OPA Docker local policy watch not working on MAC

[GuihVicentini]

Hello There!

I have question, I have a deployed OPA Server using a docker-compose and mounted the policies in a /policies folder like this:

  opa:
    image: openpolicyagent/opa:1.12.3
    ports:
      - "127.0.0.1:8181:8181"
    volumes:
      - .opa/policies:/policies/
    command:
      - "run"
      - "--server"
      - "--watch"  # <--- 
      - "--disable-telemetry"
      - "--addr=0.0.0.0:8181"
      - "--log-format=json-pretty"
      - "--set=decision_logs.console=true"
      - "/policies"

Now, when I change a policy file in the .opa/policies folder the policy does not get reloaded.

I'm running it using a MacBook and editing the files through IntelliJ. The docker containers is running inside a VM using colima.

Has anyone faced this issue, and is there some workarounds for it, is something wrong with my configuration?

I read some stuff regarding the autosave from IntelliJ and how it might affect the file change "notification", but when I changed the file using VIM the reload didn't worked either.

Thanks for the help!

[srenatus]

I suppose this is a shortcoming in inotify and how it's supposed to watch a directory for changes. I guess with these many layers involved, the update notifications just don't happen.

As for workarounds, you could run OPA on your machine as a native macOS binary. Alternatively, you could set up some scripting to update your policies on changes, with tools like entr and curl.

[GuihVicentini]

Thanks for the quick response. Yes, we noticed that was easier and faster to just restart the service instead.
But I will have a look into deeper in the Colima and virtualisation stuff. I'm still interested in making it work, but we don't have the hurry for it.

Thank you.