Skip to content

default site config escape hatch path is only writeable by root

Created by: ggilmore

https://github.com/sourcegraph/sourcegraph/blob/837b3b25d94e180864c7d1b7276a235a1ed9933a/internal/conf/conf.go#L176

SITE_CONFIG_ESCAPE_HATCH_PATH defaults to /site.config.json. However, only root can write to this file since it lives directly underneath /. This happens to work in both our k8s deployment and sourcegraph/server (we don't use the sourcegraph/alpine image which sets the sourcegraph user) since they both run as root. However, anyone who is using deploy-sourcegraph-docker or has otherwise modified the running user will run into this error message when running the frontend image:

t=2020-01-17T17:11:50+0000 lvl=eror msg="config: failed to write site config file, trying again in 1s" error="open /site-config.json: permission denied"

This issue also prevents the frontend binary from starting.

We need to change the default path to a location that's writeable for both root and the sourcegraph user?

  • /mnt/cache?
  • /tmp/?
  • /etc/config?