rocker-org / rocker

R configurations for Docker
https://rocker-project.org
GNU General Public License v2.0
1.45k stars 273 forks source link

`'lib = "/usr/local/lib/R/site-library"' is not writable` error when install R packages by non-root user #513

Closed eitsupi closed 1 year ago

eitsupi commented 1 year ago

An error occurred when I tried to install R packages via install2.r command as a non-root user (docker) on r-base (r-base@sha256:ad49725f24f2abf3f3cb8010abfd00b74d424bc47c4e3841f10e805143e5a6fa).

I don't think this is the intended behavior as described in the comments below, but is this a bug that occurs only in my environment?

https://github.com/rocker-org/rocker/blob/2f92c6c8b8da7b3e61aabc44cacc0439bf267d31/r-base/latest/Dockerfile#L10-L12

eddelbuettel commented 1 year ago

Is that user part of staff (or sometimes I use adm) ?

Overall it's a bit of a mess, and I guess the comment is stale / got copied from the Debian package setup.

I like having the system directory a lot but sometimes you either need to chown as root first, or use sudo. Such is life. I find I do not use that many containers as a non-root. If you have a suggestion, let me hear it but this is also 'de facto' behavior now.

eitsupi commented 1 year ago

Yes, I am surprised that I and other users have not noticed this behavior before.

$ groups docker
docker : docker staff
$ ls -la /usr/local/lib/R
total 12
drwxr-xr-x 3 root root 4096 Nov  1 20:21 .
drwxr-xr-x 1 root root 4096 Nov  1 20:21 ..
drwxr-xr-x 2 root root 4096 Nov  1 20:21 site-library

Perhaps the staff group is not being used?

In rocker/r-ver, the site-library is owned by the staff group, so users belonging to staff can install R packages via install.packages() function etc. https://github.com/rocker-org/rocker-versioned2/blob/348e1f38af99934f515530714d0d1884e3dafd6c/scripts/install_R_source.sh#L143

I would say this is a bug, but I don't know if it should be changed or not, as changing this behavior would definitely affect existing users...

eddelbuettel commented 1 year ago

Maybe it is a recent-ish change:

edd@rob:~$ docker run --rm -ti -u 1000:1000 r-base id
uid=1000(docker) gid=1000(docker) groups=1000(docker)
edd@rob:~$