fix(browser): run camoufox fetch as root so geoip mmdb write succeeds — RED build-browser (#905) #908

Merged

lekss361 merged 1 commit from fix/905-camoufox-geoip-mmdb into main

2026-05-31 14:53:05 +00:00

bot-backend commented

2026-05-31 14:52:08 +00:00

Collaborator

🔴 Unblocks the red deploy

After #907 merged, the build-browser CI job failed → the deploy job is gated off (needs.build-browser.result != 'failure'), so #904/#907 did not roll out. Prod is not broken (still on the prior image), just not updated until this lands.

Error (caught by a real local image build)

PermissionError: [Errno 13] Permission denied:
'/usr/local/lib/python3.12/site-packages/camoufox/GeoLite2-City.mmdb'
RUN python -m camoufox fetch → exit 1

Root cause

camoufox fetch with geoip=True downloads two things:

the Firefox build → $HOME/.cache (correctly routed to /home/app/.cache via ENV HOME — the #899 fix works),
the GeoLite2-City.mmdb, which it writes into the camoufox package dir in site-packages.

The browser image pip installs camoufox as root → site-packages/camoufox/ is root-owned → running fetch as the app user can't write the mmdb there → build fails. (The backend image #899 didn't hit this because camoufox lived in an app-owned .venv; the standalone browser image uses system pip, hence root-owned.)

Fix

Run camoufox fetch as root (writes both the mmdb to site-packages and, via ENV HOME, Firefox to /home/app/.cache), then chown -R app:app /home/app/.cache. The mmdb stays root-owned in site-packages but world-readable — all the runtime app user needs (read-only geoip lookup).

Verified

Real local docker build of the fixed Dockerfile: camoufox fetch now completes (Camoufox successfully installed. → image exports). The earlier failing build + this passing rebuild are the before/after.

Refs #905, #883, #899

## 🔴 Unblocks the red deploy After #907 merged, the `build-browser` CI job failed → the `deploy` job is gated off (`needs.build-browser.result != 'failure'`), so #904/#907 did **not** roll out. **Prod is not broken** (still on the prior image), just not updated until this lands. ### Error (caught by a real local image build) ``` PermissionError: [Errno 13] Permission denied: '/usr/local/lib/python3.12/site-packages/camoufox/GeoLite2-City.mmdb' RUN python -m camoufox fetch → exit 1 ``` ### Root cause `camoufox fetch` with `geoip=True` downloads **two** things: 1. the Firefox build → `$HOME/.cache` (correctly routed to `/home/app/.cache` via `ENV HOME` — the #899 fix works), 2. the **GeoLite2-City.mmdb**, which it writes **into the camoufox package dir** in `site-packages`. The browser image `pip install`s camoufox as root → `site-packages/camoufox/` is root-owned → running fetch as the `app` user can't write the mmdb there → build fails. (The backend image #899 didn't hit this because camoufox lived in an app-owned `.venv`; the standalone browser image uses system `pip`, hence root-owned.) ### Fix Run `camoufox fetch` as **root** (writes both the mmdb to site-packages *and*, via `ENV HOME`, Firefox to `/home/app/.cache`), then `chown -R app:app /home/app/.cache`. The mmdb stays root-owned in site-packages but world-readable — all the runtime app user needs (read-only geoip lookup). ### Verified Real local `docker build` of the fixed Dockerfile: `camoufox fetch` now completes (`Camoufox successfully installed.` → image exports). The earlier failing build + this passing rebuild are the before/after. Refs #905, #883, #899

bot-backend added 1 commit 2026-05-31 14:52:08 +00:00

fix(browser): run camoufox fetch as root so geoip mmdb write succeeds (#905 ) 393ecea458

CI build-browser (and the deploy) went red on #907's browser image:
  PermissionError: [Errno 13] Permission denied:
  '/usr/local/lib/python3.12/site-packages/camoufox/GeoLite2-City.mmdb'

camoufox fetch with geoip=True downloads TWO things: the Firefox build (→
$HOME/.cache, correctly routed to /home/app via ENV HOME, the #899 fix) AND the
GeoLite2 mmdb, which it writes INTO the camoufox package dir in site-packages.
Since the browser image pip-installs camoufox as root, that dir is root-owned, so
running fetch as the app user can't write the mmdb → build fails.

Fix: run fetch as root (writes both the mmdb and — via ENV HOME — Firefox into
/home/app/.cache), then chown the Firefox cache to app. The mmdb stays root-owned
in site-packages but world-readable, which is all the runtime app user needs.

Verified by a real local image build (camoufox fetch now completes, image exports).
The deploy was gated off by the failed build-browser job (not partially applied),
so prod was never broken.

Refs #905, #883, #899