[Bug] chia in docker container with non-root user won't start / lock file problem / compile_clvm

What happened?

Environment

• custom docker image
• chia 1.3.4 compiled from source
• pipenv as venv
• python 3.9.12 (also tested with 3.9.11, 3.9.10)
• ‘non-root’ user inside docker, chia runs as user 3981

Command inside docker container

chia -h …every chia_* cmd hangs

Current state

deadlock, chia doesn’t show anything.

Expected state

help is shown

Debugging support

• Stack see below
• per try-and-error debugging I can say the problem is the custom user in combination with lock file creation of compile_clvm. Maybe the lock file is written to some directory with different permissions. What is this concrete directory?
• with user root everything works fine
• until chia 1.3.3 the custom user also worked fine

Version

1.3.4

What platform are you using?

Linux

What ui mode are you using?

CLI

Relevant log output

chia@27d9ea5841a5:/app$ chia -h
^CTraceback (most recent call last):
  File "/opt/chia-blockchain/.venv/bin/chia", line 5, in <module>
    from chia.cmds.chia import main
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/cmds/chia.py", line 18, in <module>
    from chia.cmds.plotters import plotters_cmd
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/cmds/plotters.py", line 2, in <module>
    from chia.plotters.plotters import call_plotters
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/plotters/plotters.py", line 5, in <module>
    from chia.plotters.bladebit import get_bladebit_install_info, plot_bladebit
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/plotters/bladebit.py", line 10, in <module>
    from chia.plotting.create_plots import resolve_plot_keys
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/plotting/create_plots.py", line 10, in <module>
    from chia.daemon.keychain_proxy import KeychainProxy, connect_to_keychain_and_validate, wrap_local_keychain
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/daemon/keychain_proxy.py", line 5, in <module>
    from chia.cmds.init_funcs import check_keys
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/cmds/init_funcs.py", line 10, in <module>
    from chia.consensus.coinbase import create_puzzlehash_for_pk
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/consensus/coinbase.py", line 6, in <module>
    from chia.wallet.puzzles.p2_delegated_puzzle_or_hidden_puzzle import puzzle_for_pk
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/wallet/puzzles/p2_delegated_puzzle_or_hidden_puzzle.py", line 68, in <module>
    from .p2_conditions import puzzle_for_conditions
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/wallet/puzzles/p2_conditions.py", line 17, in <module>
    MOD = load_clvm("p2_conditions.clvm")
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/wallet/puzzles/load_clvm.py", line 106, in load_clvm
    return Program.from_bytes(bytes(load_serialized_clvm(clvm_filename, package_or_requirement=package_or_requirement)))
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/wallet/puzzles/load_clvm.py", line 92, in load_serialized_clvm
    compile_clvm(full_path, output, search_paths=[full_path.parent])
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/wallet/puzzles/load_clvm.py", line 73, in compile_clvm
    with_lock(f"{full_path}.lock", do_compile)
  File "/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/util/lock.py", line 39, in with_lock
    time.sleep(0.1)
KeyboardInterrupt

[stefan-lange]

the reason seems to be that the clvm compile logic wants to create a *.lock file in

/opt/chia-blockchain/.venv/lib/python3.9/site-packages/chia/wallet/puzzles

fixed it for me with this, which is not 100% future proof. That changes the owner of the code directory to the current user, so it can be written to:

RUN find /opt/chia-blockchain/.venv/ -type d -name "puzzles" -exec chown $UID {} \;

I don’t understand exactly why this is done, because in the folder there are already *.clvm and the related *.clvm.hex files - in my case. I think it is not really nice, because the app code can be changed during execution. My intention was to secure the app so no one can change it.

Suggestion: if you need temp or cache files, why not using the existing folders like ~/.cache etc. for that? There should be version for every OS.

[wallentx]

We are working on this at the moment (https://github.com/Chia-Network/chia-blockchain/pull/12050 is part of it), but for the moment, this workaround seems to be the advisable.