Folders HOME and GITEA_WORK_DIR should corelate in rootless installation #396
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
I am using the helm chart version 6.0.4 and had trouble running it on OpenShift 4.11.
The helm chart can be run with the rootless option which solved some, but not all issues.
One of them was, that the Gitea Pod itself did not use the defined working directory, which would be on the mounted persistent volume in
/data
. Instead, it tried to create/chmod the folder/var/lib/gitea/git
, which results in "permission denied" on OpenShift. The init-containers did run in/data
and/data/gitea
and created their files there.They used the environment variable
GITEA_WORK_DIR
which is set to/data
.I discovered that the Gitea rootless image uses the environment variable
HOME
to reference to the git folder.HOME
points to/var/lib/gitea/git
which in a constrained platform like OpenShift, where you would choose the rootless image, is not writable. (There is the/data
mount for everything we need)The docker-setup script in the rootless image tries to create/chmod a folder based on that
HOME
variable:https://github.com/go-gitea/gitea/blob/main/docker/rootless/usr/local/bin/docker-setup.sh#L4
Setting the environment variable
HOME
in the values.yaml solved the issue:(For everyone else having this issue: Overwrite also the
GITEA_TEMP
variable to point to the/data
mount)My suggestion would be to add the
HOME
variable in the statefulset definition, preferably together with the rootless switch:https://gitea.com/gitea/helm-chart/src/branch/main/templates/gitea/statefulset.yaml#L240
Or add this fact to the documentation. Maybe suggesting creating a volume mount also for
/var/lib/gitea
or settingHOME
correctly.Thanks, this is a very concise description!
Openshift is usually stricter in many points and most don't have a testing cluster available.
I am also running with the rootless image myself on EKS and I can see that
/var/lib/gitea/git
exists but it's empty ?Is it empty in your install as well?
Anyhow, changing the default
HOME
definition conditionally on the rootless image use makes sense.Is
/tmp
also restricted in openshift?I cannot check if
/var/lib/gitea/git
is empty or not, because with that default setting, the pod won't even start.Same goes for the folder
/tmp
.The issue lies in the fact that the
chmod
operation will fail on those folders.OpenShift does not allow chmod-ing files/folders in non-mounted places, at least with the current security context constraints (scc) active in my OpenShift install.
Thanks for considering the
HOME
env-var definition!That's odd. The Helm Chart explicitly overrides and aligns all the differences between both image variants. It sounds like Openshift would look for the image spec and restricts the environment based on that.
Feel free to propose an Openshift related section to the docs.
Yes, that's what OpenShift does.
Nevermind: The GITEA_TEMP override is not necessary.
The helm chart already maps
/tmp
to an "emptyDir", which is also for OpenShift useable.https://gitea.com/gitea/helm-chart/src/branch/main/templates/gitea/statefulset.yaml#L340-L341