helmwrapper issue with rootless env : try to create /.cache

[clopnis]

On OKD, when you try to spawn a service it fail with this error :

2025-11-23T17:04:19.344Z  INFO 2 --- [nio-8080-exec-9] i.g.i.helmwrapper.utils.Command          : /usr/local/bin/helm upgrade --install --history-max 0 jupyter-python-548908 ide/jupyter-python -n ai --version 2.3
.24 -f /tmp/values1551710929998758534.yaml --output json                                                                                                                                                            
Error: mkdir /.cache: permission denied                                                                                                                                                                             
2025-11-23T17:04:19.416Z ERROR 2 --- [nio-8080-exec-9] o.a.c.c.C.[.[.[.[dispatcherServlet]      : Servlet.service() for servlet [dispatcherServlet] in context with path [/api] threw exception

If /.cache is exist as extramount volume, it fail with :

2025-11-23T16:59:36.274Z  INFO 2 --- [nio-8080-exec-9] i.g.i.helmwrapper.utils.Command          : /usr/local/bin/helm upgrade --install --history-max 0 jupyter-python-268589 ide/jupyter-python -n ai --version 2.3
.24 -f /tmp/values6422124428214452133.yaml --output json                                                                                                                                                            
Error: repo ide not found                                                                                                                                                                                           
2025-11-23T16:59:36.373Z ERROR 2 --- [nio-8080-exec-9] o.a.c.c.C.[.[.[.[dispatcherServlet]      : Servlet.service() for servlet [dispatcherServlet] in context with path [/api] threw exception

I guess onyxia-api should use something like /tmp/cache instead of /.cache

[olevitt]

Hi !

Thanks for your bug report, I will take a look at it tomorrow.
I'm not familiar with OKD, is the restriction the same or similar to read-only filesystem ?

[clopnis]

by design, OKD / OpenShift is rootless. More detail here https://www.redhat.com/en/blog/pod-admission-and-sccs-version-2-in-openshift on restricted-v2 used by default

I found other issue like :

2025-11-23T17:24:06.426Z  INFO 2 --- [   scheduling-1] i.g.i.helmwrapper.utils.Command          : /usr/local/bin/helm repo add automation https://inseefrlab.github.io/helm-charts-automation
Error: mkdir /.config: permission denied

Few month ago, Onyxia was working fine on it, i'm surprised about those changes

[olevitt]

The only major change from the last months with potential to break this I can think of is the implementation of http cache to reduce the amount of package retrieval requests.
Can you test with http.cacheEnabled=false ?

[olevitt]

You can also try api tag helm-v4 which is similar to v4.10.0 but with helm v4 binary.
Also the default home seems to be /var/cache/onyxia (may have changed with base java image upgrades) resulting in the following directories being used by helm :

| Operating System | Cache Path                | Configuration Path             | Data Path               |
|------------------|---------------------------|--------------------------------|-------------------------|
| Linux            | $HOME/.cache/helm         | $HOME/.config/helm             | $HOME/.local/share/helm |

You can try to set the following api env variables to override those helm directories :

| $HELM_CACHE_HOME                   | set an alternative location for storing cached files.                                                      |
| $HELM_CONFIG_HOME                  | set an alternative location for storing Helm configuration.                                                |
| $HELM_DATA_HOME                    | set an alternative location for storing Helm data. 

I just checked SSPCloud's onyxia-api pods (currently running helm-v4 images) and they don't have any /.cache nor /app/.cache but they do have helm cache on /var/cache/onyxia/.cache (which is $HOME/.cache )

[olevitt]

btw I just released v4.11.0 which now includes helm v4.
Please try this version and report if you still have issues