lekss361/gendesign
1
0
Fork 0
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions

fix(browser): run camoufox fetch as root so geoip mmdb write succeeds (#905)

Browse source 
CI build-browser (and the deploy) went red on #907's browser image:
  PermissionError: [Errno 13] Permission denied:
  '/usr/local/lib/python3.12/site-packages/camoufox/GeoLite2-City.mmdb'

camoufox fetch with geoip=True downloads TWO things: the Firefox build (→
$HOME/.cache, correctly routed to /home/app via ENV HOME, the #899 fix) AND the
GeoLite2 mmdb, which it writes INTO the camoufox package dir in site-packages.
Since the browser image pip-installs camoufox as root, that dir is root-owned, so
running fetch as the app user can't write the mmdb → build fails.

Fix: run fetch as root (writes both the mmdb and — via ENV HOME — Firefox into
/home/app/.cache), then chown the Firefox cache to app. The mmdb stays root-owned
in site-packages but world-readable, which is all the runtime app user needs.

Verified by a real local image build (camoufox fetch now completes, image exports).
The deploy was gated off by the failed build-browser job (not partially applied),
so prod was never broken.

Refs #905, #883, #899
This commit is contained in:
bot-backend 2026-05-31 17:51:43 +03:00
parent d6479c13b9
commit 393ecea458
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
tradein-mvp/browser/Dockerfile
View file

@ -25,14 +25,19 @@ RUN pip install --no-cache-dir "camoufox[geoip]"
COPY server.py ./server.py
# CRITICAL (#899): USER + ENV HOME должны быть установлены ДО fetch,
# чтобы Firefox-сборка легла в /home/app/.cache — туда же, куда рантайм её ищет.
# Без этого fetch под root кладёт браузер в /root/.cache и app при старте
# не находит Firefox ("browser not found").
USER app
# camoufox fetch качает (а) Firefox-сборку и (б) GeoLite2 mmdb (geoip=True).
# Firefox идёт в $HOME/.cache → ENV HOME=/home/app кладёт его в кэш app-юзера,
# куда рантайм его ищет (фикс #899). НО mmdb пишется в site-packages пакета
# camoufox (root-owned после pip install) — под app это PermissionError на
# GeoLite2-City.mmdb. Поэтому fetch выполняем под ROOT (пишет и mmdb, и —
# благодаря ENV HOME — Firefox в /home/app/.cache), затем chown'им Firefox-кэш
# на app. mmdb остаётся root-owned в site-packages (world-readable → app читает
# на рантайме). Verified реальной сборкой образа 2026-05-31.
ENV HOME=/home/app
RUN python -m camoufox fetch
RUN python -m camoufox fetch && chown -R app:app /home/app/.cache
USER app
EXPOSE 3000