fix(docker): replace auth_storage named volume with bind mount#65
Merged
Conversation
Community fixes: bot-runtime secret, configurable gateway upstreams, dynamic AI models
… permission denied on storage Named Docker volumes are created with root ownership, causing Errno::EACCES when the Rails process (running as user rails:1000) tries to create subdirs under /rails/storage. Bind mount gives the container process write access. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR updates the evo-auth service container configuration to mount the Rails storage directory from the host via a bind mount instead of using a Docker named volume, resolving file permission issues when Rails writes to /rails/storage. Flow diagram for avatar upload using bind mounted storageflowchart TD
User["User uploads avatar via web UI"] --> AppServer["Rails app in evo-auth container"]
AppServer --> ChoosePath["Write file to /rails/storage"]
ChoosePath --> ContainerFS["Container path /rails/storage (bind mount)"]
ContainerFS --> HostDir["Host directory ./evo-auth-service-community/storage"]
HostDir --> Success["File saved successfully (no permission error)"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- Switching from a named volume to a relative bind mount hard-codes the repo layout (
./evo-auth-service-community/storage); consider making the host path configurable (e.g., via an env var or a top-levelx-anchor) or using a path that is stable even if the service directory is renamed. - If this
docker-compose.ymlis used beyond local development, a bind mount to a project-relative directory may not exist or be writable in other environments; consider keeping the named volume for non-dev or moving this change into a dev-only override file.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Switching from a named volume to a relative bind mount hard-codes the repo layout (`./evo-auth-service-community/storage`); consider making the host path configurable (e.g., via an env var or a top-level `x-` anchor) or using a path that is stable even if the service directory is renamed.
- If this `docker-compose.yml` is used beyond local development, a bind mount to a project-relative directory may not exist or be writable in other environments; consider keeping the named volume for non-dev or moving this change into a dev-only override file.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
DavidsonGomes
added a commit
that referenced
this pull request
May 4, 2026
Follow-up to PR #65 — that fix wired the bind mount only into evo-auth but evo-auth-sidekiq runs the same Rails app and would still hit Errno::EACCES when any background job touches /rails/storage (e.g. ActiveStorage analyzers, attachment processing). - Add the same ./evo-auth-service-community/storage:/rails/storage bind mount to evo-auth-sidekiq. - Prepend `mkdir -p /rails/storage` to both service commands so the path exists before Rails boots, even when the host directory is empty or the bind mount is replaced by a different driver. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
auth_storagepor bind mount./evo-auth-service-community/storage:/rails/storagenodocker-compose.ymlauth_storage:da seção global de volumesProblema
O named volume Docker era criado com ownership root, mas o processo Rails roda como usuário
rails(UID 1000). Ao tentar salvar uma foto de perfil, o Rails tentava criar subpastas em/rails/storage/e recebiaErrno::EACCES: Permission denied @ dir_s_mkdir, retornando HTTP 500.Solução
Com o bind mount, o Docker Desktop mapeia o diretório do host (
./evo-auth-service-community/storage) com permissões de escrita para o processo do container, eliminando o erro de permissão.Test plan
docker compose up -d evo-auth🤖 Generated with Claude Code
Summary by Sourcery
Bug Fixes: