Tabby on docker panics with permission denied

[martinellison]

When I try running Tabby with docker, I get the following error

docker run -it --gpus all   -p 8080:8080 -v $HOME/.tabby:/data   registry.tabbyml.com/tabbyml/tabby   serve --model StarCoder-1B --chat-model Qwen2-1.5B-Instruct --device cuda
The application panicked (crashed).
Message:  called `Result::unwrap()` on an `Err` value: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }
Location: crates/tabby/src/main.rs:68

I have nvidia-container-toolkit.x86_64 1.17.3-1 installed and I have restarted the docker engine.

[martinellison]

I have added myself to the docker group, rebooted, started the docker daemon, run the standard command (as above), run it again with sudo,,,, I am still getting the "permission denied" error.

Please advise.

[wsxiaoys]

Hi - could you check the permission settings of your $HOME/.tabby directory? e.g ls -ld ~/.tabby

[martinellison]

edit: setting SELinux to permissive 'fixes' the issue, but of course this is not a good idea. I have managed now to set up a Tabby session in Visual Studio Code. Previous comments follow...

I have done chmod -R a+wrx ~/.tabby/, which has set the permissions on the ~/.tabby directory recursively to read write and execute for all users, and I still get the same error on running tabby:

> docker run -it --gpus all   -p 8080:8080 -v $HOME/.tabby:/data   registry.tabbyml.com/tabbyml/tabby   serve --model StarCoder-1B --chat-model Qwen2-1.5B-Instruct --device cuda
The application panicked (crashed).
Message:  called `Result::unwrap()` on an `Err` value: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }
Location: crates/tabby/src/main.rs:68

I got an SELinux message, so I did ausearch -c 'tabby' --raw | audit2allow -M my-tabby as recommended, but this did not fix anything.

The SELinux error seems to be: type=AVC msg=audit(1734251245.627:786): avc: denied { write } for pid=18913 comm="tabby" name=".tabby" dev="sda2" ino=32870114 scontext=system_u:system_r:container_t:s0:c83,c800 tcontext=system_u:object_r:user_home_t:s0 tclass=dir permissive=0.

[martinellison]

I'm now trying to fix the permission errors without disabling SELinux. I've tried

sudo ausearch -c 'tabby' --raw > /tmp/selinux.txt
sudo cat /tmp/selinux.txt | audit2allow -M my-tabby
sudo semodule -i my-tabby.pp

which is what SELinux is advising, but it does not fix the problem.

I'm still getting

The application panicked (crashed).
Message:  Failed to fetch model 'StarCoder-7B' due to 'Permission denied (os error 13)'
Location: /root/workspace/crates/tabby-download/src/lib.rs:195

I get the same error if I try the example code in https://tabby.tabbyml.com/docs/quick-start/installation/docker/ (i.e. using StarCoder-1B). Also the same error with sudo.

I have 'relabelled' all my files in SELinux. This should fix any permissioning problems (of access to local files), but it did not fix the problem (as described above). But for all I know the 'permissioning' could be access to a web site.

What would help from Tabby's side would be if Tabby could give a bit more information about the error (like permission to access what?).

[martinellison]

edit: nothing works except setenforce 0.

Messages like the following seem to be a result of trying to load too large a model:

⠦  1700.116 s	Starting...2024-12-19T02:14:37.349804Z  WARN llama_cpp_server::supervisor: crates/llama-cpp-server/src/supervisor.rs:98: llama-server <chat> exited with status code 1, args: ...

I have done sudo audit2allow -b -M tabby3 and sudo semodule -i tabby3.pp and that seems to have placated SELinux and allowed Tabby to run.

[martinellison]

The only thing that works for me is setenforce 0.