[Bug]: Permission denied: schema.prisma

[ishaan-jaff]

What happened?

Non root image keeps on raising this error when starting up or applying DB Migrations. I've found that this error is just a warning from prisma as it looks like the pod starts up, connects to the DB and serves requests

Relevant log output

2025-08-26 17:40:14,850 - litellm_proxy_extras - INFO - Running prisma migrate deploy
2025-08-26 17:40:17,928 - litellm_proxy_extras - INFO - prisma migrate deploy stdout: Prisma schema loaded from schema.prisma
Datasource "client": PostgreSQL database "litellm", schema "public" at "litellm-elelem.civhtgrwvpzc.us-east-1.rds.amazonaws.com"
31 migrations found in prisma/migrations
No pending migrations to apply.
2025-08-26 17:40:17,928 - litellm_proxy_extras - INFO - prisma migrate deploy completed
17:40:23 - LiteLLM Proxy:ERROR: prisma_migration.py:26 - 'prisma generate' stderr: Error:
Traceback (most recent call last):
LiteLLM: Setup complete. Skipping server startup as requested.
  File "/usr/local/lib/python3.13/site-packages/prisma/generator/generator.py", line 112, in run
    self._on_request(request)
    ~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/prisma/generator/generator.py", line 170, in _on_request
    self.generate(data)
    ~~~~~~~~~~~~~^^^^^^
  File "/usr/local/lib/python3.13/site-packages/prisma/generator/generator.py", line 255, in generate
    shutil.copy(data.schema_path, packaged_schema)
    ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/shutil.py", line 428, in copy
    copyfile(src, dst, follow_symlinks=follow_symlinks)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/shutil.py", line 262, in copyfile
    with open(dst, 'wb') as fdst:
         ~~~~^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/usr/local/lib/python3.13/site-packages/prisma/schema.prisma'

Are you a ML Ops Team?

No

What LiteLLM version are you on ?

v1.75.0

Twitter / LinkedIn details

No response

[ishaan-jaff]

End state should be we can start non root images without this error trace

[Ithanil]

Unable to reproduce on vanilla litellm/litellm-non_root:v1.75.8-stable. Startup log using a fresh PostgreSQL database below:

2025-08-28 06:10:25,016 - litellm_proxy_extras - INFO - Running prisma migrate deploy
2025-08-28 06:10:28,424 - litellm_proxy_extras - INFO - prisma migrate deploy stdout: Prisma schema loaded from schema.prisma
Datasource "client": PostgreSQL database "litellm", schema "public" at "db:5432"

34 migrations found in prisma/migrations

Applying migration `20250326162113_baseline`
Applying migration `20250326171002_add_daily_user_table`
Applying migration `20250327180120_add_api_requests_to_daily_user_table`
Applying migration `20250329084805_new_cron_job_table`
Applying migration `20250331215456_track_success_and_failed_requests_daily_agg_table`
Applying migration `20250411215431_add_managed_file_table`
Applying migration `20250412081753_team_member_permissions`
Applying migration `20250415151647_add_cache_read_write_tokens_daily_spend_transactions`
Applying migration `20250415191926_add_daily_team_table`
Applying migration `20250416115320_add_tag_table_to_db`
Applying migration `20250416151339_drop_tag_uniqueness_requirement`
Applying migration `20250416185146_add_allowed_routes_litellm_verification_token`
Applying migration `20250425182129_add_session_id`
Applying migration `20250430193429_add_managed_vector_stores`
Applying migration `20250507161526_add_mcp_table_to_db`
Applying migration `20250507161527_add_health_check_fields_to_mcp_servers`
Applying migration `20250507184818_add_mcp_key_team_permission_mgmt`
Applying migration `20250508072103_add_status_to_spendlogs`
Applying migration `20250509141545_use_big_int_for_daily_spend_tables`
Applying migration `20250510142544_add_session_id_index_spend_logs`
Applying migration `20250514142245_add_guardrails_table`
Applying migration `20250522223020_managed_object_table`
Applying migration `20250526154401_allow_null_entity_id`
Applying migration `20250528185438_add_vector_stores_to_object_permissions`
Applying migration `20250603210143_cascade_budget_changes`
Applying migration `20250618225828_add_health_check_table`
Applying migration `20250625145206_cascade_budget_and_loosen_managed_file_json`
Applying migration `20250625213625_add_status_to_managed_object_table`
Applying migration `20250707212517_add_mcp_info_column_mcp_servers`
Applying migration `20250707230009_add_mcp_namespaced_tool_name`
Applying migration `20250711220620_add_stdio_mcp`
Applying migration `20250718125714_add_litellm_params_to_vector_stores`
Applying migration `20250802162330_prompt_table`
Applying migration `20250806095134_rename_alias_to_server_name_mcp_table`

The following migrations have been applied:

migrations/
  └─ 20250326162113_baseline/
    └─ migration.sql
  └─ 20250326171002_add_daily_user_table/
    └─ migration.sql
  └─ 20250327180120_add_api_requests_to_daily_user_table/
    └─ migration.sql
  └─ 20250329084805_new_cron_job_table/
    └─ migration.sql
  └─ 20250331215456_track_success_and_failed_requests_daily_agg_table/
    └─ migration.sql
  └─ 20250411215431_add_managed_file_table/
    └─ migration.sql
  └─ 20250412081753_team_member_permissions/
    └─ migration.sql
  └─ 20250415151647_add_cache_read_write_tokens_daily_spend_transactions/
    └─ migration.sql
  └─ 20250415191926_add_daily_team_table/
    └─ migration.sql
  └─ 20250416115320_add_tag_table_to_db/
    └─ migration.sql
  └─ 20250416151339_drop_tag_uniqueness_requirement/
    └─ migration.sql
  └─ 20250416185146_add_allowed_routes_litellm_verification_token/
    └─ migration.sql
  └─ 20250425182129_add_session_id/
    └─ migration.sql
  └─ 20250430193429_add_managed_vector_stores/
    └─ migration.sql
  └─ 20250507161526_add_mcp_table_to_db/
    └─ migration.sql
  └─ 20250507161527_add_health_check_fields_to_mcp_servers/
    └─ migration.sql
  └─ 20250507184818_add_mcp_key_team_permission_mgmt/
    └─ migration.sql
  └─ 20250508072103_add_status_to_spendlogs/
    └─ migration.sql
  └─ 20250509141545_use_big_int_for_daily_spend_tables/
    └─ migration.sql
  └─ 20250510142544_add_session_id_index_spend_logs/
    └─ migration.sql
  └─ 20250514142245_add_guardrails_table/
    └─ migration.sql
  └─ 20250522223020_managed_object_table/
    └─ migration.sql
  └─ 20250526154401_allow_null_entity_id/
    └─ migration.sql
  └─ 20250528185438_add_vector_stores_to_object_permissions/
    └─ migration.sql
  └─ 20250603210143_cascade_budget_changes/
    └─ migration.sql
  └─ 20250618225828_add_health_check_table/
    └─ migration.sql
  └─ 20250625145206_cascade_budget_and_loosen_managed_file_json/
    └─ migration.sql
  └─ 20250625213625_add_status_to_managed_object_table/
    └─ migration.sql
  └─ 20250707212517_add_mcp_info_column_mcp_servers/
    └─ migration.sql
  └─ 20250707230009_add_mcp_namespaced_tool_name/
    └─ migration.sql
  └─ 20250711220620_add_stdio_mcp/
    └─ migration.sql
  └─ 20250718125714_add_litellm_params_to_vector_stores/
    └─ migration.sql
  └─ 20250802162330_prompt_table/
    └─ migration.sql
  └─ 20250806095134_rename_alias_to_server_name_mcp_table/
    └─ migration.sql
      
All migrations have been successfully applied.

2025-08-28 06:10:28,430 - litellm_proxy_extras - INFO - prisma migrate deploy completed
INFO:     Started server process [1]
INFO:     Waiting for application startup.
06:10:28 - LiteLLM Proxy:DEBUG: proxy_server.py:557 - litellm.proxy.proxy_server.py::startup() - CHECKING PREMIUM USER - False
06:10:28 - LiteLLM Proxy:DEBUG: litellm_license.py:102 - litellm.proxy.auth.litellm_license.py::is_premium() - ENTERING 'IS_PREMIUM' - LiteLLM License=None
06:10:28 - LiteLLM Proxy:DEBUG: litellm_license.py:111 - litellm.proxy.auth.litellm_license.py::is_premium() - Updated 'self.license_str' - None
06:10:28 - LiteLLM Proxy:DEBUG: proxy_server.py:570 - worker_config: {"model": null, "alias": null, "api_base": null, "api_version": "2024-07-01-preview", "debug": false, "detailed_debug": true, "temperature": null, "max_tokens": null, "request_timeout": null, "max_budget": null, "telemetry": true, "drop_params": false, "add_function_to_prompt": false, "headers": null, "save": false, "config": "/app/config.yaml", "use_queue": false}

   ██╗     ██╗████████╗███████╗██╗     ██╗     ███╗   ███╗
   ██║     ██║╚══██╔══╝██╔════╝██║     ██║     ████╗ ████║
   ██║     ██║   ██║   █████╗  ██║     ██║     ██╔████╔██║
   ██║     ██║   ██║   ██╔══╝  ██║     ██║     ██║╚██╔╝██║
   ███████╗██║   ██║   ███████╗███████╗███████╗██║ ╚═╝ ██║
   ╚══════╝╚═╝   ╚═╝   ╚══════╝╚══════╝╚══════╝╚═╝     ╚═╝


.....

INFO:     Application startup complete.
INFO:     Uvicorn running on http://0.0.0.0:4000 (Press CTRL+C to quit)

Which specific tag where you using, one of the dev/nightly 1.75.0? Given the above logs I think the issue is not present anymore.

schema.prisma is owned by nobody:nobody:

bash-5.3$ ls -la /usr/lib/python3.13/site-packages/prisma/schema.prisma 
-rw-r--r--    1 nobody   nobody       21129 Aug 25 14:55 /usr/lib/python3.13/site-packages/prisma/schema.prisma