AM 7.3.0 Docker is failing with premission denied for RUN mkdir -p /home/forgerock/logging/

[sandeepk24]

@lee-baines

Could you please help.

Currently using 7.3.0 and noticed on my build step for AM I was receiving permissions denied when this line in Dockerfile

RUN mkdir -p /home/forgerock/logging/

The fix was stating -> USER root in dockerfile before this line.
At the end of my Dockerfile I'm switching back to USER 11111

After I build my new image successfully upon deploying to AM the fbc-init container received this error.

/bin/bash: line 14: cd: /home/forgerock/openam: Permission denied
cp: cannot stat '.homeVersion': Permission denied
cp: cannot stat '*': Permission denied

Nothing on the deployment.yaml file was modified in terms of the securityContext to run as user 11111.

So far I've never received this issue till now. Using Docker Version 28.1.1 and this is in AWS EKS.

[lee-baines]

Hi @sandeepk24, I have not seen this error before and after testing this myself on docker version 28.3.3, I can't reproduce it. This Dockerfile hasn't really changed for years so I'm wondering if there is a environmental issue impacting this. Can you try the build on a different machine or get someone else to test to see if they can reproduce it? Then we can take it from there.

[sandeepk24]

Thank you @lee-baines for getting back on this. We recently pruned some images as they were taking up the space. So we moved the build server that we use to build and deploy IG and AM applications back to a date in July and it started working back again. But before that we were seeing issues building and deploying applications in lower environments in Dev and Sit and are really worrking if they will break higher environments too. We were seeing permission issues failing at making the directory

RUN mkdir -p /home/forgerock/logging/ in the docker file. Initially thought it was a Docker upgraded to 28.1.1 version. I think the caching makes a difference here. Can we avoid using caching everytime we do a build and deploy.

Also some background on our setup, we have deployed IG and AM applications on AWS EKS servers across 6 clusters including Prod and DRR for over a year now.

[lee-baines]

Hi @sandeepk24,
I'm still not sure why you are seeing this error. Not even sure why an upgrade in Docker versions would cause this.
The best practice to avoid caching is to build your images with custom tags. Don't use floating tags.

[sandeepk24]

Thank you @lee-baines is there a document that mentions about custom tags or you can point me to link?

[lee-baines]

Building custom images in 7.3 is documented here: https://docs.pingidentity.com/forgeops/7.3/cdk/develop/am.html

This includes steps to export configuration but you can skip that part of you are not customizing AM config.