Repository: runatlantis/atlantis (language: go)

Issue:
If `--data-dir` is not  `/home/atlantis` results in permission denied
<!--- Please keep this note for the community --->

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
* Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
* If you are interested in working on this issue or have submitted a pull request, please leave a comment.

<!--- Thank you for keeping this note for the community --->

---

<!--- When filing a bug, please include the following headings if possible. Any example text in this template can be deleted. --->

### Overview of the Issue

When I pass the `--data-dir` flag using the default docker image I seem to run into a permission denied error and atlantis doesn't bootstrap. 

<!--- Please describe the issue you are having and how you encountered the problem. --->

### Reproduction Steps

Run:

`docker run -e ATLANTIS_GH_USER='xxxxxxxxxxxxx' -e ATLANTIS_GH_TOKEN='xxxxxxxxxxxxx' -e ATLANTIS_GH_WEBHOOK_SECRET='xxxxxxxxxxxxx' -e ATLANTIS_REPO_ALLOWLIST='github.com/example/*' -e ATLANTIS_ATLANTIS_URL='https://example.com/' -e ATLANTIS_DATA_DIR='/home/test' -it ghcr.io/runatlantis/atlantis:latest`

<!--- 

In order to effectively and quickly resolve the issue, please provide exact steps that allow us the reproduce the problem. If no steps are provided, then it will likely take longer to get the issue resolved.
  
--->

### Logs

<!---

Provide log files from Atlantis server

<details>
  <summary>Logs</summary>

```
log output
```

</details>

--->

`Error: initializing server: unable to create dir "/home/test": mkdir /home/test: permission denied
`
### Environment details

<!---

If not already included, please provide the following:
- Atlantis version:
- If not running the latest Atlantis version have you tried to reproduce this issue on the latest version: 
- Atlantis flags:

Atlantis server-side config file:
```
# config file
```

Repo `atlantis.yaml` file:
```
# config file
```

Any other information you can provide about the environment/deployment.
--->

Docker image: ghcr.io/runatlantis/atlantis:latest

### Additional Context

<!---
Additional context on the problem. Docs, links to blogs, or other material that lead you to discover this issue or were helpful in troubleshooting the issue. 
--->

I believe that this issue is due to the fact that the atlantis user (which is used to run the process) is restricted to only `/home/atlantis` according to [these lines](https://github.com/runatlantis/atlantis/blob/main/docker-base/Dockerfile.alpine#L7-L18) in the base image.

Reason why and where I encounter this error: I'm trying to mount a persistent data disk to an instance where I run Atlantis, and I want to point Atlantis to that mount path using the `--data-dir` flag.


Discussion / hints:
the data dir needs to be own by user Atlantis, or whatever user Atlantis is
running.




On Sun, Jan 1, 2023, 10:32 a.m. Bruno Schaatsbergen <
***@***.***> wrote:

> Community Note
>
>    - Please vote on this issue by adding a 👍 reaction
>    <https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/>
>    to the original issue to help the community and maintainers prioritize this
>    request. Searching for pre-existing feature requests helps us consolidate
>    datapoints for identical requirements into a single place, thank you!
>    - Please do not leave "+1" or other comments that do not add relevant
>    new information or questions, they generate extra noise for issue followers
>    and do not help prioritize the request.
>    - If you are interested in working on this issue or have submitted a
>    pull request, please leave a comment.
>
> ------------------------------
> Overview of the Issue
>
> When I pass the --data-dir flag using the default docker image I seem to
> run into a permission denied error and atlantis doesn't bootstrap.
> Reproduction Steps
>
> Run:
>
> docker run -e ATLANTIS_GH_USER='xxxxxxxxxxxxx' -e
> ATLANTIS_GH_TOKEN='xxxxxxxxxxxxx' -e
> ATLANTIS_GH_WEBHOOK_SECRET='xxxxxxxxxxxxx' -e ATLANTIS_REPO_ALLOWLIST='
> github.com/example/*' -e ATLANTIS_ATLANTIS_URL='https://example.com/' -e
> ATLANTIS_DATA_DIR='/home/test' -it ghcr.io/runatlantis/atlantis:latest
> Logs
>
> Error: initializing server: unable to create dir "/home/test": mkdir
> /home/test: permission denied
> Environment details
>
> Docker image: ghcr.io/runatlantis/atlantis:latest
> Additional Context
>
> I believe that this issue is due to the fact that the atlantis user (which
> is used to run the process) is restricted to only /home/atlantis
> according to these lines
> <https://github.com/runatlantis/atlantis/blob/main/docker-base/Dockerfile.alpine#L7-L18>
> in the base image.
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/runatlantis/atlantis/issues/2903>, or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAQ3ERFLGXTGRTXWJOXFW3TWQHEVTANCNFSM6AAAAAATOIAOY4>
> .
> You are receiving this because you are subscribed to this thread.Message
> ID: ***@***.***>
>

@jamengual, which unfortunately means that I would have to handroll my own docker image. It conflicts a bit with using the available docker image and trying to change the path to a mounted persistent data disk. (as suggested here: https://www.runatlantis.io/docs/deployment.html#data)

I happily handroll and maintain my own image, I encountered this issue where I'm building a Terraform module for Atlantis that [features persistent storage by mounting a GCP persistent disk to the instance that Atlantis runs on](https://github.com/bschaatsbergen/terraform-gcp-atlantis/pull/15/files). 
no, you just need to set the same uid and guid as the Atlantis user and it should work.


I managed to fix it by creating a service that runs a `chown` on the atlantis uuid.
See: https://github.com/bschaatsbergen/terraform-gce-atlantis/pull/15/files for a reference implementation.
I do think that we should be more explicit on how restricted the atlantis user is on that `--data-dir` flag. I'll create PR.
Thanks for the suggestion @jamengual, I was aware of this being the fix, but I was hoping to not go through this hassle to make it work in a clean/minimal way.

Fix patch:
diff --git a/runatlantis.io/docs/server-configuration.md b/runatlantis.io/docs/server-configuration.md
index 5d0d2fb201..3b97968a51 100644
--- a/runatlantis.io/docs/server-configuration.md
+++ b/runatlantis.io/docs/server-configuration.md
@@ -321,6 +321,9 @@ and set `--autoplan-modules` to `false`.
   Terraform binaries here. If Atlantis loses this directory, [locks](locking.html)
   will be lost and unapplied plans will be lost.
 
+  Note that the atlantis user is restricted to `~/.atlantis`. 
+  If you set the `--data-dir` flag to a path outside of Atlantis its home directory, ensure that you grant the atlantis user the correct permissions.
+
 ### `--default-tf-version`
   ```bash
   atlantis server --default-tf-version="v0.12.31"


Test patch: