在Hugging Face Spaces部署时遇Permission Denied错误求助

问题场景 #

我正在搭建Hugging Face Spaces，使用的Dockerfile如下：

FROM python:3.9

WORKDIR /code

COPY ./requirements.txt /code/requirements.txt
RUN pip install --no-cache-dir --prefer-binary -r /code/requirements.txt

RUN pip install --user matplotlib
COPY . .

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

构建启动时出现权限错误，无法创建flagged目录：

-->

===== Application Startup =====

Fetching model from: https://huggingface.co/facebook/wav2vec2-large-960h-lv60-self
Traceback (most recent call last):
  File "/usr/local/bin/uvicorn", line 8, in 
    sys.exit(main())
  File "/usr/local/lib/python3.9/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  ......
  File "/code/./app.py", line 3, in 
    gr.Interface.load("models/facebook/wav2vec2-large-960h-lv60-self").launch()
  File "/usr/local/lib/python3.9/site-packages/gradio/interface.py", line 109, in load
    return super().load(name=name, src=src, api_key=api_key, alias=alias, **kwargs)
  File "/usr/local/lib/python3.9/site-packages/gradio/blocks.py", line 1154, in load
    return external.load_blocks_from_repo(name, src, api_key, alias, **kwargs)
  File "/usr/local/lib/python3.9/site-packages/gradio/external.py", line 58, in load_blocks_from_repo
    blocks: gradio.Blocks = factory_methods[src](name, api_key, alias, **kwargs)
  File "/usr/local/lib/python3.9/site-packages/gradio/external.py", line 311, in from_model
    interface = gradio.Interface(**kwargs)
  File "/usr/local/lib/python3.9/site-packages/gradio/interface.py", line 424, in __init__
    self.flagging_callback.setup(
  File "/usr/local/lib/python3.9/site-packages/gradio/flagging.py", line 187, in setup
    os.makedirs(flagging_dir, exist_ok=True)
  File "/usr/local/lib/python3.9/os.py", line 225, in makedirs
    mkdir(name, mode)
PermissionError: [Errno 13] Permission denied: 'flagged'

尝试添加RUN chown语句创建目录并赋权但未生效，求解决方案。

解决方案 #

方法1：指定非默认的flagging目录（推荐） #

修改Gradio加载模型的代码，直接指定一个容器内有写入权限的目录，比如/tmp目录（容器默认对/tmp开放全局写入权限）：

gr.Interface.load(
    "models/facebook/wav2vec2-large-960h-lv60-self",
    flagging_dir="/tmp/flagged"
).launch()

也可以在启动时单独指定：

interface = gr.Interface.load("models/facebook/wav2vec2-large-960h-lv60-self")
interface.launch(flagging_dir="/tmp/flagged")

方法2：调整Dockerfile中的权限设置 #

之前的RUN chown未生效，大概率是COPY操作覆盖了目录权限，或者执行顺序有误。调整Dockerfile步骤：

FROM python:3.9

WORKDIR /code

# 先创建flagged目录并放开权限
RUN mkdir -p /code/flagged && chmod 777 /code/flagged

COPY ./requirements.txt /code/requirements.txt
RUN pip install --no-cache-dir --prefer-binary -r /code/requirements.txt

RUN pip install --user matplotlib
COPY . .

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

如果本地代码中已包含flagged目录，需要先完成COPY再调整权限：

FROM python:3.9

WORKDIR /code

COPY ./requirements.txt /code/requirements.txt
RUN pip install --no-cache-dir --prefer-binary -r /code/requirements.txt

RUN pip install --user matplotlib
COPY . .

# COPY完成后再创建/修改目录权限
RUN mkdir -p /code/flagged && chmod 777 /code/flagged

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

方法3：以普通用户身份运行容器 #

Docker默认以root用户启动，创建普通用户并切换，避免权限问题同时提升安全性：

FROM python:3.9

# 创建普通用户
RUN useradd -m appuser
WORKDIR /code

COPY ./requirements.txt /code/requirements.txt
RUN pip install --no-cache-dir --prefer-binary -r /code/requirements.txt

RUN pip install --user matplotlib
COPY . .

# 将代码目录所有权转移给普通用户
RUN chown -R appuser:appuser /code

# 切换到普通用户
USER appuser

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]

内容的提问来源于stack exchange，提问作者Andrius Solopovas