Access denied on wwwroot after DevOps deployment

Question

I've deployed a .Net Core web application to Azure App Service using Azure DevOps. Now, when I try to create file in 'D:\home\site\wwwroot' using Kudu it says:

409 Conflict: Could not write to local resource 'D:\home\site\wwwroot\anc' >due to error 'Could not find file 'D:\home\site\wwwroot\anc'.'.

I've noticed that the persmissions on the 'D:\home\site\wwwroot' directory are different than in a similar web app that I deployed using Publish Profile

Get-Acl result on the problematic app:

PS D:\home\site\wwwroot> Get-Acl "D:\home\site\wwwroot"
Get-Acl "D:\home\site\wwwroot"




    Directory: D:\home\site





Path    Owner                   Access                                         

----    -----                   ------                                         

wwwroot IIS APPPOOL\luncher-dev NT AUTHORITY\SYSTEM Allow  FullControl...      

Get-Acl result on other similar app:

PS D:\home\site\wwwroot> Get-Acl "D:\home\site\wwwroot"
Get-Acl "D:\home\site\wwwroot"




    Directory: D:\home\site





Path    Owner                  Access                                          

----    -----                  ------                                          

wwwroot BUILTIN\Administrators Everyone Allow  DeleteSubdirectoriesAndFiles,...

Corresponding Release pipeline from Azure DevOps

How can I make the wwwroot directory writable?

Answer 1

Change this APP SETTING KEY

WEBSITE_RUN_FROM_PACKAGE = 1 to 0

This setting makes wwwroot as a read-only file system.

With Run From Package, this is strictly enforced as the wwwroot folder becomes read-only

Answer 2

When you deploy as zip you cannot edit the filesystem.

Quote below from https://tomasherceg.com/blog/post/azure-app-service-cannot-create-directories-and-write-to-filesystem-when-deployed-using-azure-devops

I didn’t know about this feature at all, and what is more, the setting is hidden in VSTS task so I didn’t notice it. You need to expand the Additional Deployment Options section and click on the Select deployment method checkbox, which is unchecked by default. Only after these two clicks, you can see the dropdown with deployment methods – ZipDeploy is the default one.

I needed to change it to use WebDeploy so the application files will be stored as normal files and the application can write in the filesystem like it could before.

Answer 3

Had the same issue and took me forever to figure it out.

see link: https://theazureissues.blogspot.com/2019/04/409-conflict-could-not-write-to-local.html

The application setting ‘WEBSITE_RUN_FROM_PACKAGE=1’ of the App Service makes the wwwroot folder of the application as read-only.

I just set that to 0, restarted my app, and everything went back to normal.

I found another link: https://azureappservices.blogspot.com/2018/06/unable-to-editdelete-files-through-kudu.html which deals with specific files attributes, however, I was not even able to edit the attributes after deploying from devops. So I believe this is a fix for specific files being flagged as read-only.

OR

check this link: https://tomasherceg.com/blog/post/azure-app-service-cannot-create-directories-and-write-to-filesystem-when-deployed-using-azure-devops it could also be the

WEBSITE_RUN_FROM_ZIP

appsetting. (It was not the issue in my case)

Answer 4

Do not write

any file to wwwroot when you are in cloud. Because Azure can change your machine/server and thay will just move your publish gfiles. Not the files that you added after publish. So you will lost them.