Acorn as plugin open_basedir issue

Due to certain situations, I end up having to develop a sage theme without bedrock and got open_basedir issue after installing acorn as a plugin,

is_file(): open_basedir restriction in effect. File(/www/wwwroot/vendor/composer/installed.json) is not within the allowed path(s): (/www/wwwroot/domain_dir/:/tmp/)

I’m not sure how to solve this issue as it tried to access outside of the domain directory,
vendor/roots/acorn/src/Roots/Acorn/Application.php:270

        ->map(function ($path) use ($files) {    
		return rtrim($files->normalizePath($path), '/');
	})
	->unique()
	->filter(function ($path) use ($files) {
		return $files->isFile("{$path}/vendor/composer/installed.json")
			&& $files->isFile("{$path}/composer.json");
	})
	->all();

return new PackageManifest(

I’m having this same issue using Roots Sage 10 theme. I got on Kinsta live chat, and had them add [rootfolder]/vendor and [rootfolder]/composer.json to the base_dir options. The vendor folder option worked, but of course the composer.json file did not. Does anyone have a better solution for this? My next step is to have them update the document root to a sub folder of public/ which should work, but would hate to have to do this on every project…

There was a fix that already merged that you can give a try by using dev-main at composer, I don’t because I’m using Log1x/pagi that requires "illuminate/pagination": "^7.0|^8.0" and decided to disable open_basedir limit

If you’re not able to use Acorn as a dependency from Bedrock, can you try to add it as a dependency in the theme instead of trying to install it as a plugin?

From the theme directory: composer require roots/acorn, then update your composer.json with:

"post-autoload-dump": [
  "Roots\\Acorn\\ComposerScripts::postAutoloadDump"
]

Previous versions of Sage included Acorn this way

Unfortunately, it also has same issue, based on the defined path list, acorn tries to look at the www root directory first which outside base_dir restrictions.

Breakdown of why open_basedir occurred
open_basedir=/www/wwwroot/domain.com/:/tmp/

  ->merge([
      $this->basePath(), // return ""
      dirname(WP_CONTENT_DIR, 2), // return "/www/wwwroot" which not a wordpress or content path and trigger open_basedir restriction.
      get_template_directory(), // The path that actually acorn needed in plugin/theme environment
      get_stylesheet_directory(),
  ])

dirname(WP_CONTENT_DIR, 2) make the acorn itself assume it was in a bedrock environment which does return the correct path when we use bedrock (/www/wwwroot/domain.com)

is_file(): open_basedir restriction in effect. File(/www/xy/vendor/composer/installed.json) is not within the allowed path(s): (/www/xy/public:/www/xy/mysqleditor:/www/xy/web:/www/xy/deploy:/www/xy/deployment:/www/xy/deployments:/usr/share:/tmp)

i have a similar problem with the kinsta hosting provider.

sage manually copied, then composer install on ssh.
i also added this to composer.json:

"post-autoload-dump": [
  "Roots\\Acorn\\ComposerScripts::postAutoloadDump"
]

full composer.json:

{
	"name": "roots/sage",
	"type": "wordpress-theme",
	"license": "MIT",
	"description": "WordPress starter theme with a modern development workflow",
	"homepage": "https://roots.io/sage/",
	"authors": [
		{
			"name": "Ben Word",
			"email": "ben@benword.com",
			"homepage": "https://github.com/retlehs"
		},
		{
			"name": "Scott Walkinshaw",
			"email": "scott.walkinshaw@gmail.com",
			"homepage": "https://github.com/swalkinshaw"
		},
		{
			"name": "QWp6t",
			"email": "hi@qwp6t.me",
			"homepage": "https://github.com/qwp6t"
		},
		{
			"name": "Brandon Nifong",
			"email": "brandon@tendency.me",
			"homepage": "https://github.com/log1x"
		}
	],
	"keywords": [
		"wordpress"
	],
	"support": {
		"issues": "https://github.com/roots/sage/issues",
		"forum": "https://discourse.roots.io/"
	},
	"autoload": {
		"psr-4": {
			"App\\": "app/"
		}
	},
	"require": {
		"php": "^7.4|^8.0",
		"log1x/sage-directives": "^1.1",
		"log1x/sage-svg": "^1.1",
		"mwdelaney/sage-acf-gutenberg-blocks": "^0.7.0",
		"roots/acorn": "^2.1"
	},
	"require-dev": {
		"squizlabs/php_codesniffer": "3.7.1"
	},
	"suggest": {
		"log1x/sage-directives": "A collection of useful Blade directives for WordPress and Sage (^1.0).",
		"log1x/sage-svg": "A useful SVG directive for inlining SVG's within Blade views (^1.0)."
	},
	"config": {
		"optimize-autoloader": true,
		"preferred-install": "dist",
		"sort-packages": true
	},
	"minimum-stability": "dev",
	"prefer-stable": true,
	"scripts": {
		"lint": [
			"phpcs --extensions=php --standard=PSR12 app"
		],
		"post-autoload-dump": [
			"Roots\\Acorn\\ComposerScripts::postAutoloadDump"
		]
	},
	"extra": {
		"acorn": {
			"providers": [
				"App\\Providers\\ThemeServiceProvider"
			]
		}
	}
}

Guys, is there any for this problem?
Maybe acorn has some configuration settings like that says that we use the default WordPress environment instead of Bedrock, and we have to skip directory /var/www/ from the search for composer.json and installed.json

I am using Acorn 2.1
Problem file - roots/acorn/src/Roots/Acorn/Application.php line 271