Docker image 39.20.6: permission denied, mkdir '/tmp/renovate/cache/containerbase'

[cospeedster]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Azure DevOps Server

Please tell us more about your question or problem

After updating the renovate container image from 39.20.1 to 39.20.6 we get the following error. It seems to be a result of
1f71981.

Logs (if relevant)

Logs

##[section]Starting: Run renovate
==============================================================================
Task         : Bash
Description  : Run a Bash script on macOS, Linux, or Windows
Version      : 3.231.4
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
==============================================================================
Generating script.
Script contents:
renovate
========================== Starting Command Output ===========================
[command]/usr/bin/bash /__w/_temp/07c8e5f5-3684-453b-a78f-f6304ea9ccb9.sh
DEBUG: Using RE2 regex engine
DEBUG: Parsing configs
DEBUG: Checking for config file in config.js
DEBUG: File config
       "config": {
         "platform": "azure",
         "endpoint": "<redacted>",
         "gitAuthor": "<redacted>",
         "extends": [
           "config:best-practices",
           ":rebaseStalePrs",
           ":separateMultipleMajorReleases",
           ":separateMultipleMinorReleases",
           ":separatePatchReleases",
           ":semanticCommits",
           ":disableDependencyDashboard"
         ],
         "hostRules": [
           {
             "matchHost": "<redacted>",
             "username": "<redacted>",
             "password": "***********"
           }
         ],
         "automerge": true,
         "automergeType": "pr",
         "automergeStrategy": "squash",
         "platformAutomerge": true,
         "packageRules": [
           {
             "matchDatasources": ["docker"],
             "matchUpdateTypes": ["pinDigest"],
             "autoApprove": true,
             "automerge": true
           }
         ],
         "repositories": [
           "<redacted>"
         ]
       }
DEBUG: CLI config
       "config": {}
DEBUG: Env config
       "config": {"hostRules": [], "token": "***********"}
DEBUG: Combined config
       "config": {
         "platform": "azure",
         "endpoint": "<redacted>",
         "gitAuthor": "<redacted>",
         "extends": [
           "config:best-practices",
           ":rebaseStalePrs",
           ":separateMultipleMajorReleases",
           ":separateMultipleMinorReleases",
           ":separatePatchReleases",
           ":semanticCommits",
           ":disableDependencyDashboard"
         ],
         "hostRules": [
           {
             "matchHost": "<redacted>",
             "username": "<redacted>",
             "password": "***********"
           }
         ],
         "automerge": true,
         "automergeType": "pr",
         "automergeStrategy": "squash",
         "platformAutomerge": true,
         "packageRules": [
           {
             "matchDatasources": ["docker"],
             "matchUpdateTypes": ["pinDigest"],
             "autoApprove": true,
             "automerge": true
           }
         ],
         "repositories": [
           "<redacted>"
         ],
         "token": "***********"
       }
DEBUG: Adding trailing slash to endpoint
DEBUG: Enabling forkProcessing while in non-autodiscover mode
DEBUG: Enabling onboardingNoDeps while in non-autodiscover mode
DEBUG: Found valid git version: 2.47.0
DEBUG: Setting global hostRules
DEBUG: Adding password authentication for <redacted> (hostType=undefined) to hostRules
DEBUG: Using configured gitAuthor (<redacted>)
DEBUG: Adding token authentication for azuredevops.dataport.de (hostType=azure) to hostRules
DEBUG: Using baseDir: /tmp/renovate
DEBUG: Using cacheDir: /tmp/renovate/cache
DEBUG: Using containerbaseDir: /tmp/renovate/cache/containerbase
FATAL: Fatal error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'
       "err": {
         "errno": -13,
         "code": "EACCES",
         "syscall": "mkdir",
         "path": "/tmp/renovate/cache/containerbase",
         "message": "EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'",
         "stack": "Error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'"
       }
 INFO: Renovate is exiting with a non-zero code due to the following logged errors
       "loggerErrors": [
         {
           "name": "renovate",
           "level": 60,
           "logContext": "HQyFnqisGxRHpRtcNcZ8Y",
           "err": {
             "errno": -13,
             "code": "EACCES",
             "syscall": "mkdir",
             "path": "/tmp/renovate/cache/containerbase",
             "message": "EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'",
             "stack": "Error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'"
           },
           "msg": "Fatal error: EACCES: permission denied, mkdir '/tmp/renovate/cache/containerbase'"
         }
       ]
##[error]Bash exited with code '1'.
##[section]Finishing: Run renovate

[rarkins]

User ID was changed from 1001 to 12021. Quickest way to deal with this is to delete/reset any caches/volumes you're using

[rmontag-ap]

Hello Gabriel,
thank you, I was able to mitigate the issue by setting the gid to 0.

We are using Kubernetes Plugin in Jenkins and I had to set the property "Run As Group ID" for the Container Template to 0 - leaving the "Run As User ID" with the uid of our jenkins user.

[rarkins]

FYI running as group ID 0 is a requirement of Renovate and a solution to your problem, if not using the default UID, and is not a "mitigation"

[cospeedster]

This solution sounds good but in context of Azure DevOps Server we cannot set uid nor gid of the user created by the agent in context of a container job (see https://stackoverflow.com/a/59589187). I'll try to get around this.

[rmontag-ap]

Gabriel has changed the chmod to 777 yesterday 39.23.0...39.23.1
#32649
but I have the feeling, that this will change again...

[cospeedster]

@Gabriel-Ladzaretti changed this because of @KUGA2 's comment on #32594.

Will this persist now?

/cc @rarkins @viceice

[rarkins]

We have no plans to change it, but we can't guarantee that this scenario will keep working forever. If you run a Renovate container it should be either using the built-in UID (12021) or GID (0), and if you can't do that then you will need to manage any workarounds or rebuilding of the image yourself.

[viceice]

changed the title. it's not a bug.