`az` requires a writable home, even when there's no reason for it

Related command

az storage blob upload

Describe the bug

Traceback (most recent call last):
  File "/opt/az/lib/python3.8/runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/opt/az/lib/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/opt/az/lib/python3.8/site-packages/azure/cli/__main__.py", line 38, in <module>
    az_cli = get_default_cli()
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/__init__.py", line 903, in get_default_cli
    from azure.cli.core.azlogging import AzCliLogging
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/azlogging.py", line 30, in <module>
    from azure.cli.core.commands.events import EVENT_INVOKER_PRE_CMD_TBL_TRUNCATE
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 25, in <module>
    from azure.cli.core.extension import get_extension
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/extension/__init__.py", line 18, in <module>
    az_config = CLIConfig(config_dir=GLOBAL_CONFIG_DIR, config_env_var_prefix=ENV_VAR_PREFIX)
  File "/opt/az/lib/python3.8/site-packages/knack/config.py", line 40, in __init__
    ensure_dir(config_dir)
  File "/opt/az/lib/python3.8/site-packages/knack/util.py", line 115, in ensure_dir
    raise e
  File "/opt/az/lib/python3.8/site-packages/knack/util.py", line 112, in ensure_dir
    os.makedirs(d)
  File "/usr/bin/../../opt/az/lib/python3.8/os.py", line 223, in makedirs
    mkdir(name, mode)
PermissionError: [Errno 13] Permission denied: '/opt/proggy/.azure'

To Reproduce Run az with a non-writable home directory. E.g., in the above example, we are running az storage blob upload with our credentials coming from AZURE_STORAGE_KEY.

Expected behavior If the command can execute, then it should. (If a home dir is required, e.g., if I am asking az login to store an access token, then there’s no way around it and an error is appropriate.)

Environment summary Debian, apt-get.

I'd tell you what version of <tt>az</tt>, but…

$ az --version
Traceback (most recent call last):
  File "/opt/az/lib/python3.8/runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/opt/az/lib/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/opt/az/lib/python3.8/site-packages/azure/cli/__main__.py", line 38, in <module>
    az_cli = get_default_cli()
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/__init__.py", line 903, in get_default_cli
    from azure.cli.core.azlogging import AzCliLogging
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/azlogging.py", line 30, in <module>
    from azure.cli.core.commands.events import EVENT_INVOKER_PRE_CMD_TBL_TRUNCATE
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/commands/__init__.py", line 25, in <module>
    from azure.cli.core.extension import get_extension
  File "/opt/az/lib/python3.8/site-packages/azure/cli/core/extension/__init__.py", line 18, in <module>
    az_config = CLIConfig(config_dir=GLOBAL_CONFIG_DIR, config_env_var_prefix=ENV_VAR_PREFIX)
  File "/opt/az/lib/python3.8/site-packages/knack/config.py", line 40, in __init__
    ensure_dir(config_dir)
  File "/opt/az/lib/python3.8/site-packages/knack/util.py", line 115, in ensure_dir
    raise e
  File "/opt/az/lib/python3.8/site-packages/knack/util.py", line 112, in ensure_dir
    os.makedirs(d)
  File "/usr/bin/../../opt/az/lib/python3.8/os.py", line 223, in makedirs
    mkdir(name, mode)
PermissionError: [Errno 13] Permission denied: '/opt/proggy/.azure'

dpkg says it is 2.36.0-1~bullseye.

Additional context Security teams & audit reviews want containers to be non-writable these days, unless there is a business reason for them to be otherwise. It is for that reason that ~ is read-only here. Here, we have to explicitly make ~ writable for az, even though nothing about this particular invocation requires it. (In practice, I’m hoping that I can get away with just a writable ~/.azure.)

[evelyn-ys]

To be simple, CLI may need to create a .azure folder to store some local info, eg, installationId, config, local cache, etc.

[msftbot[bot]]

Hi @roy-work, since you haven’t asked that we “/unresolve” the issue, we’ll close this out. If you believe further discussion is needed, please add a comment “/unresolve” to reopen the issue.