Permission Denied error when uploading to local filesystem via paperclip gem - ruby-on-rails

Question

I've used paperclip in the past with AWS S3 storage, but with this project I'm trying to reduce external dependencies. I'd like to save uploaded images to the public/assets directory, for immediate use (skirting asset pipeline). Here's the error I'm getting when it tries to save:
Errno::EPERM in PostsController#update
Operation not permitted - /usr/local/src/project_name/public/assets/
...
app/controllers/posts_controller.rb:43:in `update'
I've chmod'ed the directories to 755, as suggested in an existing Stack Overflow solution. That shouldn't even matter though, because thin (my web server) is running as root (via sudo) so that I can bind to 443 (HTTPS). I don't understand why would there even be a permission error for root. What am I not getting? Is the file being uploaded by the user under an anonymous public account, or is the application server saving it as root?
Additional info:
Environment: Development
Operating System: OS X 10.9.3
Ruby version:
MRI ruby 1.9.3p194 (2012-04-20 revision 35410) [x86_64-darwin11.4.0]
Gem versions:
Gems included by the bundle:
* actionmailer (4.0.3)
* actionpack (4.0.3)
* activemodel (4.0.3)
* activerecord (4.0.3)
* activerecord-deprecated_finders (1.0.3)
* activesupport (4.0.3)
* acts-as-taggable-on (3.2.6)
* arel (4.0.2)
* atomic (1.1.15)
* bcrypt (3.1.7)
* bcrypt-ruby (3.1.5)
* builder (3.1.4)
* bundler (1.5.3)
* climate_control (0.0.3)
* cocaine (0.5.3)
* coffee-rails (4.0.1)
* coffee-script (2.2.0)
* coffee-script-source (1.7.0)
* daemons (1.1.9)
* epiceditor (0.2.2.1)
* erubis (2.7.0)
* eventmachine (1.0.3)
* execjs (2.0.2)
* faraday (0.9.0)
* friendly_id (5.0.4)
* haml (4.0.5)
* haml-rails (0.5.3)
* hike (1.2.3)
* i18n (0.6.9)
* jquery-rails (3.1.0)
* json (1.8.1)
* jwt (1.0.0)
* mail (2.5.4)
* mime-types (1.25.1)
* minitest (4.7.5)
* multi_json (1.8.4)
* multi_xml (0.5.5)
* multipart-post (2.0.0)
* oauth (0.4.7)
* oauth2 (0.9.4)
* paperclip (4.1.1)
* polyglot (0.3.4)
* rack (1.5.2)
* rack-test (0.6.2)
* rails (4.0.3)
* railties (4.0.3)
* rake (10.1.1)
* rdiscount (2.1.7.1)
* sass (3.2.14)
* sass-rails (4.0.1)
* sorcery (0.8.5)
* sprockets (2.11.0)
* sprockets-rails (2.0.1)
* sqlite3 (1.3.9)
* thin (1.6.2)
* thor (0.18.1)
* thread_safe (0.2.0)
* tilt (1.4.1)
* treetop (1.4.15)
* tzinfo (0.3.38)
* uglifier (2.4.0)
File permissions (via ls -la public):
drwxr-xr-x 9 proto admin 306 Jul 6 15:16 .
drwxr-xr-x 23 proto admin 782 Mar 28 06:24 assets
Server Daemon (via ps aux | grep [t]hin):
root 2650 0.0 0.9 2513704 79120 ?? S 3:43PM 0:07.81 thin server (0.0.0.0:443)
Post model:
class Post < ActiveRecord::Base
# Relationships
extend FriendlyId
friendly_id :title, use: [:slugged, :history]
has_attached_file :photo,
path: ':rails_root/public/assets/',
url: ':basename.:extension'
belongs_to :author
# Validations
validates_presence_of :title, :body, :author_id, :slug
validates_uniqueness_of :slug
validates_attachment_content_type :photo, content_type: /\Aimage\/.*\Z/
# Overriding this friendly method to update slug when title changes
def should_generate_new_friendly_id?
slug.blank? || title_changed?
end
end
Update action:
def update
#data = {
title: params[:post][:title],
body: params[:post][:body],
photo: params[:post][:photo]
}
if #post.update! #data
redirect_to #post
else
render :edit, layout: 'layouts/admin'
end
end
Form partial:
= form_for post, html: { multipart: true } do |f|
= f.text_field :title, placeholder: 'Title'
%br
= f.text_area :body, class: 'hidden'
#epiceditor
%br
= f.submit 'Save', class: 'button'
- unless post.new_record?
= link_to 'Delete', post, method: 'delete', class: 'button'
= f.file_field :photo, class: 'upload'
- unless post.photo.nil?
= link_to post.photo.url, post.photo.url

Answer 1

This is too long to write as a comment, but you could use other port than 443, which the root will redirect to from port 443, using, let's say, iptables.
$ sudo iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
Then you can start your server normally, as rails user, on port 8443
This is of course if you want to do so.
Regarding the comment/question I've asked to your question, I'm not familiar with thin server, but I would consider the case where the application is running as rails user (proton?) and the frontend web server as root. In that case, root owned assets folder will probably not writeable for rails user....

Answer 2

Change the permissions on public folder to 775.
Update
You might find your solution here: Errno::EPERM (Operation not permitted FILE_PATH) when uploading image with Rails, Carrierwave, Amazon EC2
Looks like you might need to change the owner of public/assets to root (or whichever user the application is running as).