"EACCES: permission denied, mkdir '/builds/renovate/renovate-runner/renovate/cache/__renovate-private-cache'" error after update from 38 to 39 version

[MuellerKlaus]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

• Gitlab 17.5.1
• "renovateVersion": "39.0.0"

Please tell us more about your question or problem

Renovate proposed the update:

- image: renovate/renovate:38
+ image: renovate/renovate:39

after a run.

After apply the proposed PR and rerun renovate schedule i get errors like:

"Error: EACCES: permission denied, mkdir '/builds/renovate/renovate-runner/renovate/cache/__renovate-private-cache'"

for each repository to check.

Revert the version back from 39 to 38 allows to check repositories again. Old working version is

• "renovateVersion": "38.142.7"

Logs (if relevant)

Logs

 INFO: Repository started (repository=kmgroup/bulbcontrol)
       "renovateVersion": "39.0.0"
DEBUG: Using localDir: /builds/renovate/renovate-runner/renovate/repos/gitlab/kmgroup/bulbcontrol (repository=kmgroup/bulbcontrol)
DEBUG: PackageFiles.clear() - Package files deleted (repository=kmgroup/bulbcontrol)
DEBUG: hostRules: applying Bearer authentication for mini.local:6080 (repository=kmgroup/bulbcontrol)
DEBUG: Using queue: host=mini.local:6080, concurrency=16 (repository=kmgroup/bulbcontrol)
DEBUG: kmgroup/bulbcontrol default branch = main (repository=kmgroup/bulbcontrol)
DEBUG: Enabling Git FS (repository=kmgroup/bulbcontrol)
DEBUG: Using http URL: http://mini.local:6080/kmgroup/bulbcontrol.git (repository=kmgroup/bulbcontrol)
ERROR: Repository has unknown error (repository=kmgroup/bulbcontrol)
       "err": {
         "errno": -13,
         "code": "EACCES",
         "syscall": "mkdir",
         "path": "/builds/renovate/renovate-runner/renovate/cache/__renovate-private-cache",
         "message": "EACCES: permission denied, mkdir '/builds/renovate/renovate-runner/renovate/cache/__renovate-private-cache'",
         "stack": "Error: EACCES: permission denied, mkdir '/builds/renovate/renovate-runner/renovate/cache/__renovate-private-cache'"
       }
DEBUG: Unknown res: unknown-error (repository=kmgroup/bulbcontrol)
DEBUG: Repository result: unknown-error, status: unknown, enabled: undefined, onboarded: undefined (repository=kmgroup/bulbcontrol)

[rarkins]

Specify exactly how you are running renovate

[MuellerKlaus]

The process is running with a docker based gitlab runner with the following ".gitlab-ci.yml" with a pipeline schedule:

mage: renovate/renovate:38

variables:
  RENOVATE_BASE_DIR: $CI_PROJECT_DIR/renovate
  RENOVATE_GIT_AUTHOR: Renovate Bot <renovatebot@mini.local>
  RENOVATE_OPTIMIZE_FOR_DISABLED: 'true'
  RENOVATE_REPOSITORY_CACHE: 'true'
  LOG_LEVEL: debug


cache:
  key: ${CI_COMMIT_REF_SLUG}-renovate
  paths:
    - $CI_PROJECT_DIR/renovate

renovate:
  stage: deploy
  resource_group: production
  only:
    - schedules
  script:
    - renovate $RENOVATE_EXTRA_FLAGS

I think I do not use a local mount. As result all paths should be used within the container and user IDs should not be important.

[rarkins]

Renovate's default user ID in official images changed from 1001 to 12021, I will add this to release notes

[MuellerKlaus]

Is the user ID important if no external mount is used with the image? There exists no local user with uid 1001 on the system nor 12021.

[MuellerKlaus]

I tried again with version 39.0.0 after I removed the cached content from last run. And now it was successful.

Seems to be a permission issue after restore the cache.

[MuellerKlaus]

I would change the cache entry naming in '.gitlab-ci.yml':

    key:
      files:
        - .gitlab-ci.yml
      prefix: ${CI_PROJECT_NAME}-${CI_COMMIT_REF_SLUG}

A new cache entry is created after update of the image version to prevent issues with permissions if the uid changes.