Simple CircleCI 2.0 configuration fails for global NPM package installation

Question

I have a Dockerfile that works fine:

FROM node:10
RUN npm set unsafe-perm true
RUN npm install -g '@oresoftware/[email protected]'

but the same CircleCI config.yml file that mirrors the above Dockerfile does not work:

{
  "version": 2,
  "jobs": {
    "build": {
      "docker": [
        {
          "image": "circleci/node:10"
        }
      ],
      "steps": [
        {
          "run": "npm set unsafe-perm true"
        },
        {
          "run": "npm install -g --loglevel=warn '@oresoftware/[email protected]'"
        }
      ]
    }
  }
}

I get the following error on CircleCI using the above config.yml file:

#!/bin/bash -eo pipefail
npm install -g --loglevel=warn @oresoftware/r2g
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules
npm ERR! path /usr/local/lib/node_modules
npm ERR! code EACCES
npm ERR! errno -13
npm ERR! syscall access
npm ERR! Error: EACCES: permission denied, access '/usr/local/lib/node_modules'
npm ERR!  { [Error: EACCES: permission denied, access '/usr/local/lib/node_modules']
npm ERR!   stack:
npm ERR!    'Error: EACCES: permission denied, access \'/usr/local/lib/node_modules\'',
npm ERR!   errno: -13,
npm ERR!   code: 'EACCES',
npm ERR!   syscall: 'access',
npm ERR!   path: '/usr/local/lib/node_modules' }
npm ERR! 
npm ERR! The operation was rejected by your operating system.
npm ERR! It is likely you do not have the permissions to access this file as the current user
npm ERR! 
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator (though this is not recommended).

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/circleci/.npm/_logs/2018-06-18T18_26_53_651Z-debug.log
Exited with code 243

CircleCI 2.0 should use Docker, so I am not sure why this permissions error is happening.

Answer 1

tldr - use the following prefix:

npm install --prefix=$HOME/.local --global serverless

• Replace serverless with your own global package requirements.

Background:

• After a bit of experimentation the above seems to be the cleanest way I've found.

• CircleCI's current circleci/node:lts-buster image has the following on the path:

  /home/circleci/.local/bin:/home/circleci/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

• I was unable to write to /home/circleci/bin due to blocked write permissions.

• I was able to write to /home/circleci/.local/bin
• Adding the --prefix=$HOME/.local option to npm install command means the global package is then installed into /home/circleci/.local/bin
• After install, the command, in my case serverless, is executable.

Answer 2

As said the Dockerfile from the top is not fully identical with the one in the CircleCI-config. In the Dockerfile the base image is node which by default runs under the root user.

The circleci/node image on the on the other hand drops to the unprivileged circleci user. So a 100% identical Dockerfile based on the node image would look like this:

FROM node:10
RUN useradd -m circleci
USER circleci
RUN npm set unsafe-perm true
RUN npm install -g '@oresoftware/[email protected]'

And with this Dockerfile the same error appears as in CircleCI.

One solution would be to use sudo, the problem with this is that you would have to use sudo on every command which makes use of the node package you installed (since with sudo it would actually be installed in the /root directory which is not accessible with the circleci user).

I think the better option would be to install the package in the circleci home directory.

{
  "version": 2,
  "jobs": {
    "build": {
      "docker": [
        {
          "image": "circleci/node:10"
        }
      ],
      "steps": [
        {
          "run": "npm set prefix=/home/circleci/npm && echo 'export PATH=$HOME/circleci/npm/bin:$PATH' >> /home/circleci/.bashrc"
        },
        {
          "run": "npm install -g --loglevel=warn '@oresoftware/[email protected]'"
        }
      ]
    }
  }
}

This way you don't have to sudo everytime you want to use the package.

Answer 3

On CircleCI you'd need to use sudo. The default user is circleci which has passwordless sudo access.