From 4e8e4a7162ee3e2bd001bfba02ae5b64f9762d87 Mon Sep 17 00:00:00 2001 From: Yassin Kortam Date: Wed, 5 Aug 2026 12:51:53 -0700 Subject: [PATCH] fix(docker): bake the pip image's prisma engines at a world-readable path (#35976) The build_from_pip image ran a bare `prisma generate`, so prisma recorded absolute engine paths under $HOME/.cache, which is /root/.cache in that build. /root is mode 0700 on python:3.13-slim, so any runtime uid other than 0 gets EACCES just traversing it and the proxy dies during prisma client initialisation. That is exactly the shape a securityContext with runAsUser produces. Generate under a fixed /opt/prisma and chmod it a+rX, matching what the shipped images already do, and pin PRISMA_BINARY_CACHE_DIR at runtime so the client resolves the baked engines instead of looking under $HOME. A build-time assertion fails the build if any recorded engine path lands outside the pinned prefix, since the original breakage was silent at build time and only surfaced as a runtime crash for non-root users. --- docker/build_from_pip/Dockerfile.build_from_pip | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docker/build_from_pip/Dockerfile.build_from_pip b/docker/build_from_pip/Dockerfile.build_from_pip index 372606a5b0f..e27e8f26cc2 100644 --- a/docker/build_from_pip/Dockerfile.build_from_pip +++ b/docker/build_from_pip/Dockerfile.build_from_pip @@ -47,7 +47,13 @@ RUN uv venv --python python && \ "prisma==0.11.0" \ "openai==2.24.0" -RUN prisma generate --schema=./schema.prisma +RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \ + npm_config_cache=/root/.npm \ + prisma generate --schema=./schema.prisma && \ + chmod -R a+rX /opt/prisma && \ + python -c "import sys; from prisma.client import BINARY_PATHS; bad = sorted(p for group in BINARY_PATHS.model_dump().values() for p in group.values() if not p.startswith('/opt/prisma/')); sys.exit('prisma engines baked outside /opt/prisma: %r' % bad) if bad else None" + +ENV PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries EXPOSE 4000/tcp