NotPermitted

NotPermitted

Error message

containers.view privilege is required to pull from container

What it means

Error "containers.view privilege is required to pull from container" thrown in vxcontrol/pentagi.

Source

Thrown at backend/pkg/server/services/flow_files.go:616

// @Router /flows/{flowID}/files/pull [post]
func (s *FlowFileService) PullFlowFiles(c *gin.Context) {
	flowID, err := parseFlowIDParam(c)
	if err != nil {
		logger.FromContext(c).WithError(err).Error("error parsing flow id")
		response.Error(c, response.ErrFlowFilesInvalidRequest, err)
		return
	}

	flow, err := s.getFlow(c, flowID, true)
	if err != nil {
		s.handleFlowLookupError(c, flowID, err)
		return
	}

	// Container interaction additionally requires containers.view (or containers.admin).
	privs := c.GetStringSlice("prm")
	if !slices.Contains(privs, "containers.admin") && !slices.Contains(privs, "containers.view") {
		response.Error(c, response.ErrNotPermitted, fmt.Errorf("containers.view privilege is required to pull from container"))
		return
	}

	var req models.PullFlowFilesRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		logger.FromContext(c).WithError(err).WithField("flow_id", flowID).Error("error parsing pull request")
		response.Error(c, response.ErrFlowFilesInvalidRequest, err)
		return
	}

	// Collect container paths from both req.Path and req.Paths, then deduplicate
	// with coverage semantics using flowfiles.DeduplicatePaths.
	// Container paths (/etc/nginx.conf) are normalised to their relative form
	// (etc/nginx.conf) so that DeduplicatePaths can apply ancestor coverage:
	// /etc/ covers /etc/nginx.conf → only /etc/ is pulled.
	rawPaths := req.Paths
	if strings.TrimSpace(req.Path) != "" {
		rawPaths = append(rawPaths, req.Path)

View on GitHub (pinned to ea665308ba)

When it happens

Trigger: Thrown at backend/pkg/server/services/flow_files.go:616 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/4e60aac1282965d6. Report an issue: GitHub.