static assets are not readable?

[yev]

Hello

I'm using redmine:alpine3.21 on MacOS 15.1.1

I need to serve static files by Puma.

I'm running the container with the following command :

docker run  -d \
    -v /srv/redmine/config/database.yml:/usr/src/redmine/config/database.yml \
    -v /srv/redmine/config/configuration.yml:/usr/src/redmine/config/configuration.yml \
    -v /srv/redmine/config/files:/usr/src/redmine/files \
    -v /var/run/mysqld/mysqld.sock:/tmp/mysqld.sock \
    -v /srv/redmine/config/master.key:/usr/src/redmine/config/master.key \
    -v /srv/redmine/config/credentials.yml.enc:/usr/src/redmine/config/credentials.yml.enc \
    -p 3000:3000 \
    -e RAILS_SERVE_STATIC_FILES=true \
  redmine:alpine3.21

And rails does not serve the static assets:
I got 404 when issuing
wget http://127.0.0.1:3000/assets/tablesort-5.2.1.min-c6968762.js

I was debugging the static.rb middleware and I discovered that the assets generated when container starting are not readable.

1. docker exec -it --user redmine:redmine REDMINE sh
2. ruby -e "puts File.readable?('/usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js')" I got false

Could someone explain me why I got this behaviour, please?

[LaurentGoderre]

See the 'WHere to Store Data' from the docs here: https://hub.docker.com/_/redmine/

[yev]

@LaurentGoderre thank you for your feedback. I know about volumes.
IMHO the volume is not great choice for assets management. The assets it's internal stuff and should be kept inside container. Each time there will be new version of redmine there is a risk to have old artefacts.

One more reason why I've created the issue, if I run the same container with SQLite the assets are served correctly...

PS: by the way, even if I'm using volume to serve assets through Nginx, I have the same problem with attachments which are stored in volume, mounted to container but are not readable because of permission problem
ruby -e "puts File.readable?('/usr/src/redmine/files/2024/04/240405092521_photo1712319673.jpeg')"
Could you, please, advise me how to fix the permissions for existing files coming from external volume?

[tianon]

I think those asset files are created by Redmine during initial startup, not by our entrypoint/image. 🤔

In your example, if you start Redmine first, then run your "readable" check (or exec into an existing Redmine instance and run your readable check), it should succeed:

$ docker run --name foo -d --user redmine:redmine --pull=always redmine:alpine3.21
alpine3.21: Pulling from library/redmine
Digest: sha256:e36eb2d7b238eb2df867062e526afeb8898755ecb04bd26d706eae92bba9b800
Status: Image is up to date for redmine:alpine3.21
337fbd33883876acf32af064ef8914e67be3d2385526bada12583bbf4d9434a4
$ docker logs --tail=2 foo
* Listening on http://0.0.0.0:3000
Use Ctrl-C to stop
$ docker exec -it foo ruby -e "puts File.readable?('public/assets/tablesort-5.2.1.min-c6968762.js')"
true

[tianon]

If you use docker diff, you can also see that they're not stored in volumes:

$ docker diff foo | grep tablesort
A /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
A /usr/src/redmine/public/assets/tablesort-5.2.1.number.min-8a47560b.js

[yev]

ruby -e "puts File.readable?('public/assets/tablesort-5.2.1.min-c6968762.js')"

Yes, the assets are generated by Redmine RoR engine, not by the docker wrapper.

I just tested your hypothesis. Nope the check returns always false.

[tianon]

That's weird -- as you can see, it was successful for me, so I don't know what's different about your setup. 🙈

[yev]

That's weird -- as you can see, it was successful for me, so I don't know what's different about your setup. 🙈

One difference I see is that I attach volumes with configuration. Like
-v /srv/redmine/config/database.yml:/usr/src/redmine/config/database.yml \ -v /srv/redmine/config/configuration.yml:/usr/src/redmine/config/configuration.yml \
But I don't understand how it can interfere with permission problem.

[LaurentGoderre]

What happens if you check the permissions outside of ruby?

docker exec -it foo ls -lah /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
-rw-r--r--    1 redmine  redmine     3.0K Jan  9 14:19 /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js

[yev]

What happens if you check the permissions outside of ruby?

docker exec -it foo ls -lah /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
-rw-r--r--    1 redmine  redmine     3.0K Jan  9 14:19 /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js

the permissions is ok
-rw-r--r-- 1 redmine redmine 3.0K Jan 8 17:50 /usr/src/redmine/public/assets/tablesort-5.2.1.min-c6968762.js
I checked File.owner? and File.readable_real? - both return true