Getting permission denied error with lighthouse image

[tforster]

I have tried with both SYS_ADMIN and SECCOMP with several different URLs and the response is always the same error.

Runtime error encountered: EACCES: permission denied, open '/home/chrome/reports/www.redacted.com_2020-07-20_12-36-48.report.html'
Error: EACCES: permission denied, open '/home/chrome/reports/www.redacted.com_2020-07-20_12-36-48.report.html'

If I try touch somefile within the reports directory I get an access denied error.

My current workaround is to create a new directory, /home/chrome/new-reports and run lighthouse from there. Once the reports are generated I copy them to my host using docker container cp.

[justinribeiro]

CAPSYS and/or SECCOMP don't handle file system permissions between the container and the host. Without seeing the command you're running and your Docker setup it's hard to tell, but based on the permission denied, my hunch is that your bindmount perms are incorrect.

See: #45 (comment) which explains a little more about running with a folder bind for output/artifact collection.

[tforster]

Sorry, I should have mentioned that I was copy/pasting the example from the README verbatim, with the exception of the path to my folder.

docker run -itv /home/tforster/lighthouse-test:/home/chrome/reports --cap-add=SYS_ADMIN justinribeiro/lighthouse

The problem appears to be with the reports folder in the container. As noted, I can create a new folder in /home/chrome and that works as expected, apart from using Docker to copy it back to the host.

Docker version 19.03.8, build afacb8b7f0
Ubuntu 20.04

[justinribeiro]

The container simply defines the volume and workdir that is owned by the unprivileged chrome user; there isn't anything particularly special about it:

dockerfiles/lighthouse/Dockerfile

Lines 56 to 61 in 8e60d23

	RUN groupadd -r chrome && useradd -r -g chrome -G audio,video chrome \
	&& mkdir -p /home/chrome/reports && chown -R chrome:chrome /home/chrome
	# some place we can mount and view lighthouse reports
	VOLUME /home/chrome/reports
	WORKDIR /home/chrome/reports

Pulling latest, I can bind and run without any issue (same OS).

As per the other comment I pointed you to, I suspect that this is a case of mismatched permissions within the scope of the namespace, which happens from time to time when the group is auto-added. See https://docs.docker.com/engine/security/userns-remap/

[tinect]

The folder needs to have right access for others chmod o+w