mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
7bd3a5e6ab
The gateway and backend images generated the prisma client under HOME=/home/nonroot, so the engine paths baked into the client sat inside a directory the base image ships at mode 0700. Only uid 65532 can search it, and prisma resolves those baked paths eagerly with an existence check that propagates EACCES, so a container started under any other uid dies with a PermissionError out of pathlib before the PRISMA_QUERY_ENGINE_BINARY override is ever read. A chart that sets runAsUser, a docker run --user, or an OpenShift namespace assigning an arbitrary uid all produce that shape, and the gateway is the request-serving component, so the proxy does not serve at all. Bake to /opt/prisma instead, the fixed world-readable path the other three images already use, and assert at build time that every baked path lands there. chmod a+rX rather than a+r because prisma executes the engine to check it can run on this machine. The runtime PRISMA_BINARY_CACHE_DIR pin keeps the CLI wrapper's own resolution pointing at the bake rather than at a /home/nonroot/.cache that no longer exists. |
||
|---|---|---|
| .. | ||
| routes | ||
| Dockerfile | ||
| main.py | ||