Help: permission denied while starting process up

[AndreFavotto]

Hello fellow Brazilians!

I am trying to use epics-in-docker to run a simple IOC with motorSim. If I understand correctly, I should be able to do it with the following compose file:

services:
  motorSim:
    image: motorsim
    build:
      context: ./
      dockerfile: ./epics-in-docker/Dockerfile
      target: no-build
      labels:
        org.opencontainers.image.source: https://github.com/cnpem/epics-in-docker
      args:
        APP_DIRS: /opt/epics/modules/motor/modules/motorMotorSim/iocs/motorSimIOC
        RUNDIR: /opt/epics/modules/motor/modules/motorMotorSim/iocs/motorSimIOC/iocBoot/iocMotorSim

However, after running it, I get the classic permission denied error:

$ docker compose up
[+] Running 1/1
 ✔ Container examples-motorSim-1  Created                                                                                                                                                         0.0s 
Attaching to motorSim-1
motorSim-1  | procServ: Error - Please change permissions on ./st.cmd to at least ---x--x--x
motorSim-1  | procServ is not able to continue without execute permission
motorSim-1 exited with code 0

This made me think a chmod +x st.cmd was missing. Inspecting the container (overriding the entrypoint with tail -f /dev/null), I see the following:

root@4d980efc35cd:/opt/epics/modules/motor/modules/motorMotorSim/iocs/motorSimIOC/iocBoot/iocMotorSim# ls -la
total 44
drwxr-xr-x 1 root root 4096 Jul 18  2025 .
drwxr-xr-x 1 root root 4096 Jul 18  2025 ..
-rwxr-xr-x 1 root root  190 Jul 18  2025 Makefile
-rw-r--r-- 1 root root  776 Jul 18  2025 README
lrwxrwxrwx 1 root root   23 Mar 19 23:12 entrypoint -> /usr/local/bin/lnls-run
-rw-r--r-- 1 root root  717 Jul 18  2025 motorSim.cmd
-rw-r--r-- 1 root root  196 Jul 18  2025 motorSim.iocsh
-rw-r--r-- 1 root root 1493 Jul 18  2025 motorSim.substitutions
-rw-r--r-- 1 root root  478 Jul 18  2025 st.cmd
-rw-r--r-- 1 root root  821 Jul 18  2025 st.cmd.Vx
-rwxr-xr-x 1 root root   94 Jul 18  2025 start_medm
root@4d980efc35cd:/opt/epics/modules/motor/modules/motorMotorSim/iocs/motorSimIOC/iocBoot/iocMotorSim# lnls-run ./st.cmd
procServ: Error - Please change permissions on ./st.cmd to at least ---x--x--x
procServ is not able to continue without execute permission
root@4d980efc35cd:/opt/epics/modules/motor/modules/motorMotorSim/iocs/motorSimIOC/iocBoot/iocMotorSim# chmod +x *.cmd
root@4d980efc35cd:/opt/epics/modules/motor/modules/motorMotorSim/iocs/motorSimIOC/iocBoot/iocMotorSim# lnls-run ./st.cmd
@@@ Restarting child "./st.cmd"
@@@ The PID of new child "./st.cmd" is: 21
@@@ @@@ @@@ @@@ @@@
./st.cmd: 4: cannot open envPaths: No such file
./st.cmd: 6: Syntax error: word unexpected (expecting ")")

@@@ @@@ @@@ @@@ @@@
@@@ Received a sigChild for process 21. Normal exit status = 2

So even with the correct permissions, something seems off there.

I also tried running the provided docker-compose-motorpigcs2.yml, that I expected to work out-of-the-box, but the same happened.

Am I missing something?

[ericonr]

Hi @AndreFavotto, thank you for trying out our project!

I think this is a matter of missing documentation on our part; you can take a look at the "Container Orchestration" section of our ICALEPCS article for some discussion about deploying these containers.

Addressing your attempts:

For motorSim, you are using the no-build target, which is intended to be internal, and it's exporting motorSimIOC, whose startup script is not adequate for being launched directly: it's missing a shebang and it's not executable. This means executing it gets it launched by your shell, causing those syntax errors. Furthermore, this IOC wasn't fully built as part of the container build process, so even though the IOC executable is available under /opt/epics/modules/motor/bin/linux-x86_64, envPaths isn't.

With motorpigcs2, which is only used in our beamlines, the expected workflow involves our internal iocs script, which launches the container and runs an external startup script that was mounted into the container. This startup script is responsible for holding all information about bringing up an IOC using the binary and databases (and possibly startup script snippets) provided by the container image (example here), which means there's no need for a ready-to-run image (or almost ready-to-run one) for this IOC. If you were to use the container image you created for motorSim, I would imagine a similar workflow for it!

(Your issue has prompted internal discussion into providing a ready-to-use motorSim image, though)

I don't think we have many ready-to-use images, since for the most part you need at least a device IP and PV prefix; however, some of the images we've built with epics-in-docker include a working startup script, and properly starting an IOC only requires launching the container with appropriate environment variables. These are used in the accelerator and in some experimental setups.

Since a lot of beamline deployments require customized scripts, we haven't put a lot of focus into preparing ready-to-run images there, and the current orchestration script wouldn't even support such a use case.

Further examples of IOCs we expect to be used in a beamline context, even if they have "working" startup scripts (since device information is hardcoded, they work better as guides):

• https://github.com/cnpem/ad-aravis-epics-ioc
• https://github.com/cnpem/pmac-epics-ioc
• https://github.com/cnpem/lakeshore-epics-ioc

Some examples of (almost) ready-to-run IOCs:

• https://github.com/cnpem/ad-sim-epics-ioc (has a default prefix, so can be launched as-is)
• https://github.com/lnls-dig/sofb-mon (only need to pass the desired startup script as the container command)
• https://github.com/lnls-dig/fofb-mon (fully ready-to-run)
• https://github.com/lnls-dig/ipmi-mgr-epics-ioc/tree/master (launching requires a pair of environment variables)
• https://github.com/lnls-dig/sinap-timing-epics-ioc (older IOC; can be started by passing multiple environment variables and choosing the appropriate startup script, but is currently started by a custom launcher script)

[AndreFavotto]

Hi Érico, thanks for the thorough response!

Honestly re-checking now, it's partly my mistake in not noticing that this shouldn't work. I overlooked install_motor.sh and by seeing motorSim mentioned I assumed it was installed in the base image. I now actually read the script (...) and noticed it is never installed as the others, as you said.

In the end I did not expect the motorpigcs2 IOC to actually work, given that I don't even have the hardware or passed the PV prefixes as you said - but indeed, this section of the README led me to believe I should be able to get past the st.cmd part and probably hang later while opening the communication given the lack of env variables.

(Your issue has prompted internal discussion into providing a ready-to-use motorSim image, though)

Nice to hear that, I'll check for when it's made available :)

For unsolicited usage context, I plan to try using epics-in-docker for WEISS demo IOCs for the next release coming soon. The MVP demo currently connects to a simple containerized IOC running in the server, but I plan to add others for demoing widgets (ADSim, motorSim, maybe others). If tests go well, epics-in-docker will help avoiding those ~3GB images per service :)

I will check the links and references you provided and get back to you. Thanks again!

[AndreFavotto]

I was able to make it work based on the provided examples, so I will close this issue now.

I would consider a good improvement to include some of these examples in the documentation. Looking at one or two really clarified how the tool is supposed to be used.

[ericonr]

I will reopen this to track adding such documentation to the project!

It should also include possibly useful info, such as the existing container labels (and new ones, like I'm adding in #165 )