immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-02-05 08:41:28 +03:00
Code Issues 26 Packages Projects Releases 10 Wiki Activity

[BUG] docker - immich_proxy has rights issues running as non-root user #1298

New Issue
Closed
opened 2026-02-05 01:11:45 +03:00 by OVERLORD · 5 comments
OVERLORD commented 2026-02-05 01:11:45 +03:00
Owner
Copy Link

Originally created by @ndewijer on GitHub (Sep 1, 2023).

The bug

Setting up Immich via docker-compose to run as non-root user breaks nginx inside immich_proxy as it can no longer write to it's config.

Workaround is copying /etc/nginx out of the container, into a directory with correct rights and mounting the folder as a volume.

The OS that Immich Server is running on

Ubuntu 22.04.3 LTS

Version of Immich Server

v1.76.1

Version of Immich Mobile App

n/a

Platform with the issue

  • Server
  • Web
  • Mobile

Your docker-compose.yml content

version: "3.8"

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    command: [ "start.sh", "immich" ]
    user: ${PUID}:${PGID}
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
    env_file:
      - stack.env
    depends_on:
      - redis
      - database
      - typesense
    restart: always

  immich-microservices:
    container_name: immich_microservices
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.yml
    #   service: hwaccel
    command: [ "start.sh", "microservices" ]
    user: ${PUID}:${PGID}
    volumes:
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - ${DOCKERPATH}/immich/geocoding:/usr/src/app/.reverse-geocoding-dump
    env_file:
      - stack.env
    depends_on:
      - redis
      - database
      - typesense
    restart: always
    mem_limit: "4g"

  immich-machine-learning:
    container_name: immich_machine_learning
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    user: ${PUID}:${PGID}
    volumes:
      - model-cache:/cache
    env_file:
      - stack.env
    restart: always

  immich-web:
    container_name: immich_web
    image: ghcr.io/immich-app/immich-web:${IMMICH_VERSION:-release}
    user: ${PUID}:${PGID}
    env_file:
      - stack.env
    restart: always

  typesense:
    container_name: immich_typesense
    image: typesense/typesense:0.24.1@sha256:9bcff2b829f12074426ca044b56160ca9d777a0c488303469143dd9f8259d4dd
    user: ${PUID}:${PGID}
    environment:
      - TYPESENSE_API_KEY=${TYPESENSE_API_KEY}
      - TYPESENSE_DATA_DIR=/data
      # remove this to get debug messages
      - GLOG_minloglevel=1
    volumes:
      - tsdata:/data
    restart: always

  redis:
    container_name: immich_redis
    user: ${PUID}:${PGID}
    image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3
    restart: always

  database:
    container_name: immich_postgres
    user: ${PUID}:${PGID}
    image: postgres:14-alpine@sha256:28407a9961e76f2d285dc6991e8e48893503cc3836a4755bbc2d40bcc272a441
    env_file:
      - stack.env
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
    volumes:
      - pgdata:/var/lib/postgresql/data
    restart: always

  immich-proxy:
    container_name: immich_proxy
    image: ghcr.io/immich-app/immich-proxy:${IMMICH_VERSION:-release}
    user: ${PUID}:${PGID}
    environment:
      - ${IMMICH_SERVER_URL}
      - ${IMMICH_WEB_URL}
    ports:
      - 2283:8080
    depends_on:
      - immich-server
      - immich-web
    restart: always

volumes:
  pgdata:
  model-cache:
  tsdata:

Your .env content

DOCKERPATH=/docker
TZ=Europe/Amsterdam
PUID=1013
PGID=1016
UPLOAD_LOCATION=/data/immich/
IMMICH_VERSION=release
TYPESENSE_API_KEY=xxx
DB_PASSWORD=xxx
DB_HOSTNAME=immich_postgres
DB_USERNAME=xx
DB_DATABASE_NAME=immich
REDIS_HOSTNAME=immich_redis
IMMICH_SERVER_URL=http://immich-server:3001
IMMICH_WEB_URL=http://immich-web:3000
PUBLIC_IMMICH_SERVER_URL=https://immich.local.xx.xx

Reproduction steps

1. follow steps from https://immich.app/docs/FAQ#how-can-i-run-immich-as-a-non-root-user
2. check docker logs of immich-proxy

Additional information

No response

Originally created by @ndewijer on GitHub (Sep 1, 2023). ### The bug Setting up Immich via docker-compose to run as non-root user breaks nginx inside immich_proxy as it can no longer write to it's config. Workaround is copying /etc/nginx out of the container, into a directory with correct rights and mounting the folder as a volume. ### The OS that Immich Server is running on Ubuntu 22.04.3 LTS ### Version of Immich Server v1.76.1 ### Version of Immich Mobile App n/a ### Platform with the issue - [X] Server - [ ] Web - [ ] Mobile ### Your docker-compose.yml content ```YAML version: "3.8" services: immich-server: container_name: immich_server image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} command: [ "start.sh", "immich" ] user: ${PUID}:${PGID} volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload env_file: - stack.env depends_on: - redis - database - typesense restart: always immich-microservices: container_name: immich_microservices image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release} # extends: # file: hwaccel.yml # service: hwaccel command: [ "start.sh", "microservices" ] user: ${PUID}:${PGID} volumes: - ${UPLOAD_LOCATION}:/usr/src/app/upload - ${DOCKERPATH}/immich/geocoding:/usr/src/app/.reverse-geocoding-dump env_file: - stack.env depends_on: - redis - database - typesense restart: always mem_limit: "4g" immich-machine-learning: container_name: immich_machine_learning image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} user: ${PUID}:${PGID} volumes: - model-cache:/cache env_file: - stack.env restart: always immich-web: container_name: immich_web image: ghcr.io/immich-app/immich-web:${IMMICH_VERSION:-release} user: ${PUID}:${PGID} env_file: - stack.env restart: always typesense: container_name: immich_typesense image: typesense/typesense:0.24.1@sha256:9bcff2b829f12074426ca044b56160ca9d777a0c488303469143dd9f8259d4dd user: ${PUID}:${PGID} environment: - TYPESENSE_API_KEY=${TYPESENSE_API_KEY} - TYPESENSE_DATA_DIR=/data # remove this to get debug messages - GLOG_minloglevel=1 volumes: - tsdata:/data restart: always redis: container_name: immich_redis user: ${PUID}:${PGID} image: redis:6.2-alpine@sha256:70a7a5b641117670beae0d80658430853896b5ef269ccf00d1827427e3263fa3 restart: always database: container_name: immich_postgres user: ${PUID}:${PGID} image: postgres:14-alpine@sha256:28407a9961e76f2d285dc6991e8e48893503cc3836a4755bbc2d40bcc272a441 env_file: - stack.env environment: POSTGRES_PASSWORD: ${DB_PASSWORD} POSTGRES_USER: ${DB_USERNAME} POSTGRES_DB: ${DB_DATABASE_NAME} volumes: - pgdata:/var/lib/postgresql/data restart: always immich-proxy: container_name: immich_proxy image: ghcr.io/immich-app/immich-proxy:${IMMICH_VERSION:-release} user: ${PUID}:${PGID} environment: - ${IMMICH_SERVER_URL} - ${IMMICH_WEB_URL} ports: - 2283:8080 depends_on: - immich-server - immich-web restart: always volumes: pgdata: model-cache: tsdata: ``` ### Your .env content ```Shell DOCKERPATH=/docker TZ=Europe/Amsterdam PUID=1013 PGID=1016 UPLOAD_LOCATION=/data/immich/ IMMICH_VERSION=release TYPESENSE_API_KEY=xxx DB_PASSWORD=xxx DB_HOSTNAME=immich_postgres DB_USERNAME=xx DB_DATABASE_NAME=immich REDIS_HOSTNAME=immich_redis IMMICH_SERVER_URL=http://immich-server:3001 IMMICH_WEB_URL=http://immich-web:3000 PUBLIC_IMMICH_SERVER_URL=https://immich.local.xx.xx ``` ### Reproduction steps ```bash 1. follow steps from https://immich.app/docs/FAQ#how-can-i-run-immich-as-a-non-root-user 2. check docker logs of immich-proxy ``` ### Additional information _No response_
OVERLORD commented 2026-02-05 01:11:50 +03:00
Author
Owner
Copy Link

@yodatak commented on GitHub (Sep 6, 2023):

Same with kubernetes k8s ^

@yodatak commented on GitHub (Sep 6, 2023): Same with kubernetes k8s ^
OVERLORD commented 2026-02-05 01:11:56 +03:00
Author
Owner
Copy Link

@kjkent commented on GitHub (Oct 3, 2023):

Just reporting that this issue doesn't occur for me using the current releases

@kjkent commented on GitHub (Oct 3, 2023): Just reporting that this issue doesn't occur for me using the current releases
OVERLORD commented 2026-02-05 01:11:59 +03:00
Author
Owner
Copy Link

@yodatak commented on GitHub (Oct 15, 2023):

same for me its no more occur

@yodatak commented on GitHub (Oct 15, 2023): same for me its no more occur
OVERLORD commented 2026-02-05 01:12:03 +03:00
Author
Owner
Copy Link

@bestrocker221 commented on GitHub (Oct 29, 2023):

I tried to run immich as non-root. The proxy gets fixed as @ndewijer is saying, by mounting the nginx volume but the microservices container does not work.
It will try to modify the folder /usr/src/app, which is owned by root with the non-root user.

@bestrocker221 commented on GitHub (Oct 29, 2023): I tried to run immich as non-root. The proxy gets fixed as @ndewijer is saying, by mounting the nginx volume but the microservices container does not work. It will try to modify the folder /usr/src/app, which is owned by root with the non-root user.
OVERLORD commented 2026-02-05 01:12:07 +03:00
Author
Owner
Copy Link

@jrasm91 commented on GitHub (Nov 23, 2023):

This container no longer exists

@jrasm91 commented on GitHub (Nov 23, 2023): This container no longer exists
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
documentation
external-library
format
good first issue
needs-answer
nice to have
sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#1298
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?