title: How to POST (and not PUT) a first package to a newly installed Verdaccio / Docker instance?
body: <p>I have installed Verdaccio as a Docker container with a <code>docker-compose.yml</code> file:</p>
  
  <pre><code>├── docker-compose.yml
  ├── INSTALLATION.md
  ├── README.md
  └── volumes
      ├── conf
      │   ├── config.yaml
      │   └── htpasswd
      ├── plugins
      └── storage
  </code></pre>
  
  <p>which is:</p>
  
  <pre><code>version: "3.7"
  services:
    registry:
      image: verdaccio/verdaccio
      networks:
        verdaccio:
      hostname: verdaccio
      ports:
        - 4873:4873
      volumes:
        - ~/dev/docker/registries/verdaccio/volumes/conf:/verdaccio/conf
        - ~/dev/docker/registries/verdaccio/volumes/plugins:/verdaccio/plugins
        - ~/dev/docker/registries/verdaccio/volumes/storage:/verdaccio/storage
      environment:
        VERDACCIO_PORT: 4873
      deploy:
        replicas: 1
        restart_policy:
          condition: any
          delay: 5s
          max_attempts: 3
          window: 30s
  networks:
    verdaccio:
      name: verdaccio
  </code></pre>
  
  <p>and the file permissions:</p>
  
  <pre><code>sudo groupadd verdaccio;
  sudo useradd -s /bin/false -d /dev/null -g verdaccio verdaccio;
  sudo chown -R verdaccio:verdaccio ~/dev/docker/registries/verdaccio/volumes/
  sudo chmod -R 755 ~/dev/docker/registries/verdaccio/volumes
  </code></pre>
  
  <p>I'm trying to publish an Angular library with the command:</p>
  
  <pre><code>npm publish lib-core-0.0.1.tgz
  </code></pre>
  
  <p>But I get the error:</p>
  
  <pre><code>npm ERR! code E403
  npm ERR! 403 403 Forbidden - PUT http://verdaccio:4873/lib-core - user stephane is not allowed to publish package lib-core
  npm ERR! 403 In most cases, you or one of your dependencies are requesting
  npm ERR! 403 a package version that is forbidden by your security policy.
  
  npm ERR! A complete log of this run can be found in:
  npm ERR!     /home/stephane/.npm/_logs/2020-05-10T05_40_47_153Z-debug.log
  ✔ ~/dev/js/projects/angular/lib-core/dist/lib-core [master|…1] 
  07:40 $ npm publish @stephane/lib-core-0.0.1.tgz
  npm ERR! code E404
  npm ERR! 404 Not Found - GET http://verdaccio:4873/@stephane%2flib-core-0.0.1.tgz - no such package available
  npm ERR! 404 
  npm ERR! 404  '@stephane/lib-core-0.0.1.tgz@latest' is not in the npm registry.
  npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
  npm ERR! 404 
  npm ERR! 404 Note that you can also install from a
  npm ERR! 404 tarball, folder, http url, or git url.
  
  npm ERR! A complete log of this run can be found in:
  npm ERR!     /home/stephane/.npm/_logs/2020-05-10T05_40_55_652Z-debug.log
  </code></pre>
  
  <p>The server log:</p>
  
  <pre><code>verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 403, user: stephane(10.255.0.2), req: 'PUT /lib-core', error: user stephane is not allowed to publish package lib-core
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 403, user: stephane(10.255.0.2), req: 'PUT /lib-core', error: user stephane is not allowed to publish package lib-core
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 403, user: stephane(10.255.0.2), req: 'GET /npm', error: user stephane is not allowed to access package npm
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 403, user: stephane(10.255.0.2), req: 'GET /npm', error: user stephane is not allowed to access package npm
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 404, user: stephane(10.255.0.2), req: 'GET /@stephane%2flib-core-0.0.1.tgz', error: no such package available
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 404, user: stephane(10.255.0.2), req: 'GET /@stephane%2flib-core-0.0.1.tgz', error: no such package available
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 404, user: stephane(10.255.0.2), req: 'GET /@stephane%2flib-core-0.0.1.tgz', error: no such package available
  verdaccio-registry_registry.1.662e59l987fw@stephane-pc    |  http &lt;-- 404, user: stephane(10.255.0.2), req: 'GET /@stephane%2flib-core-0.0.1.tgz', error: no such package available
  </code></pre>
  
  <p>When I read this error, I understand the package is looked up in Verdaccio and not found (404).
  Wait.. Am I not trying to add a new package here ? So why is it looked up first ? Is there any other command I should type in before doing a publish ?
  The trouble is that before this PUT request is issued to the server, I can't see any POST request to add the package.</p>
  
  <p>I also tried (and got the same error) with the scoped prefix:</p>
  
  <pre><code>npm publish @stephane/lib-core-0.0.1.tgz
  </code></pre>
  
  <p>I run Verdaccio with the configuration:</p>
  
  <pre><code>storage: /verdaccio/storage
  plugins: /verdaccio/plugins
  
  auth:
    htpasswd:
      file: /verdaccio/conf/htpasswd
  security:
    api:
      jwt:
        sign:
          expiresIn: 360d
          notBefore: 1
    web:
      sign:
        expiresIn: 7d
  
  packages:
    '@*/*':
      access: $all
      publish: $all
      proxy: npmjs
  
    '@stephane/*':
      access: $anonymous
      publish: $anonymous
      proxy: npmjs
  </code></pre>
  
  <p>The storage is still empty:</p>
  
  <pre><code>stephane@stephane-pc:~/dev/docker/registries/verdaccio$ ll volumes/storage/
  total 0
  </code></pre>
  
  <p>Even if removing the <code>packages:</code> configuration and restart the Verdaccio container, after a successful <code>npm login</code> command, the publish command again fails with a <code>403 Forbidden</code> error:</p>
  
  <pre><code>~/dev/js/projects/angular/lib-core/dist/lib-core [master|…1] 
  08:04 $ npm publish lib-core-0.0.1.tgz
  </code></pre>
  
  <p>UPDATE: The whole issue was a host volumes permissions issue. I reverted the permissions to my regular host user, and assigned this user to the container when running it. I added in the <code>docker-compose.yml</code> file the following <code>user</code> property:</p>
  
  <pre><code>user: "${CURRENT_UID}:${CURRENT_GID}"
  </code></pre>
  
  <p>I also changed the packages configuration so as to allow authenticated users to access scoped packages:</p>
  
  <pre><code>packages:
    '@*/*':
      access: $all
      publish: $authenticated
    '**':
      proxy: npmjs
  </code></pre>
  
  <p>The container now runs with the host user and the issue is gone.</p>