Nest JS doesn't have permissions to copy GRPC files inside docker - docker

Question

I have a docker container running via docker-compose with the command as running nestjs in dev mode:
FROM node:16-alpine as base
RUN apk add --no-cache libc6-compat tini
FROM base as dev
ENV NODE_ENV development
USER node
WORKDIR /home/node
# copy all files over
COPY --chown=node:node ./ ./
RUN mkdir -p ./my-app/dist/shared/grpc
RUN chown -R node:node ./my-app/dist
RUN chown -R node:node ./my-app/dist/shared/grpc
My grpc files are in a shared project. the full structure is:
services/shared
services/my-app
The shared project has grpc files inside the directory shared/grpc.
NestJS copies these over to it's dist folder when building. As this is dev, that's every code change or on docker error:
my-app/nest-cli.json:
{
"collection": "#nestjs/schematics",
"sourceRoot": "src",
"compilerOptions": {
"assets": [
{
"include": "../../shared/grpc/*.proto",
"outDir": "./dist/shared/grpc"
}
],
"watchAssets": true
},
"entryFile": "/my-app/src/main"
}
NestJS seems to detect 0 errors, but fails on the copying of the grpc files:
my-app_1 | [7:06:11 AM] Found 0 errors. Watching for file changes.
my-app_1 |
my-app_1 | node:fs:1828
my-app_1 | handleErrorFromBinding(ctx);
my-app_1 | ^
my-app_1 |
my-app_1 | Error [ShellJSInternalError]: EPERM: operation not permitted, chmod 'dist/shared/grpc/apps.proto'
my-app_1 | at Object.chmodSync (node:fs:1828:3)
my-app_1 | at copyFileSync (/home/node/my-app/node_modules/shelljs/src/cp.js:78:8)
my-app_1 | at /home/node/my-app/node_modules/shelljs/src/cp.js:298:7
my-app_1 | at Array.forEach (<anonymous>)
my-app_1 | at Object._cp (/home/node/my-app/node_modules/shelljs/src/cp.js:243:11)
my-app_1 | at Object.cp (/home/node/my-app/node_modules/shelljs/src/common.js:384:25)
my-app_1 | at AssetsManager.actionOnFile (/home/node/my-app/node_modules/#nestjs/cli/lib/compiler/assets-manager.js:95:19)
my-app_1 | at FSWatcher.<anonymous> (/home/node/my-app/node_modules/#nestjs/cli/lib/compiler/assets-manager.js:70:47)
my-app_1 | at FSWatcher.emit (node:events:520:28)
my-app_1 | at FSWatcher.emitWithAll (/home/node/my-app/node_modules/chokidar/index.js:540:8) {
my-app_1 | errno: -1,
my-app_1 | syscall: 'chmod',
my-app_1 | code: 'EPERM',
my-app_1 | path: 'dist/shared/grpc/apps.proto'
my-app_1 | }
my-app_1 | error Command failed with exit code 1.
my-app_1 | info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
my-app_1 | yarn run v1.22.17
However I can't work out why - it has ownership of all the folders it needs to access. Here's my docker-compose:
version: '3.8'
services:
my-app:
build:
context: .
target: dev
dockerfile: ./my-app/Dockerfile
restart: always
user: node
ports:
- 3003:3000
volumes:
- ./my-app:/home/node/my-app
- ./shared:/home/node/shared
working_dir: /home/node/my-app
command: yarn run start:dev
volumes:
my-app:
Edit 1
After removing USER node from Dockerfile and docker-compose this works. But that means node is running as root which is not OK and not a secure solution. I have even tried adding RUN chmod -R 777 /home/node within Dockerfile and that doesnt work. There must be something behind the scenes in nestjs that needs specific permissions but I can't figure out what.

Answer 1

Bit late to the party, but it was my nest-cli.json file that was causing the issue for me.
under compilerOptions I listed assets that aren't normally watched by Nest (ie: .proto or in my case .ejs files). Removing that line fixed it for me, so it had to do with me running the app in --watch mode and it needing to hot reload that file and not having permissions to copy it.
nest-cli.json:
{
"collection": "#nestjs/schematics",
"sourceRoot": "src",
"compilerOptions": {
"assets": [
"app/**/**/*.ejs"
],
"watchAssets": true
}
}