Flag pages_serve_with_zip_file_protocol does not work in dockerized environments using daemon-inplace-chroot=true

Summary

Gitlab pages working in 13.9.4 does not in 13.10.0 (404).

Dockerized environment.

Steps to reproduce

Have a working gitlab configuration under docker with . Using gitlab/gitlab-ce container. Using user namespace remapping (don't know if it is releveant here).

For example:

version: "3"

services:
  _gitlab:
    image: 'gitlab/gitlab-ce:latest'
    restart: always
    ports:
      - '8880:80' #gitlab
      - '8881:81' #registry
      - '8882:82' #pages
      - '8822:22' #ssh
    volumes:
      - /opt/gitlab/config:/etc/gitlab
      - /opt/gitlab/logs:/var/log/gitlab
      - /opt/gitlab/data:/var/opt/gitlab
    restart: unless-stopped

Public port are served as http only. Frontend nginx is somewhere else on the network and serving https.

Using gitlab/gitlab-ce:13.9.4-ce.0, gitlab-pages works. Using gitlab/gitlab-ce:13.10.0-ce.0, gitlab-pages returns 404.

What is the current bug behavior?

Pages return 404.

What is the expected correct behavior?

Pages are displayed.

Relevant logs and/or screenshots

/var/log/gitlab/gitlab-pages/current <==
{"error":"not exist: \"resource not found\"","level":"trace","msg":"Root call","path":"file:///var/opt/gitlab/gitlab-rails/shared/pages/@hashed/1a/65/1a6562590ef19d1045d06c4055742d38288e9e6dcd71ccde5cee80f1d5a774eb/pages_deployments/25/artifacts.zip","time":"2021-03-26T15:15:05Z","vfs":"zip"}
{"error":"not exist: \"resource not found\"","level":"trace","msg":"Root call","path":"file:///var/opt/gitlab/gitlab-rails/shared/pages/@hashed/1a/65/1a6562590ef19d1045d06c4055742d38288e9e6dcd71ccde5cee80f1d5a774eb/pages_deployments/25/artifacts.zip","time":"2021-03-26T15:15:05Z","vfs":"zip"}
{"error":"not exist: \"resource not found\"","level":"trace","msg":"Root call","path":"file:///var/opt/gitlab/gitlab-rails/shared/pages/@hashed/1a/65/1a6562590ef19d1045d06c4055742d38288e9e6dcd71ccde5cee80f1d5a774eb/pages_deployments/25/artifacts.zip","time":"2021-03-26T15:15:05Z","vfs":"zip"}
{"content_type":"text/html; charset=utf-8","correlation_id":"01F1QHMSV2D183321AP3WHZ2BS","duration_ms":344,"host":"XXX.pages.XXX.fr","level":"info","method":"GET","msg":"access","pages_host":"XXX.pages.XXX.fr","pages_https":true,"pages_project_id":50,"pages_project_prefix":"/","pages_project_serving_type":"zip","proto":"HTTP/1.0","referrer":"","remote_addr":"XX.XX.XX.XX","remote_ip":"XX.XX.XX.XX","status":404,"system":"http","time":"2021-03-26T15:15:05Z","ttfb_ms":344,"uri":"/","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36","written_bytes":3067}

Note here that the artifacts.zip file does exist on the container:

Archive does have a public folder and valid content.

Results of GitLab environment info

$> gitlab-rake gitlab:env:info
System information
System:
Current User:   git
Using RVM:      no
Ruby Version:   2.7.2p137
Gem Version:    3.1.4
Bundler Version:2.1.4
Rake Version:   13.0.3
Redis Version:  6.0.10
Git Version:    2.29.0
Sidekiq Version:5.2.9
Go Version:     unknown

GitLab information
Version:        13.10.0
Revision:       5eafdaf7b07
Directory:      /opt/gitlab/embedded/service/gitlab-rails
DB Adapter:     PostgreSQL
DB Version:     12.5
URL:            https://gitlab.qdel.fr
HTTP Clone URL: https://gitlab.qdel.fr/some-group/some-project.git
SSH Clone URL:  git@gitlab.qdel.fr:some-group/some-project.git
Using LDAP:     no
Using Omniauth: yes
Omniauth Providers:

GitLab Shell
Version:        13.17.0
Repository storage paths:
- default:      /var/opt/gitlab/git-data/repositories
GitLab Shell path:              /opt/gitlab/embedded/service/gitlab-shell
Git:            /opt/gitlab/embedded/bin/git

Results of GitLab application Check

$> gitlab-rake gitlab:check SANITIZE=true
Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version >= 13.17.0 ? ... OK (13.17.0)
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Internal API available: OK
Redis available via internal API: OK
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Gitaly ...

Gitaly: ... default ... OK

Checking Gitaly ... Finished

Checking Sidekiq ...

Sidekiq: ... Running? ... yes
Number of Sidekiq processes (cluster/worker) ... 1/1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab App ...

Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... yes
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ...
2/1 ... yes
2/2 ... yes
1/3 ... yes
3/4 ... yes
2/5 ... yes
5/6 ... yes
5/7 ... yes
5/8 ... yes
5/9 ... yes
5/12 ... yes
2/13 ... yes
2/15 ... yes
2/16 ... yes
5/17 ... yes
7/18 ... yes
10/19 ... yes
5/20 ... yes
5/21 ... yes
7/22 ... yes
12/24 ... yes
11/29 ... yes
4/34 ... yes
10/35 ... yes
1/36 ... yes
7/37 ... yes
17/38 ... yes
17/39 ... yes
17/40 ... yes
17/41 ... yes
2/42 ... yes
20/43 ... yes
20/44 ... yes
17/45 ... yes
21/46 ... yes
17/48 ... yes
23/50 ... yes
2/51 ... yes
Redis version >= 4.0.0? ... yes
Ruby version >= 2.7.2 ? ... yes (2.7.2)
Git version >= 2.29.0 ? ... yes (2.29.0)
Git user has default SSH configuration? ... yes
Active users: ... 6
Is authorized keys file accessible? ... yes
GitLab configured to store new projects in hashed storage? ... yes
All projects are in hashed storage? ... yes

Checking GitLab App ... Finished


Checking GitLab subtasks ... Finished

Possible fixes

Linked to !54650 (merged) ?

Temporary workaround

From #326117 (comment 539628193)

exec bash inside inside docker container
call gitlab-rails console
wait until initialized and call

Feature.disable(:pages_serve_with_zip_file_protocol);

Edited Apr 05, 2021 by Jaime Martinez