starred/pocket-id
1
0
Fork 0
mirror of https://github.com/pocket-id/pocket-id.git synced 2026-02-05 00:39:38 +03:00
Code Issues 61 Packages Projects Releases 10 Wiki Activity

🐛 Bug Report: "config error: ENCRYPTION_KEY must be at least 16 bytes long" - Docker Compose container restarts #635

New Issue
Open
opened 2026-02-04 20:42:12 +03:00 by OVERLORD · 4 comments
OVERLORD commented 2026-02-04 20:42:12 +03:00
Owner
Copy Link

Originally created by @Zydepoint on GitHub (Jan 29, 2026).

hello, i seem to get issues whenever i try to run pocket-id via docker container. i didn't find this issue so i am suspecting the issue might be on my side..

Reproduction steps

what my current docker compose config is:

services:

# auth.x.x
  pocket-id:
    image: ghcr.io/pocket-id/pocket-id:latest
    container_name: pocket-id
    security_opt:
      - no-new-privileges=true
    read_only: true
    user: 1000:1000
    cap_drop:
      - ALL
    ports:
      - "1411:1411"
    volumes:
      - "./data:/app/data"
      - ".key:/key:ro"
    healthcheck:
      test: [ "CMD", "/app/pocket-id", "healthcheck" ]
      interval: 1m30s
      timeout: 5s
      retries: 2
      start_period: 10s
    networks:
      POCKETID-NET:
    restart: unless-stopped

networks:
  POCKETID-NET:
    external: true

what i've tried:

  • use different methods to create the key: -base64 32 and -hex 32. also -base64 64
  • pinpointed the image to older version: v2.0.0 and i've tried latest v2.2.0

right now, the key is in a specified file and i define the path to the file in the .env file:

APP_URL="https://auth.x.x"
ENCRYPTION_KEY_FILE=/key
TRUST_PROXY="true"
#MAXMIND_LICENSE_KEY=
PUID="1000"
PGID="1000"

Expected behavior

I expected either -base64 32 or -hex 32 methods to work, at least after destroying the docker container and rebuilding it from the latest image.

Actual Behavior

the pocked-id docker container restarts endlessly.

Pocket ID Version

v2.0.0 or latest. I run latest right now but i've tried to pinpoint to v2.0.0 and the issue persists

Database

SQLite i'd assume since i don't run a postgres container beside pocket id.

OS and Environment

Docker running on an Ubuntu VM, see versions below:

sudo docker compose version
Docker Compose version v5.0.0

sudo docker version
Client: Docker Engine - Community
Version: 29.1.3
API version: 1.52
Go version: go1.25.5
Git commit: f52814d
Built: Fri Dec 12 15:05:45 2025
OS/Arch: linux/amd64
Context: default

lsb_release -a
Distributor ID: Ubuntu
Description: Ubuntu 25.04
Release: 25.04
Codename: plucky

Log Output

pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
pocket-id  | config error: ENCRYPTION_KEY must be at least 16 bytes long
[...]
pocket-id exited with code 1 (restarting)
Originally created by @Zydepoint on GitHub (Jan 29, 2026). hello, i seem to get issues whenever i try to run pocket-id via docker container. i didn't find this issue so i am suspecting the issue might be on my side.. ### Reproduction steps what my current docker compose config is: ``` services: # auth.x.x pocket-id: image: ghcr.io/pocket-id/pocket-id:latest container_name: pocket-id security_opt: - no-new-privileges=true read_only: true user: 1000:1000 cap_drop: - ALL ports: - "1411:1411" volumes: - "./data:/app/data" - ".key:/key:ro" healthcheck: test: [ "CMD", "/app/pocket-id", "healthcheck" ] interval: 1m30s timeout: 5s retries: 2 start_period: 10s networks: POCKETID-NET: restart: unless-stopped networks: POCKETID-NET: external: true ``` what i've tried: - use different methods to create the key: -base64 32 and -hex 32. also -base64 64 - pinpointed the image to older version: v2.0.0 and i've tried latest v2.2.0 right now, the key is in a specified file and i define the path to the file in the .env file: ``` APP_URL="https://auth.x.x" ENCRYPTION_KEY_FILE=/key TRUST_PROXY="true" #MAXMIND_LICENSE_KEY= PUID="1000" PGID="1000" ``` ### Expected behavior I expected either -base64 32 or -hex 32 methods to work, at least after destroying the docker container and rebuilding it from the latest image. ### Actual Behavior the pocked-id docker container restarts endlessly. ### Pocket ID Version v2.0.0 or latest. I run latest right now but i've tried to pinpoint to v2.0.0 and the issue persists ### Database SQLite i'd assume since i don't run a postgres container beside pocket id. ### OS and Environment Docker running on an Ubuntu VM, see versions below: `sudo docker compose version` Docker Compose version v5.0.0 `sudo docker version` Client: Docker Engine - Community Version: 29.1.3 API version: 1.52 Go version: go1.25.5 Git commit: f52814d Built: Fri Dec 12 15:05:45 2025 OS/Arch: linux/amd64 Context: default `lsb_release -a` Distributor ID: Ubuntu Description: Ubuntu 25.04 Release: 25.04 Codename: plucky ### Log Output ``` pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long pocket-id | config error: ENCRYPTION_KEY must be at least 16 bytes long [...] pocket-id exited with code 1 (restarting) ```
OVERLORD commented 2026-02-04 20:42:17 +03:00
Author
Owner
Copy Link

@l-maciej commented on GitHub (Jan 30, 2026):

You have to regenerate the key with fitting value in .env file

@l-maciej commented on GitHub (Jan 30, 2026): You have to regenerate the key with fitting value in .env file
OVERLORD commented 2026-02-04 20:42:20 +03:00
Author
Owner
Copy Link

@Zydepoint commented on GitHub (Feb 2, 2026):

i have done that? the guide says "openssl rand -base64 32" but i've tried that and other methods, and none of them works apparently

@Zydepoint commented on GitHub (Feb 2, 2026): i have done that? the guide says "openssl rand -base64 32" but i've tried that and other methods, and none of them works apparently
OVERLORD commented 2026-02-04 20:42:25 +03:00
Author
Owner
Copy Link

@Zydepoint commented on GitHub (Feb 2, 2026):

I see now that the installation guide mentions: "The ENCRYPTION_KEY environment variable is now mandatory. You must set this variable to a at least 16 characters long random string. You can generate a secure random string using openssl rand -base64 32."

but the error suggests the issue is in the size of the encryption key? i tried now using different lengths but none works, tried 16, 32, 64, and a very long one.

@Zydepoint commented on GitHub (Feb 2, 2026): I see now that the installation guide mentions: "The ENCRYPTION_KEY environment variable is now mandatory. You must set this variable to a at least 16 characters long random string. You can generate a secure random string using openssl rand -base64 32." but the error suggests the issue is in the size of the encryption key? i tried now using different lengths but none works, tried 16, 32, 64, and a very long one.
OVERLORD commented 2026-02-04 20:42:28 +03:00
Author
Owner
Copy Link

@l-maciej commented on GitHub (Feb 2, 2026):

@Zydepoint Checked .env on my other machine

Image

I've just used some key bbut it is not encrypted. Application started without any issues.
Latest version and env from documentation

@l-maciej commented on GitHub (Feb 2, 2026): @Zydepoint Checked .env on my other machine <img width="764" height="267" alt="Image" src="https://github.com/user-attachments/assets/a35bfdea-a01d-4d08-adcf-3466c09d3021" /> I've just used some key bbut it is not encrypted. Application started without any issues. Latest version and env from documentation
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
breaking
bug
bug
bug
documentation
feature
needs more upvotes
open to pull requests
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/pocket-id#635
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?