Permission denied to write my own persistent files to `/data`

Configuration
1

I am using puppeteer ( puppeteer/troubleshooting.md at e4c48d3b8c2a812752094ed8163e4f2f32c4b6cb · puppeteer/puppeteer · GitHub ) that recommends not using user root (--no-sandbox). For that reason, I created a new user (pptruser).

Everything seems to be working fine, except the part I need to persist a session file…

[Error: EACCES: permission denied, open '/data/session.json'] {
  errno: -13,
  code: 'EACCES',
  syscall: 'open',
  path: '/data/session.json'
}

I saw this post ( Addon unable to reach /data/options.json. Permission denied. · Issue #2158 · home-assistant/supervisor · GitHub ) that says all JSON files are stored with 0600 and recommends using the API but I think (or at least I don’t know) I can’t use API to persist something in /data folder.
I also saw this post ( Addon unable to reach /data/options.json. Permission denied. · Issue #2158 · home-assistant/supervisor · GitHub ) that says about configuring ownership and permissions but still no success because the file is created in runtime.
I also saw some discussions about /config folder, but I can’t find it anymore. Maybe because I am stuck for the last 3 days.

So my questions are:

  • First thing, is it correct to store persistent data to /data folder ? Based on the docs, I think it is.
  • Is there some way to use API to persist a file in /data folder ? If so, what is the link to the documentation ?
  • Otherwise, how would you recommend to complete this task ? I mean, the task is using another user to store a file that is persistent across executions of the same container.

Thanks in advance

UPDATE
Yesterday, I created a separate routine with rsync to copy the file to /data/session.json. This is my workaround for now.

2

Use “allowlist_external_dirs” https://www.home-assistant.io/docs/configuration/basic/

3

Sorry. I didn’t understand.
How I could use it inside an addon container?
Do you have any example ?

4

It’s never recommended to use root to run anything, even inside a docker container.

Fact of life is that HAOS / Supervised does, so I’d suggest to go with the flow and run your addon under root, like all the other addons running on your system.

If that’s not acceptable, forget about HA addons and run it somewhere else, as a “plain” docker container. Trying to insert a cube in a round hole is a recipe for headaches :wink:

1 Like
5

In configuration.yaml add

  allowlist_external_dirs:
     - /config/data/