starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-25 16:06:04 +03:00

[GH-ISSUE #1071] Allow running Hoarder as a non-root user (PUID/PGID support) #703

New issue

Closed

opened 2026-03-02 11:52:03 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 11:52:03 +03:00

Owner

Originally created by @Cromagnonaut on GitHub (Feb 27, 2025).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1071

Describe the feature you'd like

Currently, Hoarder does not seem support running as a non-root user with a defined PUID/PGID, as specified in the user directive of a Docker Compose setup. When attempting to run the container with a specific user ID, the startup process fails with the following error:

/package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1000 and we're lacking the privileges to fix it.
s6-overlay-suexec: fatal: child failed with exit code 100

This issue prevents users from running the container without elevated privileges. Other containers in the same stack (such as chrome and meilisearch) work correctly with non-root users, but hoarder fails due to permission issues. This is assuming the permissions for the volumes align for the container and filesystem (e.g. 1000:1000 for all files and folders)

Describe the benefits this would bring to existing Hoarder users

Mostly improved security and easier integration into existing Docker environments. Running containers as a non-root will reduce possible security risks by reducing the attack surface if an exploit is found.
Regarding integration: Many users run Docker environments with non-root configurations for compliance or security policies. Supporting PUID/PGID out of the box would make Hoarder easier to deploy in these setups.

Can the goal of this request already be achieved via other means?

No. Currently, the only workaround is to run the container as root, which is not ideal from a security standpoint. Adjusting permissions manually inside the container is also not a sustainable solution due to the s6-overlay startup mechanism (?). At least I did not find a well-functioning workaround.

Have you searched for an existing open/closed issue?

I have searched for existing issues and none cover my fundamental request

Additional context

Example docker-compose.yaml (stripped down for better readabilty). See comments for relevant lines / context

name: hoarder

services:
  hoarder:
    image: ghcr.io/hoarder-app/hoarder:${HOARDER_VERSION:-release}
    container_name: hoarder_server
    user: ${PUID}:${PGID} # This line causes the error mentioned above
    security_opt:
      - no-new-privileges=true
    depends_on:
      - hoarder_chrome
      - hoarder_meilisearch
    volumes:
      - ${DOCKERDIR}/appdata/hoarder/hoarder/data:/app/data    
      - ./entrypoint.sh:/entrypoint.sh:ro
    environment:
      - TZ=${TZ}
      - PUID=${PUID}  # This line causes the issues the error mentioned above
      - PGID=${PGID}  # This line causes the issues the error mentioned above
      - HOARDER_VERSION
      - DATA_DIR

  hoarder_chrome:
    image: gcr.io/zenika-hub/alpine-chrome:123
    container_name: hoarder_chrome
    restart: unless-stopped
    user: ${PUID}:${PGID} # Is working fine
    command:
      - --no-sandbox
      - --disable-gpu
      - --disable-dev-shm-usage
      - --remote-debugging-address=0.0.0.0
      - --remote-debugging-port=9222
      - --hide-scrollbars
    security_opt:
      - no-new-privileges=true
    environment:
      - PUID=${PUID} # Is working fine
      - PGID=${PGID} # Is working fine

  hoarder_meilisearch:
    image: getmeili/meilisearch:v1.11.1
    container_name: hoarder_meilisearch
    restart: unless-stopped
    user: ${PUID}:${PGID}
    security_opt:
      - no-new-privileges=true
    volumes:
      - ${DOCKERDIR}/appdata/hoarder/meilisearch/data:/meili_data
    environment:
      - PUID=${PUID} # Is working fine
      - PGID=${PGID} # Is working fine
      - MEILI_MASTER_KEY

Originally created by @Cromagnonaut on GitHub (Feb 27, 2025). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1071 ### Describe the feature you'd like Currently, Hoarder does not seem support running as a non-root user with a defined PUID/PGID, as specified in the user directive of a Docker Compose setup. When attempting to run the container with a specific user ID, the startup process fails with the following error: ```bash /package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1000 and we're lacking the privileges to fix it. s6-overlay-suexec: fatal: child failed with exit code 100 ``` This issue prevents users from running the container without elevated privileges. Other containers in the same stack (such as `chrome` and `meilisearch`) work correctly with non-root users, but `hoarder` fails due to permission issues. This is assuming the permissions for the volumes align for the container and filesystem (e.g. 1000:1000 for all files and folders) ### Describe the benefits this would bring to existing Hoarder users Mostly improved security and easier integration into existing Docker environments. Running containers as a non-root will reduce possible security risks by reducing the attack surface if an exploit is found. Regarding integration: Many users run Docker environments with non-root configurations for compliance or security policies. Supporting PUID/PGID out of the box would make Hoarder easier to deploy in these setups. ### Can the goal of this request already be achieved via other means? No. Currently, the only workaround is to run the container as root, which is not ideal from a security standpoint. Adjusting permissions manually inside the container is also not a sustainable solution due to the s6-overlay startup mechanism (?). At least I did not find a well-functioning workaround. ### Have you searched for an existing open/closed issue? - [x] I have searched for existing issues and none cover my fundamental request ### Additional context Example `docker-compose.yaml` (stripped down for better readabilty). See comments for relevant lines / context ```yaml name: hoarder services: hoarder: image: ghcr.io/hoarder-app/hoarder:${HOARDER_VERSION:-release} container_name: hoarder_server user: ${PUID}:${PGID} # This line causes the error mentioned above security_opt: - no-new-privileges=true depends_on: - hoarder_chrome - hoarder_meilisearch volumes: - ${DOCKERDIR}/appdata/hoarder/hoarder/data:/app/data - ./entrypoint.sh:/entrypoint.sh:ro environment: - TZ=${TZ} - PUID=${PUID} # This line causes the issues the error mentioned above - PGID=${PGID} # This line causes the issues the error mentioned above - HOARDER_VERSION - DATA_DIR hoarder_chrome: image: gcr.io/zenika-hub/alpine-chrome:123 container_name: hoarder_chrome restart: unless-stopped user: ${PUID}:${PGID} # Is working fine command: - --no-sandbox - --disable-gpu - --disable-dev-shm-usage - --remote-debugging-address=0.0.0.0 - --remote-debugging-port=9222 - --hide-scrollbars security_opt: - no-new-privileges=true environment: - PUID=${PUID} # Is working fine - PGID=${PGID} # Is working fine hoarder_meilisearch: image: getmeili/meilisearch:v1.11.1 container_name: hoarder_meilisearch restart: unless-stopped user: ${PUID}:${PGID} security_opt: - no-new-privileges=true volumes: - ${DOCKERDIR}/appdata/hoarder/meilisearch/data:/meili_data environment: - PUID=${PUID} # Is working fine - PGID=${PGID} # Is working fine - MEILI_MASTER_KEY ```

kerem

2026-03-02 11:52:03 +03:00

closed this issue
added the
feature request

status/untriaged
labels

kerem commented

2026-03-02 11:52:04 +03:00

Author

Owner

@MohamedBassem commented on GitHub (Mar 2, 2025):

Thanks for the feature request. We're planning to address this in #606.

@MohamedBassem commented on GitHub (Mar 2, 2025): Thanks for the feature request. We're planning to address this in #606.

kerem referenced this issue

2026-03-02 11:53:22 +03:00

[GH-ISSUE #1355] Add Lists and RSS-Feeds, Rules to JSON-Export/-Import #867

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#703

No description provided.

Rows
Columns