vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Why can't non-root users access files? 

Virtual Private Cloud

Classic infrastructure

 What’s happening 

You uploaded files to your IBM Cloud Object Storage service instance by using the console or the REST API. When you try to access these files with a non-root user that you defined with runAsUser in your app deployment, access to the files is denied.

 Why it’s happening 

In Linux, a file or a directory has three access groups: Owner, Group, and Other. When you upload a file to IBM Cloud Object Storage by using the console or the REST API, the permissions for the Owner, Group, and Other are removed. The permission of each file looks as follows:

d--------- 1 root root 0 Jan 1 1970 <file_name>

When you upload a file by using the IBM Cloud Object Storage plug-in, the permissions for the file are preserved and not changed.

 How to fix it 

To access the file with a non-root user, the non-root user must have read and write permissions for the file. Changing the permission on a file as part of your pod deployment requires a write operation. IBM Cloud Object Storage is not designed for write workloads.

Updating permissions during the pod deployment might prevent your pod from getting into a Running state.

To resolve this issue, before you mount the PVC to your app pod, create another pod to set the correct permission for the non-root user.



1. To check the permissions of your files in your bucket, create a configuration file for your test-permission pod and name the file test-permission.yaml.

apiVersion: v1
kind: Pod
metadata:
name: test-permission
spec:
containers:
- name: test-permission
image: nginx
volumeMounts:
- name: cos-vol
mountPath: /test
volumes:
- name: cos-vol
persistentVolumeClaim:
claimName: <pvc_name>
2. Create the test-permission pod.

kubectl apply -f test-permission.yaml
3.
To fork a repo so that you can contribute changes through pull requests, click Fork.
5. To create a private repo on the server, select the Make this repository private checkbox.
6. To use Bitbucket Issues for issue tracking, select the Enable Bitbucket Issues checkbox.
7. To track the deployment of code changes by creating tags and comments on commits, and labels and comments on issues that are referenced by the commits, select the Track deployment of code changes checkbox. For more information, see [Track where your code is deployed with toolchains](https://www.ibm.com/cloud/blog/announcements/track-code-deployed-toolchains/).
8. Click Create Integration.
9. From your toolchain, on the Third-Party tools card, click the Bitbucket tool integration for the Bitbucket repo that you want to work with. The Bitbucket website opens where you can view the contents of the repo.
10. If you enabled Bitbucket Issues, click Bitbucket Issues to open it. You can use this instance of Bitbucket Issues for your entire toolchain, even if the toolchain contains multiple Bitbucket repos.



If you don't have owner or master privileges for the repo that you are linking to, your integration is limited because you can't use a webhook. Webhooks are required to automatically run a pipeline when a commit is pushed to the repo. Without a webhook, you must start your pipelines manually.



 Configuring Bitbucket by using the API
* JCIP-ANNOTATIONS [HttpCore](https://repo1.maven.org/maven2/org/apache/httpcomponents/httpcore/)
* IMMUTABLE.JAVA [JSR305](https://search.maven.org/remotecontent?filepath=com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1-sources.jar)
* NOTTHREADSAFE.JAVA [JSR305](https://search.maven.org/remotecontent?filepath=com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1-sources.jar)







 Creative Commons Attribution 3.0 Generic 

The Program includes some or all of the following works licensed under the Creative Commons. The URL to the license is [https://creativecommons.org/licenses/by/3.0/legalcode](https://creativecommons.org/licenses/by/3.0/legalcode)



* [BOOTSTRAP DOCS](https://github.com/twbs/bootstrap/tree/v3.3.2)
* SITE-POLICIES [golang/net](https://github.com/golang/net/archive/161cd47e91fd.zip), DIR.TMPL - SITE POLICIES [golang/tools](https://github.com/golang/tools/archive/bf090417da8b.zip)
* [Uninstalling the OpenShift Data Foundation add-on from the console](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-manage-deploymentocs-addon-rm-console)
* [Uninstalling the OpenShift Data Foundation add-on from the CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-manage-deploymentocs-addon-rm-cli)



* [Troubleshooting ODF](https://cloud.ibm.com/docs/openshift?topic=openshift-ocs-manage-deploymentodf-troubleshooting-gather)



[Managing the Multi-Cloud Object Gateway](https://cloud.ibm.com/docs/openshift?topic=openshift-odf-manage-noobaaodf-manage-noobaa)



* [Setting up backing stores by using the NooBaa CLI](https://cloud.ibm.com/docs/openshift?topic=openshift-odf-manage-noobaaodf-backingstore)
* [Creating a bucket class that uses two backing stores with a mirror placement policy](https://cloud.ibm.com/docs/openshift?topic=openshift-odf-manage-noobaaodf-bucketclass)
* [Creating a storage class](https://cloud.ibm.com/docs/openshift?topic=openshift-odf-manage-noobaaodf-sc)
* [Creating an Object Bucket Claim](https://cloud.ibm.com/docs/openshift?topic=openshift-odf-manage-noobaaodf-obc)
* [Deploying an s3 app in the Multicloud Object Gateway](https://cloud.ibm.com/docs/openshift?topic=openshift-odf-manage-noobaamcg-deploy-app)
* PHP_MAN.HTML [elazarl/goproxy (go)] (Copyright (c) 2012 Elazar Leibovich)([https://github.com/elazarl/goproxy/tree/49ad98f6dac1e021cff612afa5a9d95843efde52](https://github.com/elazarl/goproxy/tree/49ad98f6dac1e021cff612afa5a9d95843efde52))
* SPDX [npm] (Copyright (c) npm, Inc. and Contributors)([http://registry.npmjs.org/npm/-/npm-6.14.6.tgz](http://registry.npmjs.org/npm/-/npm-6.14.6.tgz))
* SITE-POLICIES [golang/tools (go)] (Copyright (c) 2009 The Go Authors)([https://github.com/golang/tools/archive/4735f53fb37db012e63d1a62914417980fb3c023.zip](https://github.com/golang/tools/archive/4735f53fb37db012e63d1a62914417980fb3c023.zip))







 Creative Commons Attribution Share Alike 2.0 generic 

The Program includes some or all of the following works licensed under the Creative Commons. The URL to the license is [https://creativecommons.org/licenses/by-sa/2.0/legalcode](https://creativecommons.org/licenses/by-sa/2.0/legalcode).
We are aware of the issue and are addressing it promptly.



1. Download the global pull secret to your local file system by running the following command from the directory of your choice.

oc extract secret/pull-secret -n openshift-config --to=.
2. Edit the .dockerconfigjson file you downloaded in the previous step to remove the cloud.openshift.com entry.

"cloud.openshift.com":{"auth":"<hash>","email":"<email_address>"}
3. Save the file.
4. From the same directory where you downloaded the pull secret, replace the pull secret in your cluster with the updated .dockerconfigjson on your local machine. In the following command, replace <pull_secret_location> with the path to your update .dockerconfigjson file.

oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=<pull_secret_location>
The pipeline stages need the Git URLs for your repos. Each pipeline stage can refer to only one of the GitHub or Git repos that are associated with your toolchain. For instructions to configure GitHub, see the [GitHub](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelinegithub) section. For instructions to configure Git Repos and Issue Tracking, see the [Git Repos and Issue Tracking](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelinegrit) section.

b. Use a webhook. Without a webhook, you can run pipelines manually only. To use a webhook when you link to a GitHub or GitHub Enterprise repo, you need admin privileges. To link to a Git Repos and Issue Tracking repo, you need Master or Owner privileges.
8. Optional: If you are using a toolchain on IBM Cloud Public and you want Sauce Labs to run tests on your app, configure the Delivery Pipeline to add a Sauce Labs test job. For instructions to configure the test job, see the [Configuring a Sauce Labs test job in your pipeline](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelineconfig_saucelabs) section.





 Configuring a Sauce Labs test job in your pipeline 

Before you configure a Sauce Labs test job in your pipeline, you need a working pipeline that has stages to build and deploy your app. You must also configure Sauce Labs for your toolchain. For instructions about how to configure Sauce Labs, see the [Sauce Labs](https://cloud.ibm.com/docs/services/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelinesaucelabs) section.

Configure the Delivery Pipeline to add a Sauce Labs test job:



1.
The pipeline stages need the Git URLs for your repos. Each pipeline stage can refer to only one of the GitHub or Git repos that are associated with your toolchain. For instructions to configure GitHub, see the [GitHub](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelinegithub) section. For instructions to configure Git Repos and Issue Tracking, see the [Git Repos and Issue Tracking](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelinegrit) section.

b. Use a webhook. Without a webhook, you can run pipelines manually only. To use a webhook when you link to a GitHub or GitHub Enterprise repo, you need admin privileges. To link to a Git Repos and Issue Tracking repo, you need Master or Owner privileges.
8. Optional: If you are using a toolchain on IBM Cloud Public and you want Sauce Labs to run tests on your app, configure the Delivery Pipeline to add a Sauce Labs test job. For instructions to configure the test job, see the [Configuring a Sauce Labs test job in your pipeline](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelineconfig_saucelabs) section.





 Configuring a Sauce Labs test job in your pipeline 

Before you configure a Sauce Labs test job in your pipeline, you need a working pipeline that has stages to build and deploy your app. You must also configure Sauce Labs for your toolchain. For instructions about how to configure Sauce Labs, see the [Sauce Labs](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-deliverypipelinesaucelabs) section.

Configure the Delivery Pipeline to add a Sauce Labs test job:



1.
[Building a container image with stand-alone build commands (CLI)](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuild-standalone)



* [Running a single build that pulls source from public repository with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-public)



* [Running a single build with the CLI (with public repo source and automatic access to registry)](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-public-cli-a)
* [Running a single build with the CLI (with public repo source and user-provided access to registry)](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-public-cli-b)



* [Running a single build that pulls source from private repository with the CLI](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-private)



* [Running a single build with the CLI (with private repo source and automatic access to registry)](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-private-cli-a)
* [Running a single build with the CLI (with private repo source and and user-provided access to registry)](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-private-cli-b)



* [Running a single build that pulls source from a local directory](https://cloud.ibm.com/docs/codeengine?topic=codeengine-build-standalonebuildsa-local)
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
Show more

The ordered certificates are public SSL/TLS certificates and must be used as a VPN server certificate only. You cannot use the ordered certificates to authenticate the VPN clients because of the following reasons:



* Anyone can order a new certificate from a public CA. Then, they can pass the authentication if you use public SSL/TLS certificates to authenticate your VPN client.
* You cannot create a certificate revocation list (CRL) to revoke a VPN client certificate with a public CA.



You must create your own CA and import the CA certificate into Secrets Manager to authenticate your VPN client.





 Using a private certificate 

You can use a Secrets Manager private certificate in your VPN server. Review the following important considerations when doing so:



* All CAs in a CA chain must be contained in a Secrets Manager instance. Also, you must create the root CA inside the Secrets Manager. When you select an intermediate CA, the following options are required to make sure that every CA can be found while the CA chain of a private certificate in your VPN server is verified:



* In the Type section, you must select Internal signing.
* In the Type section, you must enable the Encode URL toggle button when you create a CA to encode the issuing certificate URL in end-entity certificates.
You can even [register existing Red Hat OpenShift clusters to your location](https://cloud.ibm.com/docs/satellite?topic=satellite-register-openshift-clusters) to use as deployment targets.
3. [Manage your applications](https://cloud.ibm.com/docs/satellite?topic=satellite-cluster-config) with Satellite Config.
4. Create [Satellite cluster storage templates](https://cloud.ibm.com/docs/satellite?topic=satellite-storage-template-ov).
5. Learn more about the [Satellite Link component](https://cloud.ibm.com/docs/satellite?topic=satellite-link-location-cloud) and how you can use endpoints to manage the network traffic between your location and IBM Cloud.



Need help? Check out [Getting support](https://cloud.ibm.com/docs/satellite?topic=satellite-get-help) where you can find information about cloud status, issues, and logging; contacting support; and setting your email notification preferences for IBM Cloud platform-related items.
Next, you need to create a Product. For more information, see [Creating a Product](https://cloud.ibm.com/docs/apiconnect?topic=apiconnect-managing_productscreate_product-managing_products).

Tip: Whenever you start a new command prompt, make sure that your current working directory is the project top-level directory. To do this, enter the following command:

cd <project directory name>







 Uninstalling the developer toolkit 

To uninstall the developer toolkit, complete the following steps:



1. Stop any apps that are running locally by running the following command:



apic stop --all



2. Enter the following command:



npm rm -g apiconnect



3. Clear your npm cache:



npm cache clean

If you are using Windows:



4. Delete all files whose names begin with npm- in C:UsersusernameAppDataLocalTemp
5. Delete the directory <home_dir>.apiconnect, where <home_dir> is the home directory of the user account under which the toolkit was previously installed.
Mirroring Git repositories 

If you use Git Repos and Issue Tracking for both your source and target repositories (repos), you can use the built-in GitLab mirroring feature. This feature automatically synchronizes your source and target repos. If you use a different Git provider, you must set up your own mirroring solution. Alternatively, to mirror changes in the source repo, manually clone and push your Git repos to the target repo.

If you cannot mirror your projects, you can [export](https://us-south.git.cloud.ibm.com/help/user/project/settings/import_export.mdexporting-a-project-and-its-data) and [import](https://us-south.git.cloud.ibm.com/help/user/project/settings/import_export.mdimporting-the-project) your projects instead. However, the source and target repos are not synchronized if changes are made to the source repo.

To mirror a Git Repos and Issue Tracking repo, complete the following steps:



1. Create a blank GitLab project in the target repo. Do not initialize this project with a readme file.
2. [Create a personal access token](https://us-south.git.cloud.ibm.com/help/user/profile/personal_access_tokens.mdcreating-a-personal-access-token) with the write_repository scope in the target region. Save a copy of this token.
3. Use [Push mirroring](https://us-south.git.cloud.ibm.com/help/user/project/repository/mirror/push.md) to push the source repo to the target repo:

a. From the source repo, select Settings > Repository.

b. In Mirror repository section of the Repository page, type the URL of the target repo.

c. Select Push to specify the direction of the mirror.

d. Select Password to use the password authentication method.

e.
DOM [Typescript](http://registry.npmjs.org/typescript/-/typescript-3.7.2.tgz), GO-DIGEST-README.MD FILE AND CONTRIBUTING.MD [distribution](https://github.com/docker/distribution/archive/v2.7.1.zip), DOC [docker-ce-cli](https://github.com/docker/docker-ce/archive/v19.03.3.zip), TEST_CONTAINERD_DOCS [Microsoft/hcsshim](https://pkg.go.dev/github.com/Microsoft/hcsshim@v0.8.7), CASCADINGSCHEMES.YAML [go-openapi/loads](https://pkg.go.dev/github.com/go-openapi/loads@v0.19.4), CONTAINERD DOCUMENTATION [docker/docker](https://github.com/docker/docker), DATA.GO [go-openapi/runtime](https://github.com/go-openapi/runtime/tree/v0.19.4), DOCS/LOGO.SVG [Semver](https://pypi.io/packages/source/s/semver/semver-2.13.0.tar.gz), SWAGGER PETSTORE [go-openapi/validate], EXPANDER_TEST.GO [go-openapi/spec](https://github.com/go-openapi/spec/tree/v0.19.9), PAPER-100K.PDF [Snappy](http://registry.npmjs.org/snappy/-/snappy-6.3.5.tgz), README AND DOCS FOLDER [containerd/containerd](https://github.com/containerd/containerd/archive/v1.3.2.zip)





 Creative Commons Attribution Share Alike 1.0 Generic
[Image showing a number of download options with HTTPS being selected](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_ams_mqclient3.png)

If you do not have this option, try in an alternative browser.
4. After clicking on continue. You will be redirected to screen shown below. Click on the symbol as shown by the red circle to begin your download
![Click on the image indicated by the red circle](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_ams_mqclient4.png)
5. Once downloaded, extract the file to a directory of your choice <PATH_TO_MQCLIENT_DIR>



* tar -xvzf <IBM-MQC-Redist>.tar.gz <PATH_TO_MQCLIENT_DIR>



6. Add commands to path



* export PATH=$PATH:<PATH_TO_MQCLIENT_DIR>/bin:<PATH_TO_MQCLIENT_DIR>/samp/bin
You will also need a use text editor to edit and save files in the sample. You can use many of the high-quality editors that are available for free, such as [Visual Studio Code](https://code.visualstudio.com/), [Atom](https://atom.io/), [Sublime text](http://www.sublimetext.com/), or [Brackets](http://brackets.io/).





 Step one: Download the sample 

You download the commercial paper sample by cloning the [Fabric Samples repository](https://github.com/hyperledger/fabric-samples):

git clone https://github.com/hyperledger/fabric-samples.git

After you download the Fabric Samples, run the following commands to ensure that you are using the version of the samples compatible with Fabric v2.2.10.

cd fabric-samples
git checkout v1.4.9

You can find the sample in the commercial paper folder of fabric-samples.

cd $HOME/fabric-samples/commercial-paper

The tutorial contains two sample organizations, magnetocorp and digibank. Each organization has its own sample application code, which is stored in two separate folders under the organization directory.

ls organization
digibank magnetocorp

In the course of the tutorial, you will first use the magnetocorp application code to issue a commercial paper. You can then use the digibank application code to buy and redeem the paper. Both directories contain the same smart contract.

Navigate to the application code inside the magnetocorp directory.

cd organization/magnetocorp/application

When you are inside the directory, you can download the application dependencies by running the following command:

npm install





 Step two: Install and Propose smart contract 

You can find the commercial paper smart contract inside the contract folder of the digibank and magnetocorp directory. You need to install this smart contract on all the peers of the organizations that use the tutorial.
[Image showing selecting the redistributable MQ C client compatible with an Operating System](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_ams_mqclient2.png)
3. Select to download via HTTPS, this will allow you to download the client directly through your browser as shown below ![Image showing a number of download options with HTTPS being selected](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_ams_mqclient3.png)



* Note: if you do not have this option, try in an alternative browser.



4. After clicking on continue. You will be redirected to screen shown below. Click on the symbol as shown by the red circle to begin your download ![Click on the image indicated by the red circle](https://cloud.ibm.com/docs-content/v1/content/3a120b16db5fdc3e70d071af8a63ce5515c1b096/mqcloud/images/mqoc_ams_mqclient4.png)
5. Once downloaded, extract the file to a directory of your choice <PATH_TO_MQCLIENT_DIR>



* tar -xvzf <IBM-MQC-Redist>.tar.gz <PATH_TO_MQCLIENT_DIR>



6. Add commands to path



* export PATH=$PATH:<PATH_TO_MQCLIENT_DIR>/bin:<PATH_TO_MQCLIENT_DIR>/samp/bin
passport.authenticate(APIStrategy.STRATEGY_NAME, {
session: false
}),
function(req, res) {
// Get full appIdAuthorizationContext from request object
var appIdAuthContext = req.appIdAuthorizationContext;

appIdAuthContext.accessToken; // Raw access_token
appIdAuthContext.accessTokenPayload; // Decoded access_token JSON
appIdAuthContext.identityToken; // Raw identity_token
appIdAuthContext.identityTokenPayload; // Decoded identity_token JSON
appIdAuthContext.refreshToken; // Raw refresh_token
...
}
);

// iOS Swift example

class delegate : TokenResponseDelegate {
public func onAuthorizationSuccess(accessToken: AccessToken?, identityToken: IdentityToken?, refreshToken: RefreshToken?, response:Response?) {
//User authenticated
}

public func onAuthorizationFailure(error: AuthorizationError) {
//Exception occurred
}
}

AppID.sharedInstance.signinWithResourceOwnerPassword(username: username, password: password, delegate: delegate())

// Server-side swift example

let options = [
"clientId": "<clientID>",
"secret": "<secret>",
"tenantId": "<tenantID>",
"oauthServerUrl": "<oauthServerURL>",
"redirectUri": "<appURL>" + CALLBACK_URL
]
let webappKituraCredentialsPlugin = WebAppKituraCredentialsPlugin(options: options)
let kituraCredentials = Credentials()
kituraCredentials.register(plugin: webappKituraCredentialsPlugin)