Permission issues when running as root user

[Impact123]

NPM seems to have changed the way it runs scripts, see npm/cli#4811, which causes node-red to not be executed with the user that you expect.

What are the steps to reproduce?

root@debian:~# rm -rf nrdata/; docker run -it --rm -u root -p 1880:1880 -v $(pwd)/nrdata:/data --name nodered nodered/node-red:3.0.0

What happens?

> [email protected] start
> node $NODE_OPTIONS node_modules/node-red/red.js $FLOWS "--userDir" "/data"

node:internal/fs/utils:345
    throw err;
    ^

Error: EACCES: permission denied, copyfile '/usr/src/node-red/node_modules/node-red/settings.js' -> '/data/settings.js'
    at Object.copyFileSync (node:fs:2817:3)
    at copyFile (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:73:6)
    at onFile (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:59:25)
    at getStats (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:51:44)
    at handleFilterAndCopy (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:36:10)
    at Object.copySync (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:29:10)
    at Object.<anonymous> (/usr/src/node-red/node_modules/node-red/red.js:129:20)
    at Module._compile (node:internal/modules/cjs/loader:1105:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
    at Module.load (node:internal/modules/cjs/loader:981:32) {
  errno: -13,
  syscall: 'copyfile',
  code: 'EACCES',
  path: '/usr/src/node-red/node_modules/node-red/settings.js',
  dest: '/data/settings.js'
}

You can verify this is due to npm by running the script directly through node

root@debian:~# rm -rf nrdata/; docker run -it --rm -u root --entrypoint /bin/bash -p 1880:1880 -v $(pwd)/nrdata:/data --name nodered nodered/node-red:3.0.0
bash-5.1# node node_modules/node-red/red.js

which works as expected.

What do you expect to happen?

I expect this to work as before with 2.x.

root@debian:~# rm -rf nrdata/; docker run -it --rm -u root -p 1880:1880 -v $(pwd)/nrdata:/data --name nodered nodered/node-red:2.2.2

> [email protected] start /usr/src/node-red
> node $NODE_OPTIONS node_modules/node-red/red.js $FLOWS "--userDir" "/data"

18 Jul 22:09:40 - [info]

Welcome to Node-RED
===================
...

Please tell us about your environment:

Platform/OS: Debian 11 64bit

[hardillb]

I'll have a look tomorrow, but do you have a good reason to be running as root?

[Impact123]

No but, although not your fault, this is still a breaking change

[hardillb]

OK, yeah, and it doesn't look like npm have decided how they are going to "fix" it yet either, which is not helpful

npm/rfcs#546

[hardillb]

Please test 3.0.1 (when it ships)

[Impact123]

Gladly. Hopefully I won't forget. Thanks for giving this attention!

[Impact123]

I've build the docker image(s) myself and tested them with the same command as above. The only difference being the image being used. In this case testing:node-red-build. They seem to work fine. No errors and the created files have the expected uid. I'd suggest leaving this open until official release for visibility but as far as I'm concerned the issue is resolved. Thanks again.

[H-K-47]

This issue still persists

root@raspberrypi:/opt# docker run --restart=always --net=host -it -v /opt/node_red_data:/data --name nodered nodered/node-red:3.0.2
node:internal/fs/utils:345
throw err;
^

Error: EACCES: permission denied, copyfile '/usr/src/node-red/node_modules/node-red/settings.js' -> '/data/settings.js'
at Object.copyFileSync (node:fs:2817:3)
at copyFile (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:73:6)
at onFile (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:59:25)
at getStats (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:51:44)
at handleFilterAndCopy (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:36:10)
at Object.copySync (/usr/src/node-red/node_modules/fs-extra/lib/copy/copy-sync.js:29:10)
at Object. (/usr/src/node-red/node_modules/node-red/red.js:129:20)
at Module._compile (node:internal/modules/cjs/loader:1105:14)
at Object.Module._extensions..js (node:internal/modules/cjs/loader:1159:10)
at Module.load (node:internal/modules/cjs/loader:981:32) {
errno: -13,
syscall: 'copyfile',
code: 'EACCES',
path: '/usr/src/node-red/node_modules/node-red/settings.js',
dest: '/data/settings.js'

I fixed it by adding --user=root:root to the docker call

[hardillb]

@H-K-47 That doesn't run Node-RED as root in the container, it's just running the docker command as root. That is not the same things.

Node-RED will still be running as the node-red user.

Look at the opening comment for details of how to run as root in the container.

[H-K-47]

@hardillb Yeah i added --user=root:root and it worked

[cuserroro]

chown -R 1000:1000 /volume1/docker/node_red_data worked for me

[oooseun]

chown -R 1000:1000 /path/to/docker/node_red_data worked for me too!

Thanks!

[Bitmage77]

Hello, can someone please explain it to me? I am very new to this and I am not able to see the palette manager inside node red. So I order to make the menu point visible Ineed to edit the settings.js file of node red and change the 2 values. Everytime I want to access the file my terminal says "permission denied".

Could some explain step by step to me what needs to be done? I dont really get what needs to be done exactly here in these posts. I am stuck - so would be cool if someone could help me out :)

[hardillb]

@Bitmage77 Please do not use closed issues to ask questions. If you have questions ask them on the forum or Node-RED Slack, if need be you can reference this issue.

[Bitmage77]

okay