{"action":"created","issue":{"url":"https://api.github.com/repos/bitwalker/exrm/issues/238","labels_url":"https://api.github.com/repos/bitwalker/exrm/issues/238/labels{/name}","comments_url":"https://api.github.com/repos/bitwalker/exrm/issues/238/comments","events_url":"https://api.github.com/repos/bitwalker/exrm/issues/238/events","html_url":"https://github.com/bitwalker/exrm/issues/238","id":116168912,"number":238,"title":"Permissions when using separate deployer and runner","user":{"login":"maxim","id":7758,"avatar_url":"https://avatars.githubusercontent.com/u/7758?v=3","gravatar_id":"","url":"https://api.github.com/users/maxim","html_url":"https://github.com/maxim","followers_url":"https://api.github.com/users/maxim/followers","following_url":"https://api.github.com/users/maxim/following{/other_user}","gists_url":"https://api.github.com/users/maxim/gists{/gist_id}","starred_url":"https://api.github.com/users/maxim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maxim/subscriptions","organizations_url":"https://api.github.com/users/maxim/orgs","repos_url":"https://api.github.com/users/maxim/repos","events_url":"https://api.github.com/users/maxim/events{/privacy}","received_events_url":"https://api.github.com/users/maxim/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/bitwalker/exrm/labels/deployment/appups","name":"deployment/appups","color":"e7a2c3"},{"url":"https://api.github.com/repos/bitwalker/exrm/labels/deployment/general","name":"deployment/general","color":"d4c5f9"},{"url":"https://api.github.com/repos/bitwalker/exrm/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-11-10T18:14:37Z","updated_at":"2015-11-12T16:36:05Z","closed_at":null,"body":"I managed to bootstrap my production environment in a way that runner user can run the app without needing to create any directories. Basically this:\r\n\r\n```shell\r\nmkdir app/running-config app/log app/tmp\r\nchown app:app app/running-config app/log app/tmp\r\n```\r\n\r\n(app is my runner user)\r\n\r\nThis is useful because I don't want user that runs the app to be able to modify app files, that's what the deployer is for.\r\n\r\nThe problem is with the `upgrade` operation. If I run `upgrade` as the runner, it won't have permissions to unpack the new .tar.gz, but if I run it as deployer, it won't have permissions to write to the log file. Is there a way to remove unpacking responsibility from upgrade? I have a feeling that I can unpack .tar.gz manually before running `upgrade`, is that something that makes sense doing? Where exactly should the unpacked files go?"},"comment":{"url":"https://api.github.com/repos/bitwalker/exrm/issues/comments/156158828","html_url":"https://github.com/bitwalker/exrm/issues/238#issuecomment-156158828","issue_url":"https://api.github.com/repos/bitwalker/exrm/issues/238","id":156158828,"user":{"login":"maxim","id":7758,"avatar_url":"https://avatars.githubusercontent.com/u/7758?v=3","gravatar_id":"","url":"https://api.github.com/users/maxim","html_url":"https://github.com/maxim","followers_url":"https://api.github.com/users/maxim/followers","following_url":"https://api.github.com/users/maxim/following{/other_user}","gists_url":"https://api.github.com/users/maxim/gists{/gist_id}","starred_url":"https://api.github.com/users/maxim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maxim/subscriptions","organizations_url":"https://api.github.com/users/maxim/orgs","repos_url":"https://api.github.com/users/maxim/repos","events_url":"https://api.github.com/users/maxim/events{/privacy}","received_events_url":"https://api.github.com/users/maxim/received_events","type":"User","site_admin":false},"created_at":"2015-11-12T16:36:05Z","updated_at":"2015-11-12T16:36:05Z","body":"@bitwalker Hey, thanks for response! I came to the same conclusions as far as hot upgrades go in general, it's just impossible in principle. The idea behind deployer/runner separation was to just provide one extra layer of security, eliminate a possible attack vector. It's not much, but it could reduce potential damage. Vulnerability leading to remote code execution can wreck havoc regardless, but at least this way you know it didn't modify your server files, and will not survive an app restart."}}