On my server, I have a git repository covering a to-be-web-readable directory. The contents of this particular user's www directory will be readable and writable by that user, but I want the .git directory to be owned by root.

Is there any way to make the .git directory sufficiently readable that the non-root user can checkout files as a simple means of reverting? Adding and committing aren't permitted (only the admin actually marks changes as "accepted", which can then result in them being promoted from staging), but it should in theory be possible for an unprivileged user to read from .git and change files in www. Commands like git log and git show have no trouble in this setup, but attempting a checkout fails:

$ git checkout www/some-file-name
fatal: Unable to create '/REDACTED/PATH/.git/index.lock': Permission denied

Can I ask git to not lock the index? Can I somehow permit the index to be locked without opening too much else? (Obviously I can't make the .git directory writable as that would forfeit all protection.)

NOTE: It is possible to work around this for a single file at a time:

$ git show HEAD:www/some-file-name >www/some-file-name

So it's clearly not a fundamental limitation. Maybe it's just that git checkout assumes it's doing a branch switch? It is the most convenient way to manage wildcards and directory trees, though.

EDIT: This is not talking about a branch switch. I want to be able to use git checkout to check out a single file. That's why the obvious answer is not applicable here.

1 Answer 1


What you ask is contradictory. To run git checkout on a repo, the user needs write access to the .git folder.

You could track your project one level above the webroot, so it won't be accessible by the webserver.

Otherwise you could clone the repo elsewhere and symbolic link only what is needed into the webroot

  • Read access, but not write access. As explained, commands like git log and git show have no issues with the .git directory being owned by root (it's readable by the other user).
    – rosuav
    Feb 17, 2017 at 19:45
  • Can you elaborate on WHY a file checkout needs write access? I'm not trying to switch branches here.
    – rosuav
    Feb 17, 2017 at 20:05
  • 1
    A checkout will write a lock in .git to prevent multiple conflicting checkouts to be run on the same files.
    – Bruno9779
    Feb 17, 2017 at 20:07
  • I'm already tracking one level above the webroot; /REDACTED/PATH/www and /REDACTED/PATH/.git are peers.
    – rosuav
    Feb 17, 2017 at 20:14
  • 1
    git show is non-intrusive and non-clobbering. git checkout is clobbering by definition (it replaces the current files with the files tracked on a branch). If you were to run git checkout on the same repo, in 2 different shells at the same time, who knows what madness could happen. The same goes for many git commands run at the same time as checkout
    – Bruno9779
    Feb 17, 2017 at 20:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .