This is an automated email from the ASF dual-hosted git repository.
yuqi1129 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/main by this push:
new 72dbdace25 [#11652] fix(docker): chmod 775 server home dir for
non-root log creation (#11659)
72dbdace25 is described below
commit 72dbdace25c9fb12cfb41e7e5f101fee00070ede
Author: roryqi <[email protected]>
AuthorDate: Mon Jun 15 23:45:40 2026 -0700
[#11652] fix(docker): chmod 775 server home dir for non-root log creation
(#11659)
### What changes were proposed in this pull request?
Add `chmod 775 <server-home>` to the RUN step of the gravitino,
iceberg-rest-server and lance-rest-server Dockerfiles so the directory
created by `WORKDIR` becomes group-writable.
### Why are the changes needed?
PR #11533 replaced `chmod -R g+rwX <dir>` with `COPY --chmod=775`.
However
`COPY --chmod` only applies to the copied contents, not to the target
directory itself, which was created earlier by `WORKDIR` and retains the
default `755 root:root` permission. The container runs as `uid=1000,
gid=0`,
so the non-root user cannot create subdirectories such as
`/opt/gravitino/logs`, and the server fails at startup:
```
main ERROR Unable to create file /opt/gravitino/logs/gravitino-server.log
java.io.IOException: Could not create directory /opt/gravitino/logs
```
A single non-recursive `chmod 775` on the top directory fixes this while
preserving #11533's goal of not duplicating an image layer from a
recursive
chmod.
Fix: #11652
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Built the real gravitino image via `dev/docker/build-docker.sh` and ran
it
as `uid=1000, gid=0`:
- `/opt/gravitino` now has `drwxrwxr-x` (775) instead of `755`.
- The server starts, creates `/opt/gravitino/logs/gravitino-server.log`,
and `GET /api/version` returns HTTP 200.
- Confirmed the previous `Could not create directory` error no longer
appears.
Co-authored-by: Claude Opus 4.8 <[email protected]>
---
dev/docker/gravitino/Dockerfile | 3 ++-
dev/docker/iceberg-rest-server/Dockerfile | 3 ++-
dev/docker/lance-rest-server/Dockerfile | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/dev/docker/gravitino/Dockerfile b/dev/docker/gravitino/Dockerfile
index 7f7cc2b4b8..c5d319ca22 100644
--- a/dev/docker/gravitino/Dockerfile
+++ b/dev/docker/gravitino/Dockerfile
@@ -26,7 +26,8 @@ WORKDIR /opt/gravitino
COPY --chmod=775 packages/gravitino /opt/gravitino
-RUN chmod +x /opt/gravitino/docker/docker-entrypoint.sh \
+RUN chmod 775 /opt/gravitino \
+ && chmod +x /opt/gravitino/docker/docker-entrypoint.sh \
&& useradd -u 1000 -g 0 -M -s /sbin/nologin gravitino
EXPOSE 8090
diff --git a/dev/docker/iceberg-rest-server/Dockerfile
b/dev/docker/iceberg-rest-server/Dockerfile
index 7ae8bf16b1..5ed7b6b0f5 100644
--- a/dev/docker/iceberg-rest-server/Dockerfile
+++ b/dev/docker/iceberg-rest-server/Dockerfile
@@ -27,7 +27,8 @@ WORKDIR /opt/gravitino-iceberg-rest-server
COPY --chmod=775 packages/gravitino-iceberg-rest-server
/opt/gravitino-iceberg-rest-server
-RUN chmod +x
/opt/gravitino-iceberg-rest-server/bin/start-iceberg-rest-server.sh \
+RUN chmod 775 /opt/gravitino-iceberg-rest-server \
+ && chmod +x
/opt/gravitino-iceberg-rest-server/bin/start-iceberg-rest-server.sh \
&& useradd -u 1000 -g 0 -M -s /sbin/nologin gravitino
EXPOSE 9001
diff --git a/dev/docker/lance-rest-server/Dockerfile
b/dev/docker/lance-rest-server/Dockerfile
index f9b67c6de0..71795cd042 100644
--- a/dev/docker/lance-rest-server/Dockerfile
+++ b/dev/docker/lance-rest-server/Dockerfile
@@ -27,7 +27,8 @@ WORKDIR /opt/gravitino-lance-rest-server
COPY --chmod=775 packages/gravitino-lance-rest-server
/opt/gravitino-lance-rest-server
-RUN chmod +x /opt/gravitino-lance-rest-server/bin/start-lance-rest-server.sh
+RUN chmod 775 /opt/gravitino-lance-rest-server \
+ && chmod +x /opt/gravitino-lance-rest-server/bin/start-lance-rest-server.sh
EXPOSE 9101
