[GH-ISSUE #1910] [vaultwarden::db::sqlite_migrations][ERROR] Error creating database directory when using Postgres #1105

New issue

Closed

opened 2026-03-03 02:06:18 +03:00 by kerem · 5 comments

kerem commented 2026-03-03 02:06:18 +03:00

Owner

Copy link

Originally created by @cschmatzler on GitHub (Aug 16, 2021).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1910

Subject of the issue

Using a DATABASE_URL env variable starting with postgres://, Vaultwarden still tries to run SQLite migrations and fails at https://github.com/dani-garcia/vaultwarden/blob/main/src/db/mod.rs#L291. Data directory is writeable since the keys are created successfully.

Deployment environment

Debian Bullseye with Docker version 20.10.8, build 3967b7d

• vaultwarden version: Docker image vaultwarden/server:1.22.2

• Install method:

docker run --rm --name vaultwarden \
                        --log-driver=none \
                        --user 1500:1500 \
                        --cap-drop=ALL \
                        --cap-add=DAC_OVERRIDE \
                        --tmpfs=/tmp:rw,noexec,nosuid,size=100m \
                        --network={redacted} \
                        --env-file=/{redacted}/vaultwarden/env-vaultwarden \
                        --mount type=bind,src=/{redacted}/vaultwarden/data,dst=/data \
                        --mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \
                        --mount type=bind,src=/etc/timezone,dst=/etc/timezone,ro \
                        --mount type=bind,src=/etc/localtime,dst=/etc/localtime,ro \
                        vaultwarden/server:1.22.2

• MySQL/MariaDB or PostgreSQL version: postgres:13.3

• Other relevant details:

> ls -l data
total 12
drwxr-xr-x 2 1500 1500 4096 Aug 16 20:44 icon_cache
-rw-r--r-- 1 1500 1500 1675 Aug 16 20:44 rsa_key.pem
-rw-r--r-- 1 1500 1500 451 Aug 16 20:44 rsa_key.pub.pem

env-vaultwarden:

ROCKET_PORT=8080

DATABASE_URL="postgresql://{redacted}:{redacted}@postgres/vaultwarden"

Running it under root uid works.

Steps to reproduce

Create the env file, a postgres database, data dir with correct owner and run the above command to launch the docker image.

Expected behaviour

SQLite migrations should be skipped and container should launch.

Actual behaviour

Container stops at SQLite migrations failing

Troubleshooting data

[2021-08-16 20:43:49.406][vaultwarden][INFO] Private key created correctly.
[2021-08-16 20:43:49.407][vaultwarden][INFO] Public key created correctly.
[2021-08-16 20:43:49.407][vaultwarden::db::sqlite_migrations][ERROR] Error creating database directory

Originally created by @cschmatzler on GitHub (Aug 16, 2021). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1910 ### Subject of the issue Using a `DATABASE_URL` env variable starting with `postgres://`, Vaultwarden still tries to run SQLite migrations and fails at https://github.com/dani-garcia/vaultwarden/blob/main/src/db/mod.rs#L291. Data directory is writeable since the keys are created successfully. ### Deployment environment Debian Bullseye with Docker `version 20.10.8, build 3967b7d` * vaultwarden version: Docker image `vaultwarden/server:1.22.2` * Install method: ``` docker run --rm --name vaultwarden \ --log-driver=none \ --user 1500:1500 \ --cap-drop=ALL \ --cap-add=DAC_OVERRIDE \ --tmpfs=/tmp:rw,noexec,nosuid,size=100m \ --network={redacted} \ --env-file=/{redacted}/vaultwarden/env-vaultwarden \ --mount type=bind,src=/{redacted}/vaultwarden/data,dst=/data \ --mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \ --mount type=bind,src=/etc/timezone,dst=/etc/timezone,ro \ --mount type=bind,src=/etc/localtime,dst=/etc/localtime,ro \ vaultwarden/server:1.22.2 ``` * MySQL/MariaDB or PostgreSQL version: `postgres:13.3` * Other relevant details: ``` > ls -l data total 12 drwxr-xr-x 2 1500 1500 4096 Aug 16 20:44 icon_cache -rw-r--r-- 1 1500 1500 1675 Aug 16 20:44 rsa_key.pem -rw-r--r-- 1 1500 1500 451 Aug 16 20:44 rsa_key.pub.pem ``` env-vaultwarden: ``` ROCKET_PORT=8080 DATABASE_URL="postgresql://{redacted}:{redacted}@postgres/vaultwarden" ``` Running it under root uid works. ### Steps to reproduce Create the env file, a postgres database, data dir with correct owner and run the above command to launch the docker image. ### Expected behaviour SQLite migrations should be skipped and container should launch. ### Actual behaviour Container stops at SQLite migrations failing ### Troubleshooting data ``` [2021-08-16 20:43:49.406][vaultwarden][INFO] Private key created correctly. [2021-08-16 20:43:49.407][vaultwarden][INFO] Public key created correctly. [2021-08-16 20:43:49.407][vaultwarden::db::sqlite_migrations][ERROR] Error creating database directory ```

kerem closed this issue 2026-03-03 02:06:18 +03:00

kerem commented 2026-03-03 02:06:19 +03:00

Author

Owner

Copy link

@BlackDex commented on GitHub (Aug 16, 2021):

I'm having no issues using postgresql.
Are you sure the correct env is loaded? Since sqlite is default, i think those env's you try to load arn't working.
Try to add LOG_LEVEL=debug or trace and see if the output changes.

<!-- gh-comment-id:899796548 --> @BlackDex commented on GitHub (Aug 16, 2021): I'm having no issues using postgresql. Are you sure the correct env is loaded? Since sqlite is default, i think those env's you try to load arn't working. Try to add LOG_LEVEL=debug or trace and see if the output changes.

kerem commented 2026-03-03 02:06:19 +03:00

Author

Owner

Copy link

@cschmatzler commented on GitHub (Aug 16, 2021):

Running

docker run --rm --name vaultwarden \
                        --log-driver=none \
                        --user 1500:1500 \
                        --cap-drop=ALL \
                        --cap-add=DAC_OVERRIDE \
                        --tmpfs=/tmp:rw,noexec,nosuid,size=100m \
                        --network={redacted} \
                        --env-file=/{redacted}/vaultwarden/env-vaultwarden \
                        --mount type=bind,src=/{redacted}/vaultwarden/data,dst=/data \
                        --mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \
                        --mount type=bind,src=/etc/timezone,dst=/etc/timezone,ro \
                        --mount type=bind,src=/etc/localtime,dst=/etc/localtime,ro \
                        vaultwarden/server:1.22.2 \
                        printenv

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=ad541f43b05b
ROCKET_PORT=8080
LOG_LEVEL=trace
DATABASE_URL="postgresql://{redacted}:{redacted}@postgres/vaultwarden"
ROCKET_ENV=staging
ROCKET_WORKERS=10
HOME=/{redacted}

Passing the DATABASE_URL environment variable to psql connects to the database successfully.

> psql "postgresql://{redacted}:{redacted}@postgres/vaultwarden"

psql (13.3 (Debian 13.3-1.pgdg100+1))
Type "help" for help.

vaultwarden=# 

<!-- gh-comment-id:899864984 --> @cschmatzler commented on GitHub (Aug 16, 2021): Running ``` docker run --rm --name vaultwarden \ --log-driver=none \ --user 1500:1500 \ --cap-drop=ALL \ --cap-add=DAC_OVERRIDE \ --tmpfs=/tmp:rw,noexec,nosuid,size=100m \ --network={redacted} \ --env-file=/{redacted}/vaultwarden/env-vaultwarden \ --mount type=bind,src=/{redacted}/vaultwarden/data,dst=/data \ --mount type=bind,src=/etc/passwd,dst=/etc/passwd,ro \ --mount type=bind,src=/etc/timezone,dst=/etc/timezone,ro \ --mount type=bind,src=/etc/localtime,dst=/etc/localtime,ro \ vaultwarden/server:1.22.2 \ printenv ``` ``` PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ad541f43b05b ROCKET_PORT=8080 LOG_LEVEL=trace DATABASE_URL="postgresql://{redacted}:{redacted}@postgres/vaultwarden" ROCKET_ENV=staging ROCKET_WORKERS=10 HOME=/{redacted} ``` Passing the `DATABASE_URL` environment variable to `psql` connects to the database successfully. ``` > psql "postgresql://{redacted}:{redacted}@postgres/vaultwarden" psql (13.3 (Debian 13.3-1.pgdg100+1)) Type "help" for help. vaultwarden=# ```

kerem commented 2026-03-03 02:06:20 +03:00

Author

Owner

Copy link

@cschmatzler commented on GitHub (Aug 16, 2021):

Let's minimize a little:

docker run --rm --name vaultwarden --user 1500:1500 --env-file=/{redacted}/vaultwarden/env-vaultwarden --mount type=bind,src=/{redacted}/vaultwarden/data,dst=/data vaultwarden/server:1.22.2

results in the same.
Omitting the user flag and running it as root does start the container and logs Running migration a bunch, and brings up the web vault... but does not write anything to the Postgres database and loses all data after a container restart, so it's writing somewhere in the ephemeral file system.

Which is very interesting, because it also logs

[2021-08-16 22:53:32.746][vaultwarden][INFO] Private key created correctly.
[2021-08-16 22:53:32.746][vaultwarden][INFO] Public key created correctly.

and if it was defaulting to sqlite...

database_url:           String, false,  auto,   |c| format!("{}/{}", c.data_folder, "db.sqlite3");

https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs#L302

rsa_key_filename:       String, false,  auto,   |c| format!("{}/{}", c.data_folder, "rsa_key");

https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs#L314

are both using c.data_folder, which has write permissions even for my 1500:1500 user, because the rsa_key path can be created and does persist between container restarts.

<!-- gh-comment-id:899871221 --> @cschmatzler commented on GitHub (Aug 16, 2021): Let's minimize a little: ``` docker run --rm --name vaultwarden --user 1500:1500 --env-file=/{redacted}/vaultwarden/env-vaultwarden --mount type=bind,src=/{redacted}/vaultwarden/data,dst=/data vaultwarden/server:1.22.2 ``` results in the same. Omitting the `user` flag and running it as root *does* start the container and logs `Running migration` a bunch, and brings up the web vault... but does not write anything to the Postgres database and loses all data after a container restart, so it's writing somewhere in the ephemeral file system. Which is very interesting, because it also logs ``` [2021-08-16 22:53:32.746][vaultwarden][INFO] Private key created correctly. [2021-08-16 22:53:32.746][vaultwarden][INFO] Public key created correctly. ``` and if it was defaulting to sqlite... ``` database_url: String, false, auto, |c| format!("{}/{}", c.data_folder, "db.sqlite3"); ``` https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs#L302 ``` rsa_key_filename: String, false, auto, |c| format!("{}/{}", c.data_folder, "rsa_key"); ``` https://github.com/dani-garcia/vaultwarden/blob/main/src/config.rs#L314 are both using `c.data_folder`, which has write permissions even for my `1500:1500` user, because the `rsa_key` path *can* be created and *does* persist between container restarts.

kerem commented 2026-03-03 02:06:20 +03:00

Author

Owner

Copy link

@cschmatzler commented on GitHub (Aug 16, 2021):

Found the issue.
DATABASE_URL may not be quoted, neither in single nor in double quotes. This is in contrast to the wiki entry here, which gives

To run the binary or container ensure the DATABASE_URL environment variable is set (i.e. DATABASE_URL='postgresql://<user>:<password>@postgresql/bitwarden')
as an example.

The server should probably allow quoted environment variables? When passing a quoted variable as -e DATABASE_URL='...', Docker automatically unquotes it, but as --env-file, it stays quoted.

<!-- gh-comment-id:899875339 --> @cschmatzler commented on GitHub (Aug 16, 2021): Found the issue. `DATABASE_URL` may not be quoted, neither in single nor in double quotes. This is in contrast to the wiki entry [here](https://github.com/dani-garcia/vaultwarden/wiki/Using-the-PostgreSQL-Backend), which gives > To run the binary or container ensure the `DATABASE_URL` environment variable is set (i.e. `DATABASE_URL='postgresql://<user>:<password>@postgresql/bitwarden'`) as an example. The server should probably allow quoted environment variables? When passing a quoted variable as `-e DATABASE_URL='...'`, Docker automatically unquotes it, but as `--env-file`, it stays quoted.

kerem commented 2026-03-03 02:06:20 +03:00

Author

Owner

Copy link

@jjlin commented on GitHub (Aug 16, 2021):

It's generally not the application's job to do more unquoting on environment variables, as the user might want an env var to have a quoted value. Unfortunately, there is not really any standard for env file syntax, so different tools can handle it differently.

I've updated https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview#loading-environment-variables-from-a-file to mention this pitfall with --env-file. That wiki page covers other ways to load env files as well.

<!-- gh-comment-id:899886489 --> @jjlin commented on GitHub (Aug 16, 2021): It's generally not the application's job to do more unquoting on environment variables, as the user might want an env var to have a quoted value. Unfortunately, there is not really any standard for env file syntax, so different tools can handle it differently. I've updated https://github.com/dani-garcia/vaultwarden/wiki/Configuration-overview#loading-environment-variables-from-a-file to mention this pitfall with `--env-file`. That wiki page covers other ways to load env files as well.

kerem referenced this issue 2026-03-03 09:08:47 +03:00

[PR #1112] [MERGED] Add more docs on the email_token_size setting #2885

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

revert-7033-patch-1

cached-config-operations

test_dylint

1.35.8

1.35.7

1.35.6

1.35.5

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels   

SSO

  

Third party

  

better for forum

  

bug

  

bug

  

documentation

  

duplicate

  

enhancement

  

future Vault

  

future Vault

  

future Vault

  

good first issue

  

help wanted

  

low priority

  

notes

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

troubleshooting

  

wontfix

No labels

SSO

Third party

better for forum

bug

bug

documentation

duplicate

enhancement

future Vault

future Vault

future Vault

good first issue

help wanted

low priority

notes

pull-request

question

troubleshooting

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/vaultwarden#1105

No description provided.