Error while creating new bookmark

[bes1967]

I've been using Shaarli for about a year. All this time, Shaarli works in a docker container (on VirtualBox Debian Jessie guest). I also have virtual machine with HAProxy installed, which is used as reverse proxy (with ssl termination). First it was Shaarli v. 0.7.0 (I has installed it in September 2016), then I upgraded docker container several times. Everything worked just great (even earlier versions of 0.9 branch). Till the end of October - when I updated to version 0.9.2. Everything continued to work normally: the list of bookmarks was displayed, I could to log in and log out. But when I began to add a new bookmark (using bookmarklet), the window appeared on the screen, and when I clicked the Save button, it displayed error 500. Then I downgraded docker container (by using stable tag instead latest) and bookmark creation began to work again. Since then, I tried several times to upgrade to the latest tag, but each time after that the addition stopped working. I have to mention, that during this process (I mean upgrade/downgrade) I didn't change anything else, including haproxy configuration. I know, that in version 0.9.2 docker container changed dramatically, perhaps you changed something in the Nginx configuration, and I have to make a response change to haproxy?

[virtualtam]

Hi @bes1967,

The major changes were:

• switching from Debian Jessie to Alpine Linux 3.6 as the base image
• switching from PHP 5.6 to PHP 7.1
• tuning PHP configuration
• introducing new images, so Docker image tags are coherent with Git branches

More information can be found on #843, #846 and #1001

The Nginx configuration is pretty much the same: https://github.com/shaarli/Shaarli/pull/846/files#diff-9445a360dca454b9e45ee3b222d8a65f

---

Could you check the Nginx logs to see what happens when you try to add a new bookmark?

$ docker exec -ti <shaarli_container> tail -f /var/log/nginx/shaarli.access.log /var/log/nginx/shaarli.error.log

[bes1967]

Hi, first of all, thank you for your prompt response. And here is Nginx log:

2017/12/02 17:33:19 [error] 12#12: *5 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Uncaught IOException: Error accessing "data/datastore.php" in /var/www/shaarli/application/FileUtils.php:39
Stack trace:
#0 /var/www/shaarli/application/LinkDB.php(349): FileUtils::writeFlatDB('data/datastore....', Array)
#1 /var/www/shaarli/application/LinkDB.php(364): LinkDB->write()
#2 /var/www/shaarli/index.php(1303): LinkDB->save('pagecache')
#3 /var/www/shaarli/index.php(2306): renderPage(Object(Shaarli\Config\ConfigManager), Object(PluginManager), Object(LinkDB), Object(History))
#4 {main}

I have to say, that I starting container by docker-compose, and data folder is mounted to host folder. Here is snippet from yml file:

  volumes:
    - /home/shaarli/data:/var/www/shaarli/data

Host's folder owner is www-data (the same is for datastore.php file), permissions are 644. I changed permissions to let everybody to write to file, and had tried to create bookmark again. The add window showed the 500 error, but the bookmark was created. The error displayed was now associated with the history.php file:

2017/12/02 17:52:46 [error] 10#10: *5 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Uncaught Exception: History file isn't readable or writable in /var/www/shaarli/application/History.php:158
Stack trace:
#0 /var/www/shaarli/application/History.php(82): History->check()
#1 /var/www/shaarli/application/History.php(133): History->initialize()
#2 /var/www/shaarli/application/History.php(93): History->addEvent('CREATED', 289)
#3 /var/www/shaarli/index.php(1305): History->addLink(Array)
#4 /var/www/shaarli/index.php(2306): renderPage(Object(Shaarli\Config\ConfigManager), Object(PluginManager), Object(LinkDB), Object(History))
#5 {main}

So, that's all for the moment...

[virtualtam]

This is a caveat of bind-mounting directories on the host to a guest container volume: user and group IDs might not match, resulting in permission and access errors within containers...

This is likely to happen for all resources under Shaarli's data folder that need read and write permission:

• datastore
• configuration
• log files

I'd suggest one of the following:

1. update access permissions from a running container:
   $ docker exec -ti <shaarli container> chown -R nginx:nginx /var/www/shaarli/data

2. switch to using a dedicated volume in the Compose setup to handle data persistence:

services:
  shaarli:
    # [...]
    volumes:
      - shaarli-data:/var/www/shaarli/data
  # [...]

volumes:
  shaarli-data:

Relevant resources:

• https://shaarli.readthedocs.io/en/master/Shaarli-configuration/#file-and-directory-permissions
• https://docs.docker.com/engine/admin/volumes/volumes/
• https://docs.docker.com/compose/compose-file/#volume-configuration-reference

This will most likely be addressed when documenting an example Compose setup in #1010

[bes1967]

This is a caveat of bind-mounting directories on the host to a guest container volume: user and group IDs might not match, resulting in permission and access errors within containers...

I assumed something like this. Some containers use special environment variables to solve such problems (for example, technosoft2000/calibre-web). I don't know exactly how they achive the result, but it would be great if something like this could be used for your container too.

As I said, I allowed all users to write to the file, but your workaround (changing the owner from within the container) seems more safely, and I'll definitely try it.

Thank you very much )

[virtualtam]

Corresponding discussion on the Moby (formerly Docker) tracker:

• Add ability to mount volume as user other than root moby/moby#2259 - Add ability to mount volume as user other than root

The thread mentions several workarounds and delves a bit into Docker internals as far as volumes and permissions are handled when bind-mounting files and directories.

[bes1967]

Hi, I tried the method suggested by you (change the owner from within the container) and it worked (as expected). And the discussion under the link given by you, is quite interesting, thank you. So, for the moment, everythig works ok.

[virtualtam]

Good to know, I'm closing this issue as resolved