From 90456a7a5ea03ccfa905f7db983012850bcbbe0d Mon Sep 17 00:00:00 2001
From: Daniel Barranquero <danielbo2001@gmail.com>
Date: Wed, 4 Feb 2026 08:27:47 +0100
Subject: [PATCH] fix: docker volume permission error

---
 .github/workflows/ui-e2e-tests-v2.yml | 9 +++------
 .github/workflows/ui-e2e-tests.yml    | 2 --
 api/CHANGELOG.md                      | 1 +
 docker-compose-dev.yml                | 5 ++++-
 docker-compose.yml                    | 7 +++++--
 5 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index 8de1e9d9fa..9a234dbb2c 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -25,7 +25,7 @@ jobs:
   e2e-tests:
     needs: impact-analysis
     if: |
-      github.repository == 'prowler-cloud/prowler' && 
+      github.repository == 'prowler-cloud/prowler' &&
       (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
     runs-on: ubuntu-latest
     env:
@@ -99,9 +99,6 @@ jobs:
           yq -i '.networks.kind.external = true' docker-compose.yml
           yq -i '.services.worker.networks = ["kind","default"]' docker-compose.yml
 
-      - name: Fix API data directory permissions
-        run: docker run --rm -v $(pwd)/_data/api:/data alpine chown -R 1000:1000 /data
-
       - name: Add AWS credentials for testing
         run: |
           echo "AWS_ACCESS_KEY_ID=${{ secrets.E2E_AWS_PROVIDER_ACCESS_KEY }}" >> .env
@@ -222,8 +219,8 @@ jobs:
   skip-e2e:
     needs: impact-analysis
     if: |
-      github.repository == 'prowler-cloud/prowler' && 
-      needs.impact-analysis.outputs.has-ui-e2e != 'true' && 
+      github.repository == 'prowler-cloud/prowler' &&
+      needs.impact-analysis.outputs.has-ui-e2e != 'true' &&
       needs.impact-analysis.outputs.run-all != 'true'
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/ui-e2e-tests.yml b/.github/workflows/ui-e2e-tests.yml
index 6dcc2f73af..fc14d6112b 100644
--- a/.github/workflows/ui-e2e-tests.yml
+++ b/.github/workflows/ui-e2e-tests.yml
@@ -71,8 +71,6 @@ jobs:
           yq -i '.networks.kind.external = true' docker-compose.yml
           # Add network kind to worker service and default network too
           yq -i '.services.worker.networks = ["kind","default"]' docker-compose.yml
-      - name: Fix API data directory permissions
-        run: docker run --rm -v $(pwd)/_data/api:/data alpine chown -R 1000:1000 /data
       - name: Add AWS credentials for testing AWS SDK Default Adding Provider
         run: |
           echo "Adding AWS credentials for testing AWS SDK Default Adding Provider..."
diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index be9b353ce7..91c59b0dc7 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -15,6 +15,7 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ### 🔄 Changed
 
+- **BREAKING**: Changed API configuration storage from bind mount to Docker named volume to fix permission errors on fresh deployments. Existing JWT keys will be regenerated on upgrade, invalidating active sessions. Users will need to re-authenticate after updating. [(#XXXX)](https://github.com/prowler-cloud/prowler/pull/XXXX)
 - Lazy-load providers and compliance data to reduce API/worker startup memory and time [(#9857)](https://github.com/prowler-cloud/prowler/pull/9857)
 - Remove unused indexes [(#9904)](https://github.com/prowler-cloud/prowler/pull/9904)
 
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index b5de1af83f..1274a14e10 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -18,7 +18,7 @@ services:
       - ./api/src/backend:/home/prowler/backend
       - ./api/pyproject.toml:/home/prowler/pyproject.toml
       - ./api/docker-entrypoint.sh:/home/prowler/docker-entrypoint.sh
-      - ./_data/api:/home/prowler/.config/prowler-api
+      - api-config:/home/prowler/.config/prowler-api
       - outputs:/tmp/prowler_api_output
     depends_on:
       postgres:
@@ -136,6 +136,7 @@ services:
       - ./api/src/backend:/home/prowler/backend
       - ./api/pyproject.toml:/home/prowler/pyproject.toml
       - ./api/docker-entrypoint.sh:/home/prowler/docker-entrypoint.sh
+      - api-config:/home/prowler/.config/prowler-api
       - outputs:/tmp/prowler_api_output
     depends_on:
       valkey:
@@ -197,5 +198,7 @@ services:
       retries: 3
 
 volumes:
+  api-config:
+    driver: local
   outputs:
     driver: local
diff --git a/docker-compose.yml b/docker-compose.yml
index 992a753ac0..90c8ec764a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,7 +14,7 @@ services:
     ports:
       - "${DJANGO_PORT:-8080}:${DJANGO_PORT:-8080}"
     volumes:
-      - ./_data/api:/home/prowler/.config/prowler-api
+      - api-config:/home/prowler/.config/prowler-api
       - output:/tmp/prowler_api_output
     depends_on:
       postgres:
@@ -111,7 +111,8 @@ services:
       - path: .env
         required: false
     volumes:
-      - "output:/tmp/prowler_api_output"
+      - api-config:/home/prowler/.config/prowler-api
+      - output:/tmp/prowler_api_output
     depends_on:
       valkey:
         condition: service_healthy
@@ -152,5 +153,7 @@ services:
       retries: 3
 
 volumes:
+  api-config:
+    driver: local
   output:
     driver: local