Symlink permission error when trying to use binarySource=install

[florianklumb]

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us what version of Renovate you run.

32.32.5 (renovate/renovate Docker image)

Please select which platform you are using if self-hosting.

GitLab self-hosted / Jenkins with Docker

If you're self-hosting Renovate, tell us what version of the platform you run.

14.8.5

Was this something which used to work for you, and then stopped?

I never saw this working

Describe the bug

I have the same problem as described in renovatebot/renovate#14409 (reply in thread)
When using binarySource=install with npm/node versions specified as engines in package.json and BUILDPACK=true set (cf. renovatebot/renovate#14409 (reply in thread)) I get the following error

DEBUG: Using node constraint "16.14.0" from package.json (repository=MY_REPO, branch=renovate/react-select-5.x)
DEBUG: Using buildpack dynamic installs (repository=MY_REPO, branch=renovate/react-select-5.x)
DEBUG: Executing command (repository=MY_REPO, branch=renovate/react-select-5.x)
       "command": "install-tool npm 8.3.1"
DEBUG: rawExec err (repository=MY_REPO, branch=renovate/react-select-5.x)
       "err": {
         "killed": false,
         "code": 1,
         "signal": null,
         "cmd": "install-tool npm 8.3.1",
         "stdout": "Installing legacy tool npm v8.3.1\n/home/ubuntu/npm/8.3.1/bin/npm -> /home/ubuntu/npm/8.3.1/lib/node_modules/npm/bin/npm-cli.js\n/home/ubuntu/npm/8.3.1/bin/npx -> /home/ubuntu/npm/8.3.1/lib/node_modules/npm/bin/npx-cli.js\n+ [email protected]\nadded 214 packages from 96 contributors in 5.004s\n",
         "stderr": "ln: failed to create symbolic link '/usr/local/bin/npm': Permission denied\n",
         "message": "Command failed: install-tool npm 8.3.1\nln: failed to create symbolic link '/usr/local/bin/npm': Permission denied\n",
         "stack": "Error: Command failed: install-tool npm 8.3.1\nln: failed to create symbolic link '/usr/local/bin/npm': Permission denied\n\n    at ChildProcess.exithandler (child_process.js:383:12)\n    at ChildProcess.emit (events.js:400:28)\n    at ChildProcess.emit (domain.js:475:12)\n    at maybeClose (internal/child_process.js:1058:16)\n    at Process.ChildProcess._handle.onexit (internal/child_process.js:293:5)"
       }

I assumed this was mitigated/solved by #346 but it doesn't seem so. Any ideas?

[Chumper]

How do you start the docker container?

[florianklumb]

Here is an excerpt from the Jenkinsfile:

pipeline {
    agent {
        docker {
            label buildAgents.DOCKER_AVAILABLE
            image 'renovate/renovate:32.32.5'
            args '-v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp'
        }
    }

    environment {
        CONFIGURATION = 'Release'
        TZ = 'Europe/Berlin'
        ENV = '/usr/local/etc/env'
        RENOVATE_TOKEN = credentials('...')
        RENOVATE_DOCKER_USER = 'root'
        GITHUB_COM_TOKEN = credentials('...')
        RENOVATE_BINARY_SOURCE = 'install'
        BUILDPACK = true
    }

    parameters {
        string defaultValue: '', description: '', name: 'RENOVATE_ARGS', trim: true
    }

    stages {
        stage('init') {
            steps {
                sh 'renovate --version'
                sh 'rm -f renovate.log'
            }
        }

        stage('renovate') {
            steps {
                sh 'renovate --log-file renovate.log --log-file-level debug ${params.RENOVATE_ARGS}'
            }
        }
    }
}

[viceice]

ha, my jenkins agent is running as root, so container is also running as root.

So

1. remove RENOVATE_DOCKER_USER
2. add --group-add 0 to container args.

That should solve the issue.

You can also add your ubuntu user on your host to root group (instead of passing --group-add 0).

[florianklumb]

That did it. Thank you @viceice and @Chumper!

[viceice]

Can you please suggest a new jenkins.md file to https://github.com/renovatebot/docker-renovate/tree/main/docs ? So we can document it for others

[florianklumb]

Sure will do!

[florianklumb]

renovatebot/docker-renovate#307