danhuawang opened a new issue, #11652:
URL: https://github.com/apache/gravitino/issues/11652
### Version
main branch
### Describe what's wrong
After PR #11533 merged, the Gravitino Docker container fails to create the
`/opt/gravitino/logs` directory at runtime. The container runs as `uid=1000`
(gid=0), but `/opt/gravitino` directory has permission `drwxr-xr-x root:root`
(755), so the non-root user cannot create subdirectories.
The root cause is that PR #11533 replaced `chmod -R g+rwX /opt/gravitino`
with `COPY --chmod=775`. However, `COPY --chmod=775` only applies to the
**copied contents**, not the target directory (`/opt/gravitino`) itself, which
was created earlier by the `WORKDIR` instruction and retains the default 755
permission.
**Suggested fix:** Add `chmod 775 /opt/gravitino` in the RUN step:
```dockerfile
RUN chmod 775 /opt/gravitino \
&& chmod +x /opt/gravitino/docker/docker-entrypoint.sh \
&& useradd -u 1000 -g 0 -M -s /sbin/nologin gravitino
```
### Error message and/or stacktrace
```
main ERROR Unable to create file /opt/gravitino/logs/gravitino-server.log
java.io.IOException: Could not create directory /opt/gravitino/logs
at org.apache.logging.log4j.core.util.FileUtils.mkdir(FileUtils.java:129)
at
org.apache.logging.log4j.core.util.FileUtils.makeParentDirs(FileUtils.java:143)
at
org.apache.logging.log4j.core.appender.rolling.RollingFileManager$RollingFileManagerFactory.createManager(RollingFileManager.java:863)
```
### How to reproduce
1. Build the Gravitino Docker image from main branch (after PR #11533 merged)
2. Deploy the container in Kubernetes with the default Helm chart
3. Check logs: `kubectl logs <pod-name>`
4. Observe the `Could not create directory /opt/gravitino/logs` error
Verify with: `ls -la /opt/ | grep gravitino` → shows `drwxr-xr-x root:root`
(no group write).
### Additional context
Introduced by PR #11533 (`[#11532] fix(docker): avoid duplicate image layer
from recursive chmod`). The same issue likely affects the iceberg-rest-server
and lance-rest-server Dockerfiles modified in the same PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
