information we might need to reproduce this issue

15:31:50 🚨 storage:local:responseTime in ERROR state 
UnknownException: E_UNKNOWN: An unknown error happened with the file health-3IHNN.
Error code: EACCES
Original stack:
  Error: EACCES: permission denied, open '/directus/uploads/health-3IHNN'
    at handleError (/directus/node_modules/@directus/drive/dist/LocalFileSystemStorage.js:39:20)
    at LocalFileSystemStorage.put (/directus/node_modules/@directus/drive/dist/LocalFileSystemStorage.js:205:19)
    at async testStorage (/directus/node_modules/directus/dist/services/server.js:244:21)
    at async Promise.all (index 3)
    at async ServerService.health (/directus/node_modules/directus/dist/services/server.js:90:40)
    at async /directus/node_modules/directus/dist/controllers/server.js:54:18
15:31:50 ✨ request errored GET 503 /server/health 185ms

rijkvanzanten · 2021-06-24T15:46:22Z

rijkvanzanten
Jun 24, 2021
Maintainer

What's the user that owns the local file system storage volume? As of rc71, the Docker image uses the node user instead of root for security reasons, which might require an update on your end, as per #5877.

@paescuj @t7tran any instructions on how to update the owner of the volume?

2 replies

andriusign Jul 26, 2021

Unexpected updates... just keep breaking our environments...

paescuj Jul 26, 2021

@andriusign This is not unexpected - it has been announced as a breaking change in the changelog.

t7tran · 2021-06-24T21:26:10Z

t7tran
Jun 24, 2021

While the Directus container is running (whichever version you can get it up and running), follow the steps below:

Identify Directus container ID by running docker ps
Run docker exec -u root <directus-container-id> chown -R node:node /directus/database /directus/extensions /directus/uploads

If you use docker-compose, run this command instead docker-compose exec -u root <directus-service-name>chown -R node:node /directus/database /directus/extensions /directus/uploads.

10 replies

t7tran Jul 22, 2021

Spot on. I should have picked that up. One is relative to the docker-compose.yml file, and the other is from the root.

rijkvanzanten Jul 22, 2021
Maintainer

cc @jacobrienstra

andriusign Aug 1, 2021

This command helped
docker exec -u root my-api chown -R node:node /directus/database /directus/extensions /directus/uploads
Also needed to restart my service with docker restart my-api

GraphtyLove Feb 16, 2022

While the Directus container is running (whichever version you can get it up and running), follow the steps below:

Identify Directus container ID by running docker ps

Run docker exec -u root <directus-container-id> chown -R node:node /directus/database /directus/extensions /directus/uploads

If you use docker-compose, run this command instead docker-compose exec -u root <directus-service-name>chown -R node:node /directus/database /directus/extensions /directus/uploads.

I don't get it, it means that you will need to execute this command each time you pop Directus on a new server?
Shouldn't it be integrated in Directus' Dockerfile? I tried using the 9.X and the 9.5.X image and I'm still getting this error if I don't overwrite the permission with a docker exec command.

Did I miss something?

paescuj Feb 16, 2022

While the Directus container is running (whichever version you can get it up and running), follow the steps below:

Identify Directus container ID by running docker ps

Run docker exec -u root <directus-container-id> chown -R node:node /directus/database /directus/extensions /directus/uploads

If you use docker-compose, run this command instead docker-compose exec -u root <directus-service-name>chown -R node:node /directus/database /directus/extensions /directus/uploads.

I don't get it, it means that you will need to execute this command each time you pop Directus on a new server? Shouldn't it be integrated in Directus' Dockerfile? I tried using the 9.X and the 9.5.X image and I'm still getting this error if I don't overwrite the permission with a docker exec command.

Did I miss something?

This depends on several factors: Do you use a volume or bind mount? What's the default umask on your Docker host? Do you mount a previous existing directory? Are there other security mechanisms like SELinux? Etc.

Usually, volumes are automatically created with the correct ownership.
If you're using a bind mount and have a rather restrictive umask setting on your host, the permissions on the directory might not be enough for Directus (e.g. drwxr-xr-x root root) - so in this case you need to adjust the ownership with the docker exec ... command. As you already wrote, this is only required once for a new Directus instance.

mattes3 · 2023-11-05T14:03:30Z

mattes3
Nov 5, 2023

The docker exec did not work for me. But when I change the docker compose file like this, it works, entirely without docker exec:

services:
  directus:
    image: directus/directus:10.7.2
    ports:
      - 8055:8055
    volumes:
      - my_uploads:/directus/uploads
    ...etc..
 
volumes:
  my_uploads:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ./data/uploads

2 replies

enzocomics Jan 11, 2024

I ran into this issue today, and your solution worked wonderfully for me. Thank you so much!

zischler Jun 29, 2024

Worked for me too! thanks a lot! :)

CalebBarnes · 2023-12-06T23:47:16Z

CalebBarnes
Dec 6, 2023

This is an issue on the latest container version. ERROR: Extension folder "/directus/extensions/interfaces" couldn't be opened
This process then exits before I have the chance to open the container shell and edit the permissions. 👎

directus  | [23:45:02.190] ERROR: Failed to sync extensions
directus  | [23:45:02.190] ERROR: Extension folder "/directus/extensions/interfaces" couldn't be opened
directus  |     err: {
directus  |       "type": "Error",
directus  |       "message": "Extension folder \"/directus/extensions/interfaces\" couldn't be opened",
directus  |       "stack":
directus  |           Error: Extension folder "/directus/extensions/interfaces" couldn't be opened
directus  |               at ensureExtensionDirs (file:///directus/node_modules/.pnpm/file+packages+extensions_vue@3.3.4/node_modules/@directus/extensions/dist/node.js:11:13)
directus  |               at async ExtensionManager.load (file:///directus/node_modules/.pnpm/file+api_vue@3.3.4/node_modules/@directus/api/dist/extensions/manager.js:137:13)
directus  |               at async ExtensionManager.initialize (file:///directus/node_modules/.pnpm/file+api_vue@3.3.4/node_modules/@directus/api/dist/extensions/manager.js:123:13)
directus  |               at async loadExtensions (file:///directus/node_modules/.pnpm/file+api_vue@3.3.4/node_modules/@directus/api/dist/cli/load-extensions.js:17:5)
directus  |               at async createCli (file:///directus/node_modules/.pnpm/file+api_vue@3.3.4/node_modules/@directus/api/dist/cli/index.js:20:5)
directus  |     }
directus  | 2023-12-06T23:45:02: PM2 log: App name:directus id:0 disconnected
directus  | 2023-12-06T23:45:02: PM2 log: App [directus:0] exited with code [1] via signal [SIGINT]
directus  | 2023-12-06T23:45:08: PM2 log: 0 application online, retry = 3
directus  | 2023-12-06T23:45:10: PM2 log: 0 application online, retry = 2
directus  | 2023-12-06T23:45:12: PM2 log: 0 application online, retry = 1
directus  | 2023-12-06T23:45:14: PM2 log: 0 application online, retry = 0
directus  | 2023-12-06T23:45:14: PM2 log: PM2 successfully stopped

This is running on Ubuntu server by a user in the docker group.

Using the docker compose example provided in the docs:

services:
  directus:
    image: directus/directus:latest
    volumes:
      - ./uploads:/directus/uploads
      - ./extensions:/directus/extensions

Fixed!! 🚀

@mattes3 solution worked after I pruned volumes and restarted the command a couple times! 🎉

Full docker-compose.yml for anyone who has same issue:

version: "3"
services:
  database:
    container_name: database
    image: postgis/postgis:13-master
    # Required when running on platform other than amd64, like Apple M1/M2:
    # platform: linux/amd64
    volumes:
      - ./data/database:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: "directus"
      POSTGRES_PASSWORD: "directus"
      POSTGRES_DB: "directus"

  directus:
    container_name: directus
    image: directus/directus:latest
    ports:
      - 8055:8055
    volumes:
      - my_uploads:/directus/uploads
      - my_extensions:/directus/extensions
      # If you want to load extensions from the host
    depends_on:
      - database
    environment:
      KEY: "255d861b-5ea1-5996-9aa3-922530ec40b1" 
      SECRET: "6116487b-cda1-52c2-b5b5-c8022c45e263" # these are test keys 😏

      DB_CLIENT: "pg"
      DB_HOST: "database"
      DB_PORT: "5432"
      DB_DATABASE: "directus"
      DB_USER: "directus"
      DB_PASSWORD: "directus"

      ADMIN_EMAIL: "admin@example.com"
      ADMIN_PASSWORD: "d1r3ctu5"

      # Make sure to set this in production
      # (see https://docs.directus.io/self-hosted/config-options#general)
      # PUBLIC_URL: "https://directus.example.com"
volumes:
  my_uploads:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ./data/uploads
  my_extensions:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ./data/extensions

2 replies

mattes3 Jan 11, 2024

Wow, cool that it worked for you, too!

mrfzd Feb 18, 2024

This worked for us too!
Thank you for saving us the trouble.

mihaon · 2025-08-10T14:41:26Z

mihaon
Aug 10, 2025

It happens because docker "bind mount" host directory (in contrast to named volumes) is not initialized with owner/permissions taken from inside the container directory. It can be fixed via docker compose post_start hook.

services:
    directus:
        # ...
        volumes:
            - ./database:/directus/database
            - ./uploads:/directus/uploads
            - ./extensions:/directus/extensions
        post_start:
            - command: chown node:node /directus/database /directus/uploads /directus/extensions
              user: root
        # ...

P.S.: see directus/docs#428 for details

0 replies

Uh oh!

Permission error running latest container image #6480

Uh oh!

Replies: 5 comments · 16 replies

Uh oh!

rijkvanzanten Jun 24, 2021 Maintainer

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rijkvanzanten Jul 22, 2021 Maintainer

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Replies: 5 comments 16 replies

rijkvanzanten
Jun 24, 2021
Maintainer

rijkvanzanten Jul 22, 2021
Maintainer