langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 12:05:30 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

When running Alibaba's OCR sdk in the workflow, an error message appears: "error: operation not permitted" #7306

New Issue
Closed
opened 2026-02-21 18:19:55 -05:00 by yindo · 5 comments
yindo commented 2026-02-21 18:19:55 -05:00
Owner
Copy Link
Copy Source

Originally created by @xuemusi on GitHub (Dec 19, 2024).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

Version 0.14.1

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

  1. Add Alibaba and Huawei ocs sdk
    alibabacloud_ocr_api20210707==3.1.2
    huaweicloudsdkcore==3.1.127
    huaweicloudsdkocr==3.1.127
    image
    image

  2. Run the following code

import json
from alibabacloud_ocr_api20210707.client import Client as ocr_api20210707Client
from alibabacloud_tea_openapi import models as open_api_models
from alibabacloud_ocr_api20210707 import models as ocr_api_20210707_models
from alibabacloud_tea_util import models as util_models
from alibabacloud_tea_util.client import Client as UtilClient

Prompt error: “error: operation not permitted”
image

  1. I run python ocr.py directly in the container and it works, but an error message appears in the workflow.
    image

✔️ Expected Behavior

I hope to execute simple python code in the workflow, such as calling api and executing sdk.

❌ Actual Behavior

Unable to run sdk.

Originally created by @xuemusi on GitHub (Dec 19, 2024). ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version Version 0.14.1 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce 1. Add Alibaba and Huawei ocs sdk alibabacloud_ocr_api20210707==3.1.2 huaweicloudsdkcore==3.1.127 huaweicloudsdkocr==3.1.127 <img width="804" alt="image" src="https://github.com/user-attachments/assets/0279daba-d0b1-4d16-ae7c-b93fbed8ffe9" /> <img width="492" alt="image" src="https://github.com/user-attachments/assets/d8816f8b-8261-44a1-b023-45dfbb8a3128" /> 2. Run the following code ``` import json from alibabacloud_ocr_api20210707.client import Client as ocr_api20210707Client from alibabacloud_tea_openapi import models as open_api_models from alibabacloud_ocr_api20210707 import models as ocr_api_20210707_models from alibabacloud_tea_util import models as util_models from alibabacloud_tea_util.client import Client as UtilClient ``` Prompt error: “error: operation not permitted” <img width="392" alt="image" src="https://github.com/user-attachments/assets/4be5527b-3686-42ef-97ba-9692a22c6b5e" /> 3. I run python ocr.py directly in the container and it works, but an error message appears in the workflow. <img width="969" alt="image" src="https://github.com/user-attachments/assets/000d0569-ea09-47e1-9a81-f551ee1e040e" /> ### ✔️ Expected Behavior I hope to execute simple python code in the workflow, such as calling api and executing sdk. ### ❌ Actual Behavior Unable to run sdk.
yindo added the 🐞 bugstale🌊 feat:workflow labels 2026-02-21 18:19:55 -05:00
yindo closed this issue 2026-02-21 18:19:55 -05:00
yindo commented 2026-02-21 18:19:56 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 19, 2024):

Hey @xuemusi! 👋 I'm here to help you with any bugs, questions, or contributions you have for Dify. Let's squash those bugs together!

The error message "operation not permitted" when running the Alibaba OCR SDK within a Dify workflow is likely due to the security restrictions of the DifySandbox. This sandbox environment enforces strict security measures, including a whitelist policy for system calls and isolated file system access, which might be preventing certain operations required by the SDK [1][2].

To resolve this issue, you can try the following steps:

  1. Check Permissions: Ensure that the operations required by the Alibaba OCR SDK are allowed within the DifySandbox. You might need to adjust the configuration to permit specific actions if they are currently restricted.

  2. Network Configuration: Verify that the network settings within the sandbox allow the necessary API calls. Dify uses network isolation strategies, and you may need to configure the ssrf_proxy service or Egress policies to allow the SDK's network requests [2][3].

  3. Error Handling: Implement error handling in your workflow to capture and manage any exceptions that occur due to these restrictions. This can help in identifying specific operations that are not permitted and adjusting your code or configuration accordingly [4].

If these steps do not resolve the issue, you may need to review the specific system calls and network requests made by the SDK to ensure they align with the sandbox's security policies.

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Other

@dosubot[bot] commented on GitHub (Dec 19, 2024): <!-- Greeting --> Hey @xuemusi! 👋 I'm here to help you with any bugs, questions, or contributions you have for Dify. Let's squash those bugs together! <!-- Answer --> The error message "operation not permitted" when running the Alibaba OCR SDK within a Dify workflow is likely due to the security restrictions of the `DifySandbox`. This sandbox environment enforces strict security measures, including a whitelist policy for system calls and isolated file system access, which might be preventing certain operations required by the SDK <sup>[[1]](https://github.com/langgenius/dify-docs/blob/main/jp/development/backend/sandbox/README.md)</sup><sup>[[2]](https://github.com/langgenius/dify-docs/blob/main/en/development/backend/sandbox/README.md)</sup>. To resolve this issue, you can try the following steps: 1. **Check Permissions**: Ensure that the operations required by the Alibaba OCR SDK are allowed within the DifySandbox. You might need to adjust the configuration to permit specific actions if they are currently restricted. 2. **Network Configuration**: Verify that the network settings within the sandbox allow the necessary API calls. Dify uses network isolation strategies, and you may need to configure the `ssrf_proxy` service or Egress policies to allow the SDK's network requests <sup>[[2]](https://github.com/langgenius/dify-docs/blob/main/en/development/backend/sandbox/README.md)</sup><sup>[[3]](https://github.com/langgenius/dify/blob/main/docker/docker-compose.middleware.yaml)</sup>. 3. **Error Handling**: Implement error handling in your workflow to capture and manage any exceptions that occur due to these restrictions. This can help in identifying specific operations that are not permitted and adjusting your code or configuration accordingly <sup>[[4]](https://github.com/langgenius/dify-docs/blob/main/en/guides/workflow/node/code.md)</sup>. If these steps do not resolve the issue, you may need to review the specific system calls and network requests made by the SDK to ensure they align with the sandbox's security policies. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/e17b30a2-7242-4721-b086-b9b5a238335f?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/e17b30a2-7242-4721-b086-b9b5a238335f?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/e17b30a2-7242-4721-b086-b9b5a238335f?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/e17b30a2-7242-4721-b086-b9b5a238335f?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/e17b30a2-7242-4721-b086-b9b5a238335f?feedback_type=hallucination) | [Other](https://app.dosu.dev/response-feedback/e17b30a2-7242-4721-b086-b9b5a238335f?feedback_type=other)</sup>
yindo commented 2026-02-21 18:19:56 -05:00
Author
Owner
Copy Link
Copy Source

@yihong0618 commented on GitHub (Dec 19, 2024):

you can refer the FAQ from https://github.com/langgenius/dify-sandbox/blob/main/FAQ.md

@yihong0618 commented on GitHub (Dec 19, 2024): you can refer the FAQ from https://github.com/langgenius/dify-sandbox/blob/main/FAQ.md
yindo commented 2026-02-21 18:19:56 -05:00
Author
Owner
Copy Link
Copy Source

@svcvit commented on GitHub (Dec 19, 2024):

You can try https://github.com/svcvit/dify-sandbox-py

@svcvit commented on GitHub (Dec 19, 2024): You can try https://github.com/svcvit/dify-sandbox-py
yindo commented 2026-02-21 18:19:56 -05:00
Author
Owner
Copy Link
Copy Source

@xuemusi commented on GitHub (Dec 25, 2024):

https://github.com/svcvit/dify-sandbox-py
Can run 。thanks @svcvit

@xuemusi commented on GitHub (Dec 25, 2024): https://github.com/svcvit/dify-sandbox-py Can run 。thanks @svcvit
yindo commented 2026-02-21 18:19:56 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jan 25, 2025):

Hi, @xuemusi. I'm Dosu, and I'm helping the Dify team manage their backlog and am marking this issue as stale.

Issue Summary

  • You encountered an "operation not permitted" error with Alibaba's OCR SDK in a Docker environment using Dify v0.14.1.
  • I suggested checking permissions and network configurations.
  • @svcvit recommended using dify-sandbox-py, which you confirmed resolved the issue.

Next Steps

  • Please confirm if this issue is still relevant to the latest version of Dify. If so, you can keep the discussion open by commenting here.
  • If there are no further updates, this issue will be automatically closed in 15 days.

Thank you for your understanding and contribution!

@dosubot[bot] commented on GitHub (Jan 25, 2025): Hi, @xuemusi. I'm [Dosu](https://dosu.dev), and I'm helping the Dify team manage their backlog and am marking this issue as stale. **Issue Summary** - You encountered an "operation not permitted" error with Alibaba's OCR SDK in a Docker environment using Dify v0.14.1. - I suggested checking permissions and network configurations. - @svcvit recommended using `dify-sandbox-py`, which you confirmed resolved the issue. **Next Steps** - Please confirm if this issue is still relevant to the latest version of Dify. If so, you can keep the discussion open by commenting here. - If there are no further updates, this issue will be automatically closed in 15 days. Thank you for your understanding and contribution!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label stale 🌊 feat:workflow 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#7306
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?