Insufficient write permission to the media root

[etfz]

Current Behavior

Attempting to upload an image attachment fails with the following error:

Server Error

A file permission error was detected while processing this request. Common causes include the following:

Insufficient write permission to the media root. The configured media root is . Ensure that the user NetBox runs as has access to write files to all locations within this path.

<class 'PermissionError'>

[Errno 13] Permission denied: '/opt/netbox/netbox/media/image-attachments/rack_8_20240503_141712.jpg'

Python version: 3.11.4
NetBox version: 3.7.6
Plugins: None installed

Expected Behavior

Attachment uploaded.

Docker Compose Version

Docker Compose version v2.16.0

Docker Version

Client:
 Version:           20.10.5+dfsg1
 API version:       1.41
 Go version:        go1.15.15
 Git commit:        55c4c88
 Built:             Mon May 30 18:34:49 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.5+dfsg1
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.15.15
  Git commit:       363e9a8
  Built:            Mon May 30 18:34:49 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.4.13~ds1
  GitCommit:        1.4.13~ds1-1~deb11u3
 runc:
  Version:          1.0.0~rc93+ds1
  GitCommit:        1.0.0~rc93+ds1-5+deb11u2
 docker-init:
  Version:          0.19.0
  GitCommit:

The git Revision

b47e85a

The git Status

On branch release
Your branch is up to date with 'origin/release'.

Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
        modified:   configuration/plugins.py

Unmerged paths:
  (use "git restore --staged <file>..." to unstage)
  (use "git add <file>..." to mark resolution)
        both modified:   env/netbox.env

Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
        modified:   configuration/plugins.py

Untracked files:
  (use "git add <file>..." to include in what will be committed)
        Dockerfile-Plugins
        plugin_requirements.txt

Startup Command

docker compose up -d

NetBox Logs

netbox-netbox-1  | ↩️ Skip creating the superuser
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/logging.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/plugins.py'
netbox-netbox-1  | ⚠️ Warning: You have the old default admin token in your database. This token is widely known; please remove it.
netbox-netbox-1  | ✅ Initialisation is done.
netbox-netbox-1  | ⏳ Waiting for control socket to be created... (1/10)
netbox-netbox-1  | 2024/05/06 08:24:29 [warn] 7#7 Unit is running unprivileged, then it cannot use arbitrary user and group.
netbox-netbox-1  | 2024/05/06 08:24:29 [info] 7#7 unit 1.31.1 started
netbox-netbox-1  | 2024/05/06 08:24:29 [info] 22#22 discovery started
netbox-netbox-1  | 2024/05/06 08:24:29 [notice] 22#22 module: python 3.11.4 "/usr/lib/unit/modules/python3.11.unit.so"
netbox-netbox-1  | 2024/05/06 08:24:29 [info] 7#7 controller started
netbox-netbox-1  | 2024/05/06 08:24:29 [notice] 7#7 process 22 exited with code 0
netbox-netbox-1  | 2024/05/06 08:24:29 [info] 24#24 router started
netbox-netbox-1  | 2024/05/06 08:24:29 [info] 24#24 OpenSSL 3.0.8 7 Feb 2023, 30000080
netbox-netbox-1  | ⚙️ Applying configuration from /etc/unit/nginx-unit.json
netbox-netbox-1  | 2024/05/06 08:24:30 [info] 27#27 "netbox" prototype started
netbox-netbox-1  | 2024/05/06 08:24:30 [info] 28#28 "netbox" application started
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/logging.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/plugins.py'
netbox-netbox-1  | ✅ Unit configuration loaded successfully
netbox-netbox-1  | 2024/05/06 08:24:32 [notice] 7#7 process 20 exited with code 0
netbox-netbox-1  | 2024/05/06 08:24:44 [info] 37#37 "netbox" application started
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/logging.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/plugins.py'
netbox-netbox-1  | 127.0.0.1 - - [06/May/2024:08:24:49 +0000] "GET /api/ HTTP/1.1" 200 549 "-" "curl/7.88.1"
netbox-netbox-1  | 2024/05/06 08:24:59 [info] 38#38 "netbox" application started
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:24:59 +0000] "GET /api/plugins/prometheus-sd/services/?cf_monitor=true&name=HTTP HTTP/1.1" 404 11089 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:24:59 +0000] "GET /api/plugins/prometheus-sd/devices/?cf_monitoring=snmp&status=active&role=router HTTP/1.1" 404 11086 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:00 +0000] "GET /api/plugins/prometheus-sd/virtual-machines/?cf_monitoring=icmp&status=active HTTP/1.1" 404 11113 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:00 +0000] "GET /api/plugins/prometheus-sd/devices/?cf_monitoring=snmp&status=active HTTP/1.1" 404 11086 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/logging.py'
netbox-netbox-1  | 🧬 loaded config '/etc/netbox/config/plugins.py'
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:00 +0000] "GET /api/plugins/prometheus-sd/devices/?cf_monitoring=snmp&status=active&manufacturer=mikrotik HTTP/1.1" 404 11086 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:00 +0000] "GET /api/plugins/prometheus-sd/virtual-machines/?cf_monitoring=snmp&status=active HTTP/1.1" 404 11113 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:01 +0000] "GET /api/plugins/prometheus-sd/devices/?cf_monitoring=icmp&status=active HTTP/1.1" 404 11086 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 127.0.0.1 - - [06/May/2024:08:25:02 +0000] "GET /api/ HTTP/1.1" 200 549 "-" "curl/7.88.1"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:09 +0000] "GET /api/plugins/prometheus-sd/virtual-machines/?cf_monitoring=snmp&status=active&role=router HTTP/1.1" 404 11113 "-" "Prometheus/2.42.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:12 +0000] "POST /extras/image-attachments/add/?content_type=31&object_id=8 HTTP/1.1" 500 1879 "https://netdoc.example.com/extras/image-attachments/add/?content_type=31&object_id=8" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
netbox-netbox-1  | 127.0.0.1 - - [06/May/2024:08:25:17 +0000] "GET /api/ HTTP/1.1" 200 549 "-" "curl/7.88.1"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:22 +0000] "GET /extras/image-attachments/add/?content_type=31&object_id=8 HTTP/1.1" 200 96158 "https://netdoc.example.com/dcim/racks/8/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:25 +0000] "GET /extras/image-attachments/add/?content_type=31&object_id=8 HTTP/1.1" 200 96158 "https://netdoc.example.com/dcim/racks/8/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"
netbox-netbox-1  | 127.0.0.1 - - [06/May/2024:08:25:32 +0000] "GET /api/ HTTP/1.1" 200 549 "-" "curl/7.88.1"
netbox-netbox-1  | 172.25.1.4 - - [06/May/2024:08:25:33 +0000] "POST /extras/image-attachments/add/?content_type=31&object_id=8 HTTP/1.1" 500 1879 "https://netdoc.example.com/extras/image-attachments/add/?content_type=31&object_id=8" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0"

Content of docker-compose.override.yml

version: '3.4'
services:
  netbox:
    networks:
      - default
      - nginx-proxy
    environment:
      VIRTUAL_HOST: netdoc.example.com
      VIRTUAL_PORT: 8080
    build:
      context: .
      dockerfile: Dockerfile-Plugins
    image: netbox:latest-plugins
    restart: unless-stopped
  netbox-worker:
    image: netbox:latest-plugins
    restart: unless-stopped
    build:
      context: .
      dockerfile: Dockerfile-Plugins
  netbox-housekeeping:
    image: netbox:latest-plugins
    build:
      context: .
      dockerfile: Dockerfile-Plugins
    restart: unless-stopped
  postgres:
    image: postgres:15-alpine

networks:
  nginx-proxy:
    external: true

[etfz]

Why convert to a discussion?

[KarimGeiger]

I have the same issue since the last update. The file owner is set to 101, with the internal user being "unit" with uid 999. I suspect this has changed in recent updates?

As a manual fix, you can try the following:

1. Get the media volume name using docker volume ls
2. Stop the Netbox containers: docker compose down
3. Run an alpine container to change the permissions:

docker run --rm -it -v [project_name]_netbox-media-files:/mnt/netbox-media-files --entrypoint sh alpine
cd /mnt/netbox-media-files
chown -R 999 devicetype-images image-attachments
exit

4. Re-start netbox: docker compose up -d