BashOperator 任务执行时气流权限被拒绝答案

【问题标题】：Airflow permission denied on BashOperator task executionBashOperator 任务执行时气流权限被拒绝
【发布时间】：2022-09-23 04:37:21
【问题描述】：

初学者

我必须在 Airflow（使用 docker）中运行一个 python 文件，但我的权限被拒绝。这个 python 文件中的第一个任务是从一个文件夹中解压缩一些文件并将它们插入到另一个已经解压缩的文件夹中。这些 zip 来自数据湖并放置在此目录中，因此它们只是用于解压缩。我不允许改变这个流程，所以我需要保持原样，只是用气流来协调它们。在 Ubuntu 20 命令行上，相同的 python 脚本在 Airflow 之外运行而没有错误。我尝试在目录中添加 chmod 命令，但它不起作用。

我的 dags 在 /opt/airflow/dags 中运行，python 脚本在 /opt/airflow/filepy 中，要解压缩的文件在 /opt/airflow/filepy/unzip/zip 中。

This is the error from airflow

This is the task call

This is the part of python file encharged to unzip files

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# \"License\"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
#

# Basic Airflow cluster configuration for CeleryExecutor with Redis and PostgreSQL.
#
# WARNING: This configuration is for local development. Do not use it in a production deployment.
#
# This configuration supports basic configuration using environment variables or an .env file
# The following variables are supported:
#
# AIRFLOW_IMAGE_NAME           - Docker image name used to run Airflow.
#                                Default: apache/airflow:2.3.4
# AIRFLOW_UID                  - User ID in Airflow containers
#                                Default: 50000
# Those configurations are useful mostly in case of standalone testing/running Airflow in test/try-out mode
#
# _AIRFLOW_WWW_USER_USERNAME   - Username for the administrator account (if requested).
#                                Default: airflow
# _AIRFLOW_WWW_USER_PASSWORD   - Password for the administrator account (if requested).
#                                Default: airflow
# _PIP_ADDITIONAL_REQUIREMENTS - Additional PIP requirements to add when starting all containers.
#                                Default: \'\'
#
# Feel free to modify this file to suit your needs.
---
version: \'3\'
x-airflow-common:
  &airflow-common
  # In order to add custom dependencies or upgrade provider packages you can use your extended image.
  # Comment the image line, place your Dockerfile in the directory where you placed the docker-compose.yaml
  # and uncomment the \"build\" line below, Then run `docker-compose build` to build the images.
  image: ${AIRFLOW_IMAGE_NAME:-apache/airflow:2.3.4}
  # build: .
  environment:
    &airflow-common-env
    AIRFLOW__CORE__EXECUTOR: CeleryExecutor
    AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@postgres/airflow
    # For backward compatibility, with Airflow <2.3
    AIRFLOW__CORE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@postgres/airflow
    AIRFLOW__CELERY__RESULT_BACKEND: db+postgresql://airflow:airflow@postgres/airflow
    AIRFLOW__CELERY__BROKER_URL: redis://:@redis:6379/0
    AIRFLOW__CORE__FERNET_KEY: \'\'
    AIRFLOW__CORE__DAGS_ARE_PAUSED_AT_CREATION: \'true\'
    AIRFLOW__CORE__LOAD_EXAMPLES: \'true\'
    AIRFLOW__API__AUTH_BACKENDS: \'airflow.api.auth.backend.basic_auth\'
    _PIP_ADDITIONAL_REQUIREMENTS: ${_PIP_ADDITIONAL_REQUIREMENTS:- azure-core azure-functions progressbar2 wheel pytest-shutil threaded queuelib azure-storage-blob xml-python urllib3 apache-airflow-providers-microsoft-azure==4.2.0}
# progressbar}
  volumes:
    - ./dags:/opt/airflow/dags
    - ./logs:/opt/airflow/logs
    - ./plugins:/opt/airflow/plugins
    - /home/lopp/s3i/infra/sqlserver/BD_NF:/opt/airflow/filepy
  user: \"${AIRFLOW_UID:-50000}:0\"
  command: \"chown -R ${AIRFLOW_UID:-50000}.${AIRFLOW_UID:-50000} /opt/airflow/dags\"
  command: \"chown -R ${AIRFLOW_UID:-50000}.${AIRFLOW_UID:-50000} /opt/airflow/filepy\"
  command: \"chown -R ${AIRFLOW_UID:-50000}.${AIRFLOW_UID:-50000} /opt/airflow/filepy/unzip\"
  command: \"chown -R ${AIRFLOW_UID:-50000}.${AIRFLOW_UID:-50000} /opt/airflow/filepy/unzip/zip\"
  depends_on:
    &airflow-common-depends-on
    redis:
      condition: service_healthy
    postgres:
      condition: service_healthy

services:
  postgres:
    image: postgres:13
    environment:
      POSTGRES_USER: airflow
      POSTGRES_PASSWORD: airflow
      POSTGRES_DB: airflow
    volumes:
      - postgres-db-volume:/var/lib/postgresql/data
    healthcheck:
      test: [\"CMD\", \"pg_isready\", \"-U\", \"airflow\"]
      interval: 5s
      retries: 5
    restart: always

  redis:
    image: redis:latest
    expose:
      - 6379
    healthcheck:
      test: [\"CMD\", \"redis-cli\", \"ping\"]
      interval: 5s
      timeout: 30s
      retries: 50
    restart: always

  airflow-webserver:
    <<: *airflow-common
    command: webserver
    ports:
      - 8080:8080
    healthcheck:
      test: [\"CMD\", \"curl\", \"--fail\", \"http://localhost:8080/health\"]
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-scheduler:
    <<: *airflow-common
    command: scheduler
    healthcheck:
      test: [\"CMD-SHELL\", \'airflow jobs check --job-type SchedulerJob --hostname \"$${HOSTNAME}\"\']
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-worker:
    <<: *airflow-common
    command: celery worker
    healthcheck:
      test:
        - \"CMD-SHELL\"
        - \'celery --app airflow.executors.celery_executor.app inspect ping -d \"celery@$${HOSTNAME}\"\'
      interval: 10s
      timeout: 10s
      retries: 5
    environment:
      <<: *airflow-common-env
      # Required to handle warm shutdown of the celery workers properly
      # See https://airflow.apache.org/docs/docker-stack/entrypoint.html#signal-propagation
      DUMB_INIT_SETSID: \"0\"
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-triggerer:
    <<: *airflow-common
    command: triggerer
    healthcheck:
      test: [\"CMD-SHELL\", \'airflow jobs check --job-type TriggererJob --hostname \"$${HOSTNAME}\"\']
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-init:
    <<: *airflow-common
    entrypoint: /bin/bash
    # yamllint disable rule:line-length
    command:
      - -c
      - |
        function ver() {
          printf \"%04d%04d%04d%04d\" $${1//./ }
        }
        airflow_version=$$(AIRFLOW__LOGGING__LOGGING_LEVEL=INFO && gosu airflow airflow version)
        airflow_version_comparable=$$(ver $${airflow_version})
        min_airflow_version=2.2.0
        min_airflow_version_comparable=$$(ver $${min_airflow_version})
        if (( airflow_version_comparable < min_airflow_version_comparable )); then
          echo
          echo -e \"\\033[1;31mERROR!!!: Too old Airflow version $${airflow_version}!\\e[0m\"
          echo \"The minimum Airflow version supported: $${min_airflow_version}. Only use this or higher!\"
          echo
          exit 1
        fi
        if [[ -z \"${AIRFLOW_UID}\" ]]; then
          echo
          echo -e \"\\033[1;33mWARNING!!!: AIRFLOW_UID not set!\\e[0m\"
          echo \"If you are on Linux, you SHOULD follow the instructions below to set \"
          echo \"AIRFLOW_UID environment variable, otherwise files will be owned by root.\"
          echo \"For other operating systems you can get rid of the warning with manually created .env file:\"
          echo \"    See: https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html#setting-the-right-airflow-user\"
          echo
        fi
        one_meg=1048576
        mem_available=$$(($$(getconf _PHYS_PAGES) * $$(getconf PAGE_SIZE) / one_meg))
        cpus_available=$$(grep -cE \'cpu[0-9]+\' /proc/stat)
        disk_available=$$(df / | tail -1 | awk \'{print $$4}\')
        warning_resources=\"false\"
        if (( mem_available < 4000 )) ; then
          echo
          echo -e \"\\033[1;33mWARNING!!!: Not enough memory available for Docker.\\e[0m\"
          echo \"At least 4GB of memory required. You have $$(numfmt --to iec $$((mem_available * one_meg)))\"
          echo
          warning_resources=\"true\"
        fi
        if (( cpus_available < 2 )); then
          echo
          echo -e \"\\033[1;33mWARNING!!!: Not enough CPUS available for Docker.\\e[0m\"
          echo \"At least 2 CPUs recommended. You have $${cpus_available}\"
          echo
          warning_resources=\"true\"
        fi
        if (( disk_available < one_meg * 10 )); then
          echo
          echo -e \"\\033[1;33mWARNING!!!: Not enough Disk space available for Docker.\\e[0m\"
          echo \"At least 10 GBs recommended. You have $$(numfmt --to iec $$((disk_available * 1024 )))\"
          echo
          warning_resources=\"true\"
        fi
        if [[ $${warning_resources} == \"true\" ]]; then
          echo
          echo -e \"\\033[1;33mWARNING!!!: You have not enough resources to run Airflow (see above)!\\e[0m\"
          echo \"Please follow the instructions to increase amount of resources available:\"
          echo \"   https://airflow.apache.org/docs/apache-airflow/stable/start/docker.html#before-you-begin\"
          echo
        fi
        mkdir -p /sources/logs /sources/dags /sources/plugins
        chown -R \"${AIRFLOW_UID}:0\" /sources/{logs,dags,plugins}
        exec /entrypoint airflow version
    # yamllint enable rule:line-length
    environment:
      <<: *airflow-common-env
      _AIRFLOW_DB_UPGRADE: \'true\'
      _AIRFLOW_WWW_USER_CREATE: \'true\'
      _AIRFLOW_WWW_USER_USERNAME: ${_AIRFLOW_WWW_USER_USERNAME:-airflow}
      _AIRFLOW_WWW_USER_PASSWORD: ${_AIRFLOW_WWW_USER_PASSWORD:-airflow}
      _PIP_ADDITIONAL_REQUIREMENTS: \'\'
    user: \"0:0\"
    volumes:
      - .:/sources

  airflow-cli:
    <<: *airflow-common
    profiles:
      - debug
    environment:
      <<: *airflow-common-env
      CONNECTION_CHECK_MAX_COUNT: \"0\"
    # Workaround for entrypoint issue. See: https://github.com/apache/airflow/issues/16252
    command:
      - bash
      - -c
      - airflow

  # You can enable flower by adding \"--profile flower\" option e.g. docker-compose --profile flower up
  # or by explicitly targeted on the command line e.g. docker-compose up flower.
  # See: https://docs.docker.com/compose/profiles/
  flower:
    <<: *airflow-common
    command: celery flower
    profiles:
      - flower
    ports:
      - 5555:5555
    healthcheck:
      test: [\"CMD\", \"curl\", \"--fail\", \"http://localhost:5555/\"]
      interval: 10s
      timeout: 10s
      retries: 5
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

volumes:
  postgres-db-volume:

编辑：

手动我可以解压缩文件

标签： python docker permissions airflow

【解决方案1】：

您是否尝试过在 bash 命令之前添加“sudo”？

【讨论】：

是的，我做到了，但出现了另一个错误

【解决方案2】：

请尝试 initializing the environment 的 Airflow 设置，提供必要的用户相关信息。

如上述文档所示：

在 Linux 上，容器中挂载的卷使用本机 Linux 文件系统用户/组权限，因此您必须确保容器和主机计算机具有匹配的文件权限。

要解决此问题，请尝试创建一个运行例如建议命令的.env 文件：
echo -e "AIRFLOW_UID=$(id -u)\nAIRFLOW_GID=0" > .env
它将使用主机操作系统当前用户的 uid 和 gid 创建几个环境变量，并使 Airflow 在您的容器中也为气流用户使用这些值。

然后，通过删除以下内容重新创建您的 docker 堆栈：
docker-compose down
并再次启动您的容器：
docker-compose up -d

【讨论】：

尝试了这些步骤，但现在气流甚至不稳定，不断重启