starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-26 00:16:03 +03:00

[GH-ISSUE #1324] Docker: Permission Errors (EACCES) when running container as non-root user #846

New issue

Closed

opened 2026-03-02 11:53:13 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 11:53:13 +03:00

Owner

Originally created by @monstermuffin on GitHub (Apr 28, 2025).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1324

Describe the Bug

Running the Karakeep Docker image with user: directive set to a non-root user ID/GID causes issues with the app.

The container fails on startup due to permission errors (EACCES) when trying to write to directories owned by root within the image:

Corepack Cache:

    Error: EACCES: permission denied, mkdir '/.cache/node/corepack/v1'

Next.js Cache: (Occurs even after working around the first issue):

    Error: EACCES: permission denied, mkdir '/app/apps/web/.next/cache'

Workaround for Corepack:
I am able to get Karakeep to stat by setting XDG_CACHE_HOME=/data/.cache which fixes the corepack perm issue but not the .next/cache issue when using the app.

I could volume mount .next/cache but this is an imperfect workaround.

Steps to Reproduce

Add the user: "UID:GID" directive, specifying a non-root user/group ID from the host into compose.
Chown the /data volume mount point on the host to the UID:GID.
Start app.

Expected Behaviour

The container should run successfully when the user: directive is specified, without requiring manual workarounds. Internal processes should write necessary runtime files/caches to user-writable locations, such as the configured /data volume. Running as non-root is a common security practice.

Screenshots or Additional Context

Could the Docker image or application be updated to handle execution as a non-root user more gracefully, ensuring caches and temporary files are written to appropriate, user-writable locations by default?

My Ansible deploy workflow for containers ensures all containers are run as their own non-root user with their own volume mounts for security purposes, Karakeep should be able to be run in this way.

Device Details

No response

Exact Karakeep Version

0.24.1

Have you checked the troubleshooting guide?

I have checked the troubleshooting guide and I haven't found a solution to my problem

Originally created by @monstermuffin on GitHub (Apr 28, 2025). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/1324 ### Describe the Bug Running the Karakeep Docker image with `user:` directive set to a non-root user ID/GID causes issues with the app. The container fails on startup due to permission errors (EACCES) when trying to write to directories owned by root within the image: Corepack Cache: ``` Error: EACCES: permission denied, mkdir '/.cache/node/corepack/v1' ``` Next.js Cache: (Occurs even after working around the first issue): ``` Error: EACCES: permission denied, mkdir '/app/apps/web/.next/cache' ``` **Workaround for Corepack:** I am able to get Karakeep to stat by setting `XDG_CACHE_HOME=/data/.cache` which fixes the corepack perm issue but not the `.next/cache` issue when using the app. I could volume mount `.next/cache` but this is an imperfect workaround. ### Steps to Reproduce - Add the user: "UID:GID" directive, specifying a non-root user/group ID from the host into compose. - Chown the /data volume mount point on the host to the UID:GID. - Start app. ### Expected Behaviour The container should run successfully when the user: directive is specified, without requiring manual workarounds. Internal processes should write necessary runtime files/caches to user-writable locations, such as the configured /data volume. Running as non-root is a common security practice. ### Screenshots or Additional Context Could the Docker image or application be updated to handle execution as a non-root user more gracefully, ensuring caches and temporary files are written to appropriate, user-writable locations by default? My Ansible deploy workflow for containers ensures all containers are run as their own non-root user with their own volume mounts for security purposes, Karakeep should be able to be run in this way. ### Device Details _No response_ ### Exact Karakeep Version 0.24.1 ### Have you checked the troubleshooting guide? - [x] I have checked the troubleshooting guide and I haven't found a solution to my problem

kerem

2026-03-02 11:53:13 +03:00

closed this issue
added the
bug

status/untriaged
labels

kerem referenced this issue

2026-03-02 11:59:03 +03:00

[PR #1209] [MERGED] ui(web): Copy link button greyed out when clipboard not available #1758

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#846

No description provided.

Rows
Columns