Azure blob storage with read-only container still write file to cache causing permission errors

What is the problem you are having with rclone?

I am using rclone to mount Azure Blob Storage as a drive in Windows. I am using Azure AD auth which is working fine since I started using the config from az cli - before that I could not figure out any config that would persuade rclone to login and get a token.

However I have a problem with a readonly container. The user has only readonly permissions to the container, but rclone still allows the user to write a file and then stores it in the vfs cache. The consequence is permission errors; this is also confusing for the user.

Is it possible to tell rclone that this container is readonly?

The idea is to have several containers showing as directories in Explorer so I don't want the entire mount to be readonly.

Run the command 'rclone version' and share the full output of the command.

rclone v1.63.0

  • os/version: Microsoft Windows 11 Pro 22H2 (64 bit)
  • os/kernel: 10.0.22621.1848 (x86_64)
  • os/type: windows
  • os/arch: amd64
  • go/version: go1.20.5
  • go/linking: static
  • go/tags: cmount

Which cloud storage system are you using? (eg Google Drive)

Azure Blob Storage

The command you were trying to run (eg rclone copy /tmp remote:tmp)

rclone mount AzureBlob: T: --vfs-cache-mode full

The rclone config contents with secrets removed.

[AzureBlob]
type = azureblob
account = myaccount
env_auth = true

Example output:

The service rclone has been started.
2023/07/07 10:58:17 ERROR : readonly/oops.txt: Failed to copy: PUT https://myaccount.blob.core.windows.net/readonly/oops.txt
--------------------------------------------------------------------------------
RESPONSE 403: 403 This request is not authorized to perform this operation using this permission.
ERROR CODE: AuthorizationPermissionMismatch
--------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:13d632aa-501e-0061-7eb9-b0c4aa000000
Time:2023-07-07T09:58:17.7463490Z</Message></Error>
--------------------------------------------------------------------------------
2023/07/07 10:58:17 ERROR : readonly/oops.txt: vfs cache: failed to upload try #1, will retry in 10s: vfs cache: failed to transfer file from cache to remote: PUT https://myaccount.blob.core.windows.net/readonly/oops.txt
--------------------------------------------------------------------------------
RESPONSE 403: 403 This request is not authorized to perform this operation using this permission.
ERROR CODE: AuthorizationPermissionMismatch
--------------------------------------------------------------------------------
<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthorizationPermissionMismatch</Code><Message>This request is not authorized to perform this operation using this permission.
RequestId:13d632aa-501e-0061-7eb9-b0c4aa000000
Time:2023-07-07T09:58:17.7463490Z</Message></Error>

What you could do is to mount individual containers to a path using --read-only only for RO one:

rclone mount AzureBlob:container1 C:\AzureBlob\container1
rclone mount AzureBlob:containerRO C:\AzureBlob\containerRO --read-only
rclone mount AzureBlob:container3 C:\AzureBlob\container3

If you have many containers you can use --exclude to simplify all setup:

rclone mount AzureBlob: C:\AzureBlob\RW --exclude "/containerRO/**"
rclone mount AzureBlob:containerRO C:\AzureBlob\RO --read-only
1 Like

Brilliant, I will try that. Thanks.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.