[GH-ISSUE #606] Add user: "${UID}:${GID}" in compose.yaml

kerem commented

2026-03-02 11:49:23 +03:00

Owner

Originally created by @Ronaldvr on GitHub (Oct 31, 2024).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/606

Describe the feature you'd like

When experimenting with hoarder I found that deleting documents in the mounted directories was impossible without root access. This means the images are mounted with the root (1000) user. A simple solution is using the
user: "${UID}:${GID}"
in the yaml and adding those variables to the .env file
As explained for instance her: https://stackoverflow.com/questions/40462189/docker-compose-set-user-and-group-on-mounted-volume

Describe the benefits this would bring to existing Hoarder users

Not only is this strongly recommended behaviour these days https://www.howtogeek.com/devops/why-processes-in-docker-containers-shouldnt-run-as-root/ it is easier and safer.

Can the goal of this request already be achieved via other means?

No

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

Additional context

No response

Originally created by @Ronaldvr on GitHub (Oct 31, 2024). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/606 ### Describe the feature you'd like When experimenting with hoarder I found that deleting documents in the mounted directories was impossible without root access. This means the images are mounted with the root (1000) user. A simple solution is using the user: "${UID}:${GID}" in the yaml and adding those variables to the .env file As explained for instance her: https://stackoverflow.com/questions/40462189/docker-compose-set-user-and-group-on-mounted-volume ### Describe the benefits this would bring to existing Hoarder users Not only is this strongly recommended behaviour these days https://www.howtogeek.com/devops/why-processes-in-docker-containers-shouldnt-run-as-root/ it is easier and safer. ### Can the goal of this request already be achieved via other means? No ### Have you searched for an existing open/closed issue? - [X] I have searched for existing issues and none cover my fundamental request ### Additional context _No response_

kerem

2026-03-02 11:49:23 +03:00

closed this issue
added the
feature request

pri/high

status/approved
labels

kerem commented

2026-03-02 11:49:24 +03:00

Author

Owner

@bishtawi commented on GitHub (Dec 4, 2024):

Support for running the image as non-root would be greatly appriciated. When I attempt to run the image as user 1000:1000, I get the following error:

s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service init-db-migration: starting
Running db migration script
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started

/db_migrations/index.js:815
		[util.cppdb]: { value: new addon.Database(filename, filenameGiven, anonymous, readonly, fileMustExist, timeout, verbose || null, buffer || null) },
		                      ^
SqliteError: unable to open database file
    at new Database (/db_migrations/index.js:815:26)
    at /db_migrations/index.js:11751:16
    at /db_migrations/index.js:11825:3
    at Object.<anonymous> (/db_migrations/index.js:11828:12)
    at Module._compile (node:internal/modules/cjs/loader:1546:14)
    at Object..js (node:internal/modules/cjs/loader:1689:10)
    at Module.load (node:internal/modules/cjs/loader:1318:32)
    at Function._load (node:internal/modules/cjs/loader:1128:12)
    at TracingChannel.traceSync (node:diagnostics_channel:315:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:218:24) {
  code: 'SQLITE_CANTOPEN'
}

Node.js v22.11.0
s6-rc: warning: unable to start service init-db-migration: command exited 1

When I exec into the container and run id, I am root even though I overridden the user to be non-root.

@bishtawi commented on GitHub (Dec 4, 2024): Support for running the image as non-root would be greatly appriciated. When I attempt to run the image as user `1000:1000`, I get the following error: ``` s6-rc: info: service s6rc-oneshot-runner: starting s6-rc: info: service s6rc-oneshot-runner successfully started s6-rc: info: service fix-attrs: starting s6-rc: info: service init-db-migration: starting Running db migration script s6-rc: info: service fix-attrs successfully started s6-rc: info: service legacy-cont-init: starting s6-rc: info: service legacy-cont-init successfully started /db_migrations/index.js:815 [util.cppdb]: { value: new addon.Database(filename, filenameGiven, anonymous, readonly, fileMustExist, timeout, verbose || null, buffer || null) }, ^ SqliteError: unable to open database file at new Database (/db_migrations/index.js:815:26) at /db_migrations/index.js:11751:16 at /db_migrations/index.js:11825:3 at Object.<anonymous> (/db_migrations/index.js:11828:12) at Module._compile (node:internal/modules/cjs/loader:1546:14) at Object..js (node:internal/modules/cjs/loader:1689:10) at Module.load (node:internal/modules/cjs/loader:1318:32) at Function._load (node:internal/modules/cjs/loader:1128:12) at TracingChannel.traceSync (node:diagnostics_channel:315:14) at wrapModuleLoad (node:internal/modules/cjs/loader:218:24) { code: 'SQLITE_CANTOPEN' } Node.js v22.11.0 s6-rc: warning: unable to start service init-db-migration: command exited 1 ``` When I exec into the container and run `id`, I am root even though I overridden the user to be non-root.

kerem commented

2026-03-02 11:49:24 +03:00

Author

Owner

@kapsh commented on GitHub (Apr 9, 2025):

I've been able to run every service defined in project's example compose from non-root user, e.g. apps with uid/gid 568.

This requires managing data volumes manually, so first create base directory ${APPS_DATASET}/karakeep writeable for user apps where APPS_DATASET is some absolute path of your choice. Subdirectories data, cache and search inside it will be used instead of named volumes, which is usually better idea for precious data than docker magic anyway.
Next, mount subdirectories: data at default /data for karakeep itself, search at /melli_search (also their defaults) and cache shared for other things.
To actually use /cache configure it's path in environment variables:

COREPACK_HOME - most important. Without this karakeep cannot start, because corepack tries to download pnpm into /.cache in rootfs.
HOME for chrome service. It will cache fonts and certificates in there and maybe could work without setting, just shows warning on launch.

With this configuration karakeep runs, saves links, their screenshots and archives, OCR, tags and search work, etc. Resulting compose (only settings relevant to topic):

services:

  karakeep:
    image: ghcr.io/karakeep-app/karakeep:0.23.1
    volumes:
      - ${APPS_DATASET}/karakeep/data:/data
      - ${APPS_DATASET}/karakeep/cache:/cache
    environment:
      DATA_DIR: /data
      COREPACK_HOME: /cache/corepack
      OCR_CACHE_DIR: /cache/ocr
    user: "568:568"

  chrome:
    image: gcr.io/zenika-hub/alpine-chrome:124
    environment:
      HOME: /cache/chrome
    volumes:
      - ${APPS_DATASET}/karakeep/cache:/cache
    user: "568:568"

  meilisearch:
    image: getmeili/meilisearch:v1.13.3
    volumes:
      - ${APPS_DATASET}/karakeep/search:/meili_data
    user: "568:568"

There are some partially solved issues, like this error in logs when browsing or probably creating previews:

 ⨯ Failed to write image to cache Wieiqxxj-xhnpz2SHeXAUqn0CRer6gg1yVUlctnBFO0= Error: EACCES: permission denied, mkdir '/app/apps/web/.next/cache'
    at async Object.mkdir (node:internal/fs/promises:857:10)
    at async writeToCacheDir (/app/node_modules/next/dist/server/image-optimizer.js:178:5)
    at async ImageOptimizerCache.set (/app/node_modules/next/dist/server/image-optimizer.js:451:13)
    at async /app/node_modules/next/dist/server/response-cache/index.js:121:25
    at async /app/node_modules/next/dist/lib/batcher.js:45:32 {
  errno: -13,
  code: 'EACCES',
  syscall: 'mkdir',
  path: '/app/apps/web/.next/cache'
}

Sound like Next.js data cache, I couldn't find how to configure it's location. Doesn't break anything visible, but to be safe this path can be hacked with some post-deploy command like docker compose exec -u0 karakeep install -d -o 568 /app/apps/web/.next/cache which runs from root to create writable for user 568 directory inside running container.

@kapsh commented on GitHub (Apr 9, 2025): I've been able to run every service defined in project's example compose from non-root user, e.g. `apps` with uid/gid `568`. This requires managing data volumes manually, so first create base directory `${APPS_DATASET}/karakeep` writeable for user `apps` where `APPS_DATASET` is some absolute path of your choice. Subdirectories `data`, `cache` and `search` inside it will be used instead of named volumes, which is usually better idea for precious data than docker magic anyway. Next, mount subdirectories: `data` at default `/data` for karakeep itself, `search` at `/melli_search` (also their defaults) and `cache` shared for other things. To actually use `/cache` configure it's path in environment variables: - `COREPACK_HOME` - most important. Without this karakeep cannot start, because corepack tries to download pnpm into `/.cache` in rootfs. - `HOME` for chrome service. It will cache fonts and certificates in there and maybe could work without setting, just shows warning on launch. With this configuration karakeep runs, saves links, their screenshots and archives, OCR, tags and search work, etc. Resulting compose (only settings relevant to topic): ```yaml services: karakeep: image: ghcr.io/karakeep-app/karakeep:0.23.1 volumes: - ${APPS_DATASET}/karakeep/data:/data - ${APPS_DATASET}/karakeep/cache:/cache environment: DATA_DIR: /data COREPACK_HOME: /cache/corepack OCR_CACHE_DIR: /cache/ocr user: "568:568" chrome: image: gcr.io/zenika-hub/alpine-chrome:124 environment: HOME: /cache/chrome volumes: - ${APPS_DATASET}/karakeep/cache:/cache user: "568:568" meilisearch: image: getmeili/meilisearch:v1.13.3 volumes: - ${APPS_DATASET}/karakeep/search:/meili_data user: "568:568" ``` There are some partially solved issues, like this error in logs when browsing or probably creating previews: ``` ⨯ Failed to write image to cache Wieiqxxj-xhnpz2SHeXAUqn0CRer6gg1yVUlctnBFO0= Error: EACCES: permission denied, mkdir '/app/apps/web/.next/cache' at async Object.mkdir (node:internal/fs/promises:857:10) at async writeToCacheDir (/app/node_modules/next/dist/server/image-optimizer.js:178:5) at async ImageOptimizerCache.set (/app/node_modules/next/dist/server/image-optimizer.js:451:13) at async /app/node_modules/next/dist/server/response-cache/index.js:121:25 at async /app/node_modules/next/dist/lib/batcher.js:45:32 { errno: -13, code: 'EACCES', syscall: 'mkdir', path: '/app/apps/web/.next/cache' } ``` Sound like Next.js data cache, I couldn't find how to configure it's location. Doesn't break anything visible, but to be safe this path can be hacked with some post-deploy command like `docker compose exec -u0 karakeep install -d -o 568 /app/apps/web/.next/cache` which runs _from root_ to create writable for user 568 directory inside running container.

kerem commented

2026-03-02 11:49:24 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jun 2, 2025):

Folks, I'm a bit confused. Is this actually still an issue? I can't seem to repro at least in the latest release:

$ id
uid=1000(mbassem) gid=1000(mbassem)

$ mkdir /tmp/karakeep-data

$ ls -la /tmp/karakeep-data
total 80
drwxr-xr-x   2 mbassem mbassem  4096 Jun  2 00:04 ./
drwxrwxrwt 199 root    root    73728 Jun  2 00:04 ../


$ docker run -e DATA_DIR=/data -v /tmp/karakeep-data:/data -u 1000:1000 -it --rm ghcr.io/karakeep-app/karakeep:release
/package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 1000 - fixing it
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service init-db-migration: starting
Running db migration script
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service init-db-migration successfully started
s6-rc: info: service svc-workers: starting
s6-rc: info: service svc-web: starting
s6-rc: info: service svc-workers successfully started
s6-rc: info: service svc-web successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
  ▲ Next.js 14.2.25
  - Local:        http://localhost:3000
  - Network:      http://0.0.0.0:3000

 ✓ Starting...
 ✓ Ready in 120ms
! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-9.0.0-alpha.8.tgz

> @karakeep/workers@0.1.0 start:prod /app/apps/workers
> tsx index.ts

2025-06-02T00:05:05.033Z info: Workers version: 0.24.1
2025-06-02T00:05:05.046Z info: [crawler] Loading adblocker ...
...


$ ls -la /tmp/karakeep-data
total 460
drwxr-xr-x   2 mbassem mbassem   4096 Jun  2 00:05 ./
drwxrwxrwt 199 root    root     73728 Jun  2 00:05 ../
-rw-r--r--   1 mbassem mbassem      0 Jun  2 00:05 auth_failures.log
-rw-r--r--   1 mbassem mbassem 339968 Jun  2 00:05 db.db
-rw-r--r--   1 mbassem mbassem  49152 Jun  2 00:05 queue.db

It seems to me that passing a user works just fine? What am I missing?

@MohamedBassem commented on GitHub (Jun 2, 2025): Folks, I'm a bit confused. Is this actually still an issue? I can't seem to repro at least in the latest release: ``` $ id uid=1000(mbassem) gid=1000(mbassem) $ mkdir /tmp/karakeep-data $ ls -la /tmp/karakeep-data total 80 drwxr-xr-x 2 mbassem mbassem 4096 Jun 2 00:04 ./ drwxrwxrwt 199 root root 73728 Jun 2 00:04 ../ $ docker run -e DATA_DIR=/data -v /tmp/karakeep-data:/data -u 1000:1000 -it --rm ghcr.io/karakeep-app/karakeep:release /package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 1000 - fixing it s6-rc: info: service s6rc-oneshot-runner: starting s6-rc: info: service s6rc-oneshot-runner successfully started s6-rc: info: service fix-attrs: starting s6-rc: info: service init-db-migration: starting Running db migration script s6-rc: info: service fix-attrs successfully started s6-rc: info: service legacy-cont-init: starting s6-rc: info: service legacy-cont-init successfully started s6-rc: info: service init-db-migration successfully started s6-rc: info: service svc-workers: starting s6-rc: info: service svc-web: starting s6-rc: info: service svc-workers successfully started s6-rc: info: service svc-web successfully started s6-rc: info: service legacy-services: starting s6-rc: info: service legacy-services successfully started ▲ Next.js 14.2.25 - Local: http://localhost:3000 - Network: http://0.0.0.0:3000 ✓ Starting... ✓ Ready in 120ms ! Corepack is about to download https://registry.npmjs.org/pnpm/-/pnpm-9.0.0-alpha.8.tgz > @karakeep/workers@0.1.0 start:prod /app/apps/workers > tsx index.ts 2025-06-02T00:05:05.033Z info: Workers version: 0.24.1 2025-06-02T00:05:05.046Z info: [crawler] Loading adblocker ... ... $ ls -la /tmp/karakeep-data total 460 drwxr-xr-x 2 mbassem mbassem 4096 Jun 2 00:05 ./ drwxrwxrwt 199 root root 73728 Jun 2 00:05 ../ -rw-r--r-- 1 mbassem mbassem 0 Jun 2 00:05 auth_failures.log -rw-r--r-- 1 mbassem mbassem 339968 Jun 2 00:05 db.db -rw-r--r-- 1 mbassem mbassem 49152 Jun 2 00:05 queue.db ``` It seems to me that passing a user works just fine? What am I missing?

kerem commented

2026-03-02 11:49:24 +03:00

Author

Owner

@tribut commented on GitHub (Jun 2, 2025):

This seems to only work for uid 1000, here is what happens with uid 150:

$ sudo chown -R 150:150 /tmp/karakeep-data
$ docker run -v /tmp/karakeep-data:/data -e DATA_DIR=/data -u 150:150 -it --rm ghcr.io/karakeep-app/karakeep:release
/package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 150 - fixing it
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service init-db-migration: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
Running db migration script
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service init-db-migration successfully started
s6-rc: info: service svc-workers: starting
s6-rc: info: service svc-web: starting
s6-rc: info: service svc-workers successfully started
s6-rc: info: service svc-web successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
  ▲ Next.js 14.2.25
  - Local:        http://localhost:3000
  - Network:      http://0.0.0.0:3000

 ✓ Starting...
node:fs:1364
  const result = binding.mkdir(
                         ^

Error: EACCES: permission denied, mkdir '/.cache/node/corepack/v1'
    at mkdirSync (node:fs:1364:26)
    at getTemporaryFolder (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:21493:27)
    at download (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:21767:21)
    at installVersion (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:21861:61)
    at async Engine.ensurePackageManager (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:22323:32)
    at async Engine.executePackageManagerRequest (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:22423:25)
    at async Object.runMain (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:23110:7) {
  errno: -13,
  code: 'EACCES',
  syscall: 'mkdir',
  path: '/.cache/node/corepack/v1'
}

Node.js v22.15.0
 ✓ Ready in 238ms
node:fs:1364
  const result = binding.mkdir(
                         ^
[...]

This seems to be mostly fixed by adding -e HOME=/var/tmp. However, I have made some more changes to my docker-compose (which works fine, started using karakeep a few weeks ago). I don't have the time to do more tests right now to see if all of this is strictly necessary, but this is what I added:

services:
  karakeep:
    user: 157:172
    environment:
      S6_READ_ONLY_ROOT: "1"
      DATA_DIR: "/data"
      HOME: "/var/tmp"
    tmpfs:
      - /run:exec,uid=157,gid=172,size=32M
      - /app/apps/web/.next/cache:exec,uid=157,gid=172,size=32M
    security_opt:
      - no-new-privileges=true

@tribut commented on GitHub (Jun 2, 2025): This seems to only work for uid 1000, here is what happens with uid 150: ~~~ $ sudo chown -R 150:150 /tmp/karakeep-data $ docker run -v /tmp/karakeep-data:/data -e DATA_DIR=/data -u 150:150 -it --rm ghcr.io/karakeep-app/karakeep:release /package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 150 - fixing it s6-rc: info: service s6rc-oneshot-runner: starting s6-rc: info: service s6rc-oneshot-runner successfully started s6-rc: info: service fix-attrs: starting s6-rc: info: service init-db-migration: starting s6-rc: info: service fix-attrs successfully started s6-rc: info: service legacy-cont-init: starting Running db migration script s6-rc: info: service legacy-cont-init successfully started s6-rc: info: service init-db-migration successfully started s6-rc: info: service svc-workers: starting s6-rc: info: service svc-web: starting s6-rc: info: service svc-workers successfully started s6-rc: info: service svc-web successfully started s6-rc: info: service legacy-services: starting s6-rc: info: service legacy-services successfully started ▲ Next.js 14.2.25 - Local: http://localhost:3000 - Network: http://0.0.0.0:3000 ✓ Starting... node:fs:1364 const result = binding.mkdir( ^ Error: EACCES: permission denied, mkdir '/.cache/node/corepack/v1' at mkdirSync (node:fs:1364:26) at getTemporaryFolder (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:21493:27) at download (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:21767:21) at installVersion (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:21861:61) at async Engine.ensurePackageManager (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:22323:32) at async Engine.executePackageManagerRequest (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:22423:25) at async Object.runMain (/usr/local/lib/node_modules/corepack/dist/lib/corepack.cjs:23110:7) { errno: -13, code: 'EACCES', syscall: 'mkdir', path: '/.cache/node/corepack/v1' } Node.js v22.15.0 ✓ Ready in 238ms node:fs:1364 const result = binding.mkdir( ^ [...] ~~~ This seems to be mostly fixed by adding `-e HOME=/var/tmp`. However, I have made some more changes to my docker-compose (which works fine, started using karakeep a few weeks ago). I don't have the time to do more tests right now to see if all of this is strictly necessary, but this is what I added: ~~~yaml services: karakeep: user: 157:172 environment: S6_READ_ONLY_ROOT: "1" DATA_DIR: "/data" HOME: "/var/tmp" tmpfs: - /run:exec,uid=157,gid=172,size=32M - /app/apps/web/.next/cache:exec,uid=157,gid=172,size=32M security_opt: - no-new-privileges=true ~~~

kerem commented

2026-03-02 11:49:25 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Jun 7, 2025):

Ok, this is now fixed in main in github.com/karakeep-app/karakeep@169e14d35d. It'll be available in the nightly build in ~30mins and will be coming to the next release hopefully tomorrow. The trick was to get rid of corepack and pnpm completely from the prod build.

@MohamedBassem commented on GitHub (Jun 7, 2025): Ok, this is now fixed in main in https://github.com/karakeep-app/karakeep/commit/169e14d35dad99543eeb5c6960cdc639f0c0f7ca. It'll be available in the nightly build in ~30mins and will be coming to the next release hopefully tomorrow. The trick was to get rid of `corepack` and `pnpm` completely from the prod build.

kerem commented

2026-03-02 11:49:25 +03:00

Author

Owner

@johncalls commented on GitHub (Jun 9, 2025):

It appears that this issue was not completely resolved with 0.25.0. I'm seeing the following log entries now after the installation when attempting to access the app for the first time:

/package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 1000 - fixing it
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service init-db-migration: starting
Running db migration script
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service init-db-migration successfully started
s6-rc: info: service svc-workers: starting
s6-rc: info: service svc-web: starting
s6-rc: info: service svc-workers successfully started
s6-rc: info: service svc-web successfully started
s6-rc: info: service legacy-services: starting
s6-rc: info: service legacy-services successfully started
  ▲ Next.js 14.2.25
  - Local:        http://localhost:3000
  - Network:      http://0.0.0.0:3000

 ✓ Starting...
 ✓ Ready in 389ms
2025-06-09T10:30:35.562Z info: Workers version: 0.25.0
2025-06-09T10:30:35.639Z info: [crawler] Loading adblocker ...
2025-06-09T10:30:37.381Z info: [Crawler] Connecting to existing browser instance: http://chrome:9222
2025-06-09T10:30:37.382Z info: [Crawler] Successfully resolved IP address, new address: http://172.21.0.3:9222/
2025-06-09T10:30:37.487Z info: Starting crawler worker ...
2025-06-09T10:30:37.487Z info: Starting inference worker ...
2025-06-09T10:30:37.488Z info: Starting search indexing worker ...
2025-06-09T10:30:37.488Z info: Starting tidy assets worker ...
2025-06-09T10:30:37.488Z info: Starting video worker ...
2025-06-09T10:30:37.489Z info: Starting feed worker ...
2025-06-09T10:30:37.489Z info: Starting asset preprocessing worker ...
2025-06-09T10:30:37.489Z info: Starting webhook worker ...
2025-06-09T10:30:37.489Z info: Starting rule engine worker ...
d [TRPCError]: User settings not found
    at /app/apps/web/.next/server/chunks/6815.js:1:41820
    at async X.h.middlewares (/app/apps/web/.next/server/chunks/269.js:4:46337)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async G (/app/apps/web/.next/server/chunks/269.js:4:45731)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async G (/app/apps/web/.next/server/chunks/269.js:4:46537)
    at async /app/apps/web/.next/server/chunks/269.js:7:5476
    at async Promise.all (index 1) {
  cause: undefined,
  code: 'NOT_FOUND',
  digest: '4237581454'
}
d [TRPCError]: User settings not found
    at /app/apps/web/.next/server/chunks/6815.js:1:41820
    at async X.h.middlewares (/app/apps/web/.next/server/chunks/269.js:4:46337)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async G (/app/apps/web/.next/server/chunks/269.js:4:45731)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async F (/app/apps/web/.next/server/chunks/269.js:7:68)
    at async G (/app/apps/web/.next/server/chunks/269.js:4:46537)
    at async /app/apps/web/.next/server/chunks/269.js:7:5476
    at async Promise.all (index 1) {
  cause: undefined,
  code: 'NOT_FOUND',
  digest: '4237581454'
}

@johncalls commented on GitHub (Jun 9, 2025): It appears that this issue was not completely resolved with `0.25.0`. I'm seeing the following log entries now *after* the installation when attempting to access the app for the first time: ``` /package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 1000 - fixing it s6-rc: info: service s6rc-oneshot-runner: starting s6-rc: info: service s6rc-oneshot-runner successfully started s6-rc: info: service fix-attrs: starting s6-rc: info: service init-db-migration: starting Running db migration script s6-rc: info: service fix-attrs successfully started s6-rc: info: service legacy-cont-init: starting s6-rc: info: service legacy-cont-init successfully started s6-rc: info: service init-db-migration successfully started s6-rc: info: service svc-workers: starting s6-rc: info: service svc-web: starting s6-rc: info: service svc-workers successfully started s6-rc: info: service svc-web successfully started s6-rc: info: service legacy-services: starting s6-rc: info: service legacy-services successfully started ▲ Next.js 14.2.25 - Local: http://localhost:3000 - Network: http://0.0.0.0:3000 ✓ Starting... ✓ Ready in 389ms 2025-06-09T10:30:35.562Z info: Workers version: 0.25.0 2025-06-09T10:30:35.639Z info: [crawler] Loading adblocker ... 2025-06-09T10:30:37.381Z info: [Crawler] Connecting to existing browser instance: http://chrome:9222 2025-06-09T10:30:37.382Z info: [Crawler] Successfully resolved IP address, new address: http://172.21.0.3:9222/ 2025-06-09T10:30:37.487Z info: Starting crawler worker ... 2025-06-09T10:30:37.487Z info: Starting inference worker ... 2025-06-09T10:30:37.488Z info: Starting search indexing worker ... 2025-06-09T10:30:37.488Z info: Starting tidy assets worker ... 2025-06-09T10:30:37.488Z info: Starting video worker ... 2025-06-09T10:30:37.489Z info: Starting feed worker ... 2025-06-09T10:30:37.489Z info: Starting asset preprocessing worker ... 2025-06-09T10:30:37.489Z info: Starting webhook worker ... 2025-06-09T10:30:37.489Z info: Starting rule engine worker ... d [TRPCError]: User settings not found at /app/apps/web/.next/server/chunks/6815.js:1:41820 at async X.h.middlewares (/app/apps/web/.next/server/chunks/269.js:4:46337) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async G (/app/apps/web/.next/server/chunks/269.js:4:45731) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async G (/app/apps/web/.next/server/chunks/269.js:4:46537) at async /app/apps/web/.next/server/chunks/269.js:7:5476 at async Promise.all (index 1) { cause: undefined, code: 'NOT_FOUND', digest: '4237581454' } d [TRPCError]: User settings not found at /app/apps/web/.next/server/chunks/6815.js:1:41820 at async X.h.middlewares (/app/apps/web/.next/server/chunks/269.js:4:46337) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async G (/app/apps/web/.next/server/chunks/269.js:4:45731) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async F (/app/apps/web/.next/server/chunks/269.js:7:68) at async G (/app/apps/web/.next/server/chunks/269.js:4:46537) at async /app/apps/web/.next/server/chunks/269.js:7:5476 at async Promise.all (index 1) { cause: undefined, code: 'NOT_FOUND', digest: '4237581454' } ```

kerem commented

2026-03-02 11:49:25 +03:00

Author

Owner

@erphise commented on GitHub (Jun 19, 2025):

4237581454

I am having the same problem

@erphise commented on GitHub (Jun 19, 2025): > 4237581454 I am having the same problem

kerem commented

2026-03-02 11:49:25 +03:00

Author

Owner

@Dinth commented on GitHub (Oct 6, 2025):

Im having this problem when running as a user:

karakeep              | 2025-10-06T05:15:57.571035054Z s6-overlay-suexec: fatal: child failed with exit code 100
karakeep              | 2025-10-06T05:16:26.506615695Z /package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1003, has insecure and/or unworkable permissions, and we're lacking the privileges to fix it.
karakeep              | 2025-10-06T05:16:26.506701711Z s6-overlay-suexec: fatal: child failed with exit code 100
karakeep              | 2025-10-06T05:19:56.897357330Z /package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1003, has insecure and/or unworkable permissions, and we're lacking the privileges to fix it.

@Dinth commented on GitHub (Oct 6, 2025): Im having this problem when running as a user: ``` karakeep | 2025-10-06T05:15:57.571035054Z s6-overlay-suexec: fatal: child failed with exit code 100 karakeep | 2025-10-06T05:16:26.506615695Z /package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1003, has insecure and/or unworkable permissions, and we're lacking the privileges to fix it. karakeep | 2025-10-06T05:16:26.506701711Z s6-overlay-suexec: fatal: child failed with exit code 100 karakeep | 2025-10-06T05:19:56.897357330Z /package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1003, has insecure and/or unworkable permissions, and we're lacking the privileges to fix it. ```

kerem commented

2026-03-02 11:49:25 +03:00

Author

Owner

@fictiontoreality commented on GitHub (Nov 19, 2025):

@MohamedBassem Thank you for looking into this. Please disable auto-resolving issues after a push. This allows time for users to manually resolve issues after they confirm the fix, otherwise issue churn occurs and context/momentum is lost such as cases like this where the initial change does not fully resolve the issue.

@fictiontoreality commented on GitHub (Nov 19, 2025): @MohamedBassem Thank you for looking into this. Please disable auto-resolving issues after a push. This allows time for users to manually resolve issues after they confirm the fix, otherwise issue churn occurs and context/momentum is lost such as cases like this where the initial change does not fully resolve the issue.

kerem commented

2026-03-02 11:49:25 +03:00

Author

Owner

@niklasthorild commented on GitHub (Jan 17, 2026):

You need to assign /run to the user id you are running the container as. For example, in docker compose:

tmpfs:
  - /run:uid=1000,gid=1000,exec

Works fine for me after doing that.

@niklasthorild commented on GitHub (Jan 17, 2026): You need to assign /run to the user id you are running the container as. For example, in docker compose: ```docker-compose tmpfs: - /run:uid=1000,gid=1000,exec ``` Works fine for me after doing that.

kerem referenced this issue

2026-03-02 11:58:24 +03:00

[PR #388] [MERGED] Removing referrer header when clicking on links #387 #1610

Rows
Columns

[GH-ISSUE #606] Add user: "${UID}:${GID}" in compose.yaml #387

Describe the feature you'd like

Describe the benefits this would bring to existing Hoarder users

Can the goal of this request already be achieved via other means?

Have you searched for an existing open/closed issue?

Additional context