Permission denied when running docker container

[gpmayorga]

   ║ error: failed to create directory `/build/runtime/altair/target`
  ║
  ║ Caused by:
  ║ Permission denied (os error 13)
  parse error: Invalid numeric literal at line 1, column 11

I'm getting that error when running the action:

      - name: Build ${{ matrix.chain }}
        id: srtool_build
        uses: chevdor/srtool-actions@v0.8.0
        env:
          BUILD_OPTS: "--features on-chain-release-build"
        with:
          chain: ${{ matrix.chain }}
          # package: ${{ matrix.chain }}
          # runtime_dir: ${{ matrix.runtime.path }}
          workdir: ${{ github.workspace }}
          profile: "release"   

Before this we were using our own workflow with the docker command:

      - name: Run srtool # https://docs.substrate.io/reference/command-line-tools/srtool/
        run: >
          docker run --rm  --user root --platform=linux/amd64
          -e PACKAGE=${{ matrix.chain }} -e BUILD_OPTS="--features=on-chain-release-build" -v /home/runner/.cargo:/cargo-home  
          -v ${{ github.workspace }}:/build paritytech/srtool:1.77.0-0.15.0
          /srtool/build --app

Notice the --user root which is probably why it worked on our case. Not sure why nobody else is running into this issue as the GHA runners run with user runner and the docker container probably has a different user ID which means it probably can't create folders inside the {{github.workspace}}

Some output in case it helps:

 ℹ️ SRTOOL_LATEST: 1.77.0
  ℹ️ image: paritytech/srtool:1.77.0
  ℹ️ chain: altair
  ℹ️ package: altair-runtime
  ℹ️ workdir: /home/runner/work/centrifuge-chain/centrifuge-chain
  ℹ️ runtime_dir: runtime/altair
  ℹ️ build_opts: --features on-chain-release-build
  ℹ️ parachain_pallet_id: 0x01
  ℹ️ profile: release
  ℹ️ authorize_upgrade_prefix: 0x02
  ℹ️ .git folder: drwxr-xr-x 8 runner runner 4096 Jul 8 10:51 /home/runner/work/centrifuge-chain/centrifuge-chain/.git
  ℹ️ Cargo.toml: -rw-r--r-- 1 runner runner 35584 Jul 8 10:51 /home/runner/work/centrifuge-chain/centrifuge-chain/Cargo.toml

Maybe the action should make sure it has enough permissions to write in the build directory and if not change the permissions before running the container?

[sam0x17]

same issue here

[atodorov]

      - name: Build WASM runtime
        id: srtool_build
        uses: chevdor/srtool-actions@v0.8.0
        env:
          BUILD_OPTS: "--release ${{ needs.setup.outputs.build_options }}"
        with:
          chain: "creditcoin"
          runtime_dir: runtime
          package: creditcoin3-runtime
          tag: ${{ env.RUSTC_VERSION }}
          workdir: ${{ github.workspace }}

  ℹ️ SRTOOL_LATEST: 1.81.0
  ℹ️ image: paritytech/srtool:1.77.0
  ℹ️ chain: creditcoin
  ℹ️ package: creditcoin3-runtime
  ℹ️ workdir: /home/ubuntu/actions-runner/_work/creditcoin3-next/creditcoin3-next
  ℹ️ runtime_dir: runtime
  ℹ️ build_opts: --release
  ℹ️ parachain_pallet_id: 0x01
  ℹ️ profile: release
  ℹ️ authorize_upgrade_prefix: 0x02
  ℹ️ .git folder: drwxrwxr-x 8 ubuntu ubuntu 4096 Oct 22 08:45 /home/ubuntu/actions-runner/_work/creditcoin3-next/creditcoin3-next/.git
  ℹ️ Cargo.toml: -rw-rw-r-- 1 ubuntu ubuntu 21504 Oct 22 08:45 /home/ubuntu/actions-runner/_work/creditcoin3-next/creditcoin3-next/Cargo.toml
  ::endgroup

I have exactly the same setup across several repositories (both private & public) and I only see this failure when trying to use a self-hosted GitHub runner. Works everywhere else (incl private repo on GitHub hosted runners).

[atodorov]

I did some digging and found out what the root cause of this is and how to fix it. It's not very pretty.

Details in paritytech/srtool#46 and
https://github.com/paritytech/srtool/blob/master/Dockerfile#L12-L13

The problem is that the paritytech/srtool docker image uses specific uid/gid numbers (1001 in particular) and when the /build directory is mounted from the outside (as in the case of chevdor/srtool-actions) sometimes these may end up mismatched. When that happens you get an OS error failing to access/write to files & directories.

In my particular case, on a self-hosted runner the default user ID was 1000 and then everything under /build would end up being owned by user 1000. The container itself is running as user builder(1001) hence the error.

In the case of executing this action in a GitHub hosted runner I am assuming (did not test it explictly) that there is already something with uid 1001, probably even the current default user and that's why everything works seamlessly.

Changing the file ownership before I execute the action fixes this for me:

      - name: Workaround for paritytech/srtool uid/gid mismatch
        run: |
          sudo chown -R 1001:1001 ${{ github.workspace }}

      - name: Build WASM runtime
        id: srtool_build
        uses: chevdor/srtool-actions@v0.8.0
        env:
          BUILD_OPTS: "--release ${{ needs.setup.outputs.build_options }}"
        with:
          chain: "creditcoin"
          runtime_dir: runtime
          package: creditcoin3-runtime
          tag: ${{ env.RUSTC_VERSION }}
          workdir: ${{ github.workspace }}

Note: if you have to write something back to the directory once this action is complete you will have to revert the workaround and update file ownership to the default.