From 8f9e9398f889beb396b54eb79bc5288ae6664159 Mon Sep 17 00:00:00 2001 From: Sebastian Date: Mon, 27 Jul 2026 07:55:53 +0200 Subject: [PATCH] fix(docker): make open_webui/static writable by an arbitrary UID (OpenShift) (#26664) The backend rewrites its bundled static assets under open_webui/static on startup. Under OpenShift's restricted SCC the container runs as a random UID (member of GID 0), which cannot write to the root-owned static dir, so boot logs fill with '[Errno 13] Permission denied: .../static/*'. Give GID 0 the owner's permissions on that directory (chgrp 0 + chmod g=u), the standard Red Hat arbitrary-UID idiom. Applied unconditionally since the app writes there on every start; complements the opt-in USE_PERMISSION_HARDENING. --- Dockerfile | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Dockerfile b/Dockerfile index 6074477637..07b0e0667d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -184,6 +184,17 @@ COPY --chown=$UID:$GID --from=build /app/package.json /app/package.json # copy backend files COPY --chown=$UID:$GID ./backend . +# The backend rewrites its bundled static assets (favicons, splash, manifest, +# loader.js, ...) under open_webui/static at startup. Make that directory +# writable by an arbitrary UID -- which under OpenShift's restricted SCC is +# always a member of GID 0 -- so those writes don't fail with EACCES and crash +# the boot log with "[Errno 13] Permission denied". `chmod -R g=u` mirrors the +# owner bits onto the group (the Red Hat arbitrary-UID idiom). This is applied +# unconditionally because it targets a directory the app writes on every start; +# the broader, opt-in USE_PERMISSION_HARDENING below covers the rest of /app. +RUN chgrp -R 0 /app/backend/open_webui/static && \ + chmod -R g=u /app/backend/open_webui/static + EXPOSE 8080 HEALTHCHECK CMD curl --silent --fail http://localhost:${PORT:-8080}/health | jq -ne 'input.status == true' || exit 1