Issue with the qodana python linter in root-less execution

[Cazayus]

Hi Team,

This discussion should maybe be an issue instead, but I saw that very few were ever created, so unsure if it is the right procedure or not.

Since at least the 1st of August, it seems impossible to launch qodana-python in root-less mode.
I kept the same launcher (with --user 1000:1000) and it suddenly stopped working because of an update in the docker image.

The exact error is : open /root/.config/idea/options/security.xml: permission denied

Does anyone else ran into this problem ?

Thank you in advance.

[brichbash]

Hello,

Could you please share your Qodana configuration? Do you mount anything to the Qodana container?

[Cazayus]

I actually do a little custom thing, as described in this discussion

It is probably the root cause of the issue because I can't manage to reproduce the steps in the discussion to use conda to setup another version of the python SDK.
I tried connecting directly to the container like this : docker run --user 1000:1000 -i -t --entrypoint=/bin/bash jetbrains/qodana-python-community and I can't do any of the command described anymore.

I need a specific version of the python SDK for some dependencies of the project (it does not work with the provided python 3.10.8).

I saw in the documentation that support for selecting a JDK version or a PHP version has been added, so I guess I would very much like the same for the python linters :-)

[tiulpin]

@Cazayus which Python version do you need?

[Cazayus]

I would like to use Python 3.8.5 (any 3.8 is probably ok).
I also need to be able to install python modules to it.

[niconoe-]

Hi. I am facing the exact same issue, with Qodana for PHP.

Here is the command I run:

docker run --rm \
  --user 1853899550:100  \ 
  --tty  --env HTTP_PROXY= --env HTTPS_PROXY= \ 
  --memory 4g --memory-swap 5g \ 
  --volume <my-project-sources>:/data/project \
  --volume <my-report-folder>:/data/results \
  --volume <my-project-sources>/profile.xml:/data/profile.xml \
  --env _JAVA_OPTIONS=-Xmx4096m \
  --volume <generic-plugin-options-folder>/plugins/PHPAnnotations:/opt/idea/plugins/PHPAnnotations \
  --volume <generic-plugin-options-folder>/plugins/PhpInspectionsEA.jar:/opt/idea/plugins/PhpInspectionsEA.jar  \
  --volume <generic-plugin-options-folder>/options/ea_extended.xml:/root/.config/idea/options/ea_extended.xml  \
  jetbrains/qodana-php:2023.2-eap --source-directory <src-directory> \
    --save-report \
    --run-promo false \
    --property=idea.headless.enable.statistics=false 

Output message is instantly:

open /root/.config/idea/options/security.xml: permission denied

It started like 2 or 3 days ago.
As this file is not changed via a mounted volume, I assume the docker image built is having a bug about that permission.

[niconoe-]

I just tested by replacing --user argument with --user 0:0 to run it as root, and it does work, but this causes the .idea folder of the analyzed project to lose permission, so you won't be able to save anything related to the IDE for this project anymore.

This is a really bad idea.

[Cazayus]

I actually recently found the reason why such an error occurs.
In the qodana image, the folder /root/.config/idea is empty, which means that if you mount a folder in it, it will be created with root permissions and so a standard user won't be able to access it.

The solution is to only mount things to the paths listed here and no deeper.

In my case, I had to change my mount to something like this :
-v /home/user/qodana/python/qodana_cache/confidea:/root/.config/idea/
where my confidea folder contains "/options/jdk.table.xml"

instead of :
-v /home/user/qodana/python/qodana_cache/confidea/options/jdk.table.xml:/root/.config/idea/options/jdk.table.xml

to achieve the same result