immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 00:30:57 +03:00
Code Issues 12 Packages Projects Releases 10 Wiki Activity

[BUG] write permissions required to download files #1006

New Issue
Closed
opened 2026-02-04 23:55:06 +03:00 by OVERLORD · 3 comments
OVERLORD commented 2026-02-04 23:55:06 +03:00
Owner
Copy Link

Originally created by @tlvince on GitHub (Jun 26, 2023).

The bug

Having successfully imported assets via the read-only gallery feature, I tried downloading an imported asset (a single file via the web UI), but was shown a 500 error and Error: EACCES: permission denied /opt/read-only/path/to/photo.jpg in the server logs.

Giving write access to the directory works.

Is a temporary file being written there, perhaps? If so, could this be moved to UPLOAD_LOCATION?

The OS that Immich Server is running on

Debian (Bookworm)

Version of Immich Server

v1.63.2

Version of Immich Mobile App

v1.63.2

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

version: "3.8"

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: [ "start.sh", "immich" ]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /opt/read-only:/opt/read-only
    env_file:
      - .env
    depends_on:
      - redis
      - database
      - typesense
    restart: always

  immich-microservices:
    container_name: immich_microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: [ "start.sh", "microservices" ]
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /opt/read-only:/opt/read-only
    env_file:
      - .env
    depends_on:
      - redis
      - database
      - typesense
    restart: always

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always

  immich-web:
    container_name: immich_web
    image: ghcr.io/immich-app/immich-web:${IMMICH_VERSION:-release}
    env_file:
      - .env
    restart: always

  typesense:
    container_name: immich_typesense
    image: typesense/typesense:0.24.1@sha256:9bcff2b829f12074426ca044b56160ca9d777a0c488303469143dd9f8259d4dd
    environment:
      - TYPESENSE_API_KEY=${TYPESENSE_API_KEY}
      - TYPESENSE_DATA_DIR=/data
    logging:
      driver: none
    volumes:
      - tsdata:/data
    restart: always

  redis:
    container_name: immich_redis
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    restart: always

  database:
    container_name: immich_postgres
    image: postgres:14-alpine@sha256:28407a9961e76f2d285dc6991e8e48893503cc3836a4755bbc2d40bcc272a441
    env_file:
      - .env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      PG_DATA: /var/lib/postgresql/data
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always

  immich-proxy:
    container_name: immich_proxy
    image: ghcr.io/immich-app/immich-proxy:${IMMICH_VERSION:-release}
    environment:
      # Make sure these values get passed through from the env file
      - IMMICH_SERVER_URL
      - IMMICH_WEB_URL
    ports:
      - 2283:8080
    depends_on:
      - immich-server
      - immich-web
    restart: always

volumes:
  pgdata:
  model-cache:
  tsdata:

Your .env content

IMMICH_VERSION=v1.63.2
UPLOAD_LOCATION=/opt/immich

Reproduction steps

1. Follow [import steps](https://docs.immich.app/docs/features/read-only-gallery)
2. Download an imported image

Additional information

No response

Originally created by @tlvince on GitHub (Jun 26, 2023). ### The bug Having successfully imported assets via the [read-only gallery feature](https://docs.immich.app/docs/features/read-only-gallery), I tried downloading an imported asset (a single file via the web UI), but was shown a 500 error and `Error: EACCES: permission denied /opt/read-only/path/to/photo.jpg` in the server logs. Giving write access to the directory works. Is a temporary file being written there, perhaps? If so, could this be moved to `UPLOAD_LOCATION`? ### The OS that Immich Server is running on Debian (Bookworm) ### Version of Immich Server v1.63.2 ### Version of Immich Mobile App v1.63.2 ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML version: "3.8" services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} command: [ "start.sh", "immich" ] volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /opt/read-only:/opt/read-only env_file: - .env depends_on: - redis - database - typesense restart: always immich-microservices: container_name: immich_microservices image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} command: [ "start.sh", "microservices" ] volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - /opt/read-only:/opt/read-only env_file: - .env depends_on: - redis - database - typesense restart: always immich-machine-learning: container_name: immich_machine_learning image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} volumes: - model-cache:/cache env_file: - .env restart: always immich-web: container_name: immich_web image: ghcr.io/immich-app/immich-web:${IMMICH_VERSION:-release} env_file: - .env restart: always typesense: container_name: immich_typesense image: typesense/typesense:0.24.1@sha256:9bcff2b829f12074426ca044b56160ca9d777a0c488303469143dd9f8259d4dd environment: - TYPESENSE_API_KEY=${TYPESENSE_API_KEY} - TYPESENSE_DATA_DIR=/data logging: driver: none volumes: - tsdata:/data restart: always redis: container_name: immich_redis image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3 restart: always database: container_name: immich_postgres image: postgres:14-alpine@sha256:28407a9961e76f2d285dc6991e8e48893503cc3836a4755bbc2d40bcc272a441 env_file: - .env environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} PG_DATA: /var/lib/postgresql/data volumes: - pgdata:/var/lib/postgresql/data restart: always immich-proxy: container_name: immich_proxy image: ghcr.io/immich-app/immich-proxy:${IMMICH_VERSION:-release} environment: # Make sure these values get passed through from the env file - IMMICH_SERVER_URL - IMMICH_WEB_URL ports: - 2283:8080 depends_on: - immich-server - immich-web restart: always volumes: pgdata: model-cache: tsdata: ``` ### Your .env content ```Shell IMMICH_VERSION=v1.63.2 UPLOAD_LOCATION=/opt/immich ``` ### Reproduction steps ```bash 1. Follow [import steps](https://docs.immich.app/docs/features/read-only-gallery) 2. Download an imported image ``` ### Additional information _No response_
OVERLORD added the 🗄️server label 2026-02-04 23:55:06 +03:00
OVERLORD commented 2026-02-04 23:55:13 +03:00
Author
Owner
Copy Link

@alextran1502 commented on GitHub (Jun 26, 2023):

tagging @alex-phillips , should we also open a GH Discussion on planned/future features for the read-only gallery similar to https://github.com/immich-app/immich/discussions/2472?

@alextran1502 commented on GitHub (Jun 26, 2023): tagging @alex-phillips , should we also open a GH Discussion on planned/future features for the read-only gallery similar to https://github.com/immich-app/immich/discussions/2472?
OVERLORD commented 2026-02-04 23:55:23 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Jun 26, 2023):

It's just a good ol' bug, since it is hard coded. Should be possible to remove the W_OK portion of it.

image

@jrasm91 commented on GitHub (Jun 26, 2023): It's just a good ol' bug, since it is hard coded. Should be possible to remove the W_OK portion of it. ![image](https://github.com/immich-app/immich/assets/4334196/e9a5823c-53c5-4ac9-a96d-4427d5569a9e)
OVERLORD commented 2026-02-04 23:55:27 +03:00
Author
Owner
Copy Link

@uhthomas commented on GitHub (Jun 30, 2023):

Fixed by #3046.

@uhthomas commented on GitHub (Jun 30, 2023): Fixed by #3046.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label 🗄️server
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1006
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?