[GH-ISSUE #411] Docker: Unable to run as non-root user #237

New issue

Closed

opened 2026-03-03 01:27:04 +03:00 by kerem · 3 comments

kerem commented

2026-03-03 01:27:04 +03:00

Owner

Originally created by @rcdailey on GitHub (Feb 23, 2019).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/411

Using the latest tag as of today (2/23/2019), I'm unable to launch the docker image provided by @mprasil. I get this error after docker-compose run:

bitwarden | [2019-02-23 11:33:55][launch][INFO] Configured for staging.
bitwarden | [2019-02-23 11:33:55][launch_][INFO] address: 0.0.0.0
bitwarden | [2019-02-23 11:33:55][launch_][INFO] port: 80
bitwarden | [2019-02-23 11:33:55][launch_][INFO] log: normal
bitwarden | [2019-02-23 11:33:55][launch_][INFO] workers: 10
bitwarden | [2019-02-23 11:33:55][launch_][INFO] secret key: generated
bitwarden | [2019-02-23 11:33:55][launch_][INFO] limits: forms = 32KiB, json* = 10MiB
bitwarden | [2019-02-23 11:33:55][launch_][INFO] keep-alive: 5s
bitwarden | [2019-02-23 11:33:55][launch_][INFO] tls: disabled
bitwarden | [2019-02-23 11:33:55][rocket::fairing::fairings][INFO] Fairings:
bitwarden | [2019-02-23 11:33:55][_][INFO] 1 response: Application Headers
bitwarden | [2019-02-23 11:33:55][bitwarden_rs][ERROR] Launch error Bind(Io(Os { code: 13, kind: PermissionDenied, message: "Permission denied" }))

My docker-compose.yml is as follows:

version: '3.7'

services:
  app:
    image: mprasil/bitwarden
    container_name: bitwarden
    user: $UID:$GID
    networks:
      - reverse_proxy
    volumes:
      - ./data:/data
      - /etc/timezone:/etc/timezone:ro
    environment:
      - TZ=America/Chicago

networks:
  reverse_proxy:
    external: 'true'
    name: reverse_proxy

And yes, the permissions of my ./data directory are set properly. The same user referred to by UID and GID also owns the ./data directory.

Originally created by @rcdailey on GitHub (Feb 23, 2019). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/411 Using the `latest` tag as of today (2/23/2019), I'm unable to launch the docker image provided by @mprasil. I get this error after `docker-compose run`: ``` bitwarden | [2019-02-23 11:33:55][launch][INFO] Configured for staging. bitwarden | [2019-02-23 11:33:55][launch_][INFO] address: 0.0.0.0 bitwarden | [2019-02-23 11:33:55][launch_][INFO] port: 80 bitwarden | [2019-02-23 11:33:55][launch_][INFO] log: normal bitwarden | [2019-02-23 11:33:55][launch_][INFO] workers: 10 bitwarden | [2019-02-23 11:33:55][launch_][INFO] secret key: generated bitwarden | [2019-02-23 11:33:55][launch_][INFO] limits: forms = 32KiB, json* = 10MiB bitwarden | [2019-02-23 11:33:55][launch_][INFO] keep-alive: 5s bitwarden | [2019-02-23 11:33:55][launch_][INFO] tls: disabled bitwarden | [2019-02-23 11:33:55][rocket::fairing::fairings][INFO] Fairings: bitwarden | [2019-02-23 11:33:55][_][INFO] 1 response: Application Headers bitwarden | [2019-02-23 11:33:55][bitwarden_rs][ERROR] Launch error Bind(Io(Os { code: 13, kind: PermissionDenied, message: "Permission denied" })) ``` My `docker-compose.yml` is as follows: ```yml version: '3.7' services: app: image: mprasil/bitwarden container_name: bitwarden user: $UID:$GID networks: - reverse_proxy volumes: - ./data:/data - /etc/timezone:/etc/timezone:ro environment: - TZ=America/Chicago networks: reverse_proxy: external: 'true' name: reverse_proxy ``` And yes, the permissions of my `./data` directory are set properly. The same user referred to by `UID` and `GID` also owns the `./data` directory.

kerem closed this issue

2026-03-03 01:27:05 +03:00

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@mprasil commented on GitHub (Feb 23, 2019):

Please see #287. You're definitely missing environment variable ROCKET_PORTset to something above 1024 (only root can bind to first 1024 ports) and it seems like you also might need to add DATA_FOLDER set to /data.

Hope that helps, please continue any discussion under #287 to avoid duplicates.

@mprasil commented on GitHub (Feb 23, 2019): Please see #287. You're definitely missing environment variable `ROCKET_PORT`set to something above `1024` (only root can bind to first `1024` ports) and it seems like you also might need to add `DATA_FOLDER` set to `/data`. Hope that helps, please continue any discussion under #287 to avoid duplicates.

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@rcdailey commented on GitHub (Feb 23, 2019):

@mprasil Thank you, I will try what you have suggested. Could you please update your README to document these environment variables? https://hub.docker.com/r/mprasil/bitwarden

@rcdailey commented on GitHub (Feb 23, 2019): @mprasil Thank you, I will try what you have suggested. Could you please update your README to document these environment variables? https://hub.docker.com/r/mprasil/bitwarden

kerem commented

2026-03-03 01:27:06 +03:00

Author

Owner

@rcdailey commented on GitHub (Feb 23, 2019):

For anyone else that comes across this, this docker-compose.yml works with non-root user. I also have it set up to share my reverse proxy network so I can forward requests from NGINX to Bitwarden:

version: '3.7'

services:
  app:
    image: mprasil/bitwarden
    container_name: bitwarden
    restart: always
    user: $UID:$GID
    networks:
      - reverse_proxy
    volumes:
      - ./data:/data
      - /etc/timezone:/etc/timezone:ro
    environment:
      - TZ=America/Chicago
      - ROCKET_PORT=10080
      - DATA_FOLDER=/data

networks:
  reverse_proxy:
    external: 'true'
    name: reverse_proxy

@rcdailey commented on GitHub (Feb 23, 2019): For anyone else that comes across this, this `docker-compose.yml` works with non-root user. I also have it set up to share my reverse proxy network so I can forward requests from NGINX to Bitwarden: ```yml version: '3.7' services: app: image: mprasil/bitwarden container_name: bitwarden restart: always user: $UID:$GID networks: - reverse_proxy volumes: - ./data:/data - /etc/timezone:/etc/timezone:ro environment: - TZ=America/Chicago - ROCKET_PORT=10080 - DATA_FOLDER=/data networks: reverse_proxy: external: 'true' name: reverse_proxy ```