Skip to content

fix(docker): replace auth_storage named volume with bind mount#65

Merged
DavidsonGomes merged 3 commits into
developfrom
fix/auth-storage-permissions
Apr 27, 2026
Merged

fix(docker): replace auth_storage named volume with bind mount#65
DavidsonGomes merged 3 commits into
developfrom
fix/auth-storage-permissions

Conversation

@marcelogorutuba
Copy link
Copy Markdown
Member

@marcelogorutuba marcelogorutuba commented Apr 24, 2026

Summary

  • Substitui o named volume auth_storage por bind mount ./evo-auth-service-community/storage:/rails/storage no docker-compose.yml
  • Remove a entrada auth_storage: da seção global de volumes

Problema

O named volume Docker era criado com ownership root, mas o processo Rails roda como usuário rails (UID 1000). Ao tentar salvar uma foto de perfil, o Rails tentava criar subpastas em /rails/storage/ e recebia Errno::EACCES: Permission denied @ dir_s_mkdir, retornando HTTP 500.

Solução

Com o bind mount, o Docker Desktop mapeia o diretório do host (./evo-auth-service-community/storage) com permissões de escrita para o processo do container, eliminando o erro de permissão.

Test plan

  • Subir o serviço com docker compose up -d evo-auth
  • Acessar perfil de usuário e fazer upload de nova foto
  • Verificar que o avatar é salvo e exibido corretamente sem erros 500

🤖 Generated with Claude Code

Summary by Sourcery

Bug Fixes:

  • Map the evo-auth service storage directory with a bind mount so the Rails process can write to /rails/storage inside the container.

DavidsonGomes and others added 3 commits April 16, 2026 17:16
Community fixes: bot-runtime secret, configurable gateway upstreams, dynamic AI models
… permission denied on storage

Named Docker volumes are created with root ownership, causing Errno::EACCES
when the Rails process (running as user rails:1000) tries to create subdirs
under /rails/storage. Bind mount gives the container process write access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sourcery-ai
Copy link
Copy Markdown

sourcery-ai Bot commented Apr 24, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR updates the evo-auth service container configuration to mount the Rails storage directory from the host via a bind mount instead of using a Docker named volume, resolving file permission issues when Rails writes to /rails/storage.

Flow diagram for avatar upload using bind mounted storage

flowchart TD
    User["User uploads avatar via web UI"] --> AppServer["Rails app in evo-auth container"]
    AppServer --> ChoosePath["Write file to /rails/storage"]
    ChoosePath --> ContainerFS["Container path /rails/storage (bind mount)"]
    ContainerFS --> HostDir["Host directory ./evo-auth-service-community/storage"]
    HostDir --> Success["File saved successfully (no permission error)"]
Loading

File-Level Changes

Change Details Files
Switch Rails storage in evo-auth service from a Docker named volume to a host bind mount to fix permission errors.
  • Add a volumes section to the evo-auth service mapping ./evo-auth-service-community/storage to /rails/storage inside the container
  • Rely on host directory permissions so the Rails process (UID 1000) can write to /rails/storage without Errno::EACCES errors
  • Implicitly deprecate/remove the previous auth_storage named volume usage for this service
docker-compose.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • Switching from a named volume to a relative bind mount hard-codes the repo layout (./evo-auth-service-community/storage); consider making the host path configurable (e.g., via an env var or a top-level x- anchor) or using a path that is stable even if the service directory is renamed.
  • If this docker-compose.yml is used beyond local development, a bind mount to a project-relative directory may not exist or be writable in other environments; consider keeping the named volume for non-dev or moving this change into a dev-only override file.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Switching from a named volume to a relative bind mount hard-codes the repo layout (`./evo-auth-service-community/storage`); consider making the host path configurable (e.g., via an env var or a top-level `x-` anchor) or using a path that is stable even if the service directory is renamed.
- If this `docker-compose.yml` is used beyond local development, a bind mount to a project-relative directory may not exist or be writable in other environments; consider keeping the named volume for non-dev or moving this change into a dev-only override file.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@DavidsonGomes DavidsonGomes changed the base branch from main to develop April 27, 2026 15:46
@DavidsonGomes DavidsonGomes merged commit 4a8bb71 into develop Apr 27, 2026
3 checks passed
DavidsonGomes added a commit that referenced this pull request May 4, 2026
Follow-up to PR #65 — that fix wired the bind mount only into evo-auth
but evo-auth-sidekiq runs the same Rails app and would still hit
Errno::EACCES when any background job touches /rails/storage (e.g.
ActiveStorage analyzers, attachment processing).

- Add the same ./evo-auth-service-community/storage:/rails/storage
  bind mount to evo-auth-sidekiq.
- Prepend `mkdir -p /rails/storage` to both service commands so the
  path exists before Rails boots, even when the host directory is
  empty or the bind mount is replaced by a different driver.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants