First boot fails: Stalwart exits with "Permission denied" on /var/lib/stalwart

[DeveloperSarim]

Fresh clone, docker compose up -d, and the raymail-stalwart container dies immediately. The log ends with:

Failed to open database: IO error: While open a file for appending:
/var/lib/stalwart//LOG: Permission denied

The directory exists and I am running compose as root, so why can it not write?

[DeveloperSarim]

Running compose as root is exactly why it looks confusing: the containers do not run as root.

Both images drop privileges:

Container	Runs as	Bind mount
raymail-stalwart	uid 2000 (stalwart)	./stalwart/etc, ./stalwart/data
raymail-web	uid 1001 (raymail)	./data

When Docker creates a missing bind-mount source directory it makes it root-owned. The unprivileged process inside then cannot write to it, so RocksDB fails on its very first append and Stalwart exits. The web container hits the same wall a moment later when it tries to create its SQLite file.

Fix

cd raymail
mkdir -p stalwart/etc stalwart/data/logs data
sudo chown -R 2000:2000 stalwart/etc stalwart/data
sudo chown -R 1001:1001 data
docker compose up -d

Then confirm the ownership actually took:

ls -ldn stalwart/data data
# drwxr-xr-x  2000 2000  ...  stalwart/data
# drwxr-xr-x  1001 1001  ...  data

The numeric uids matter, not names — those users do not exist on the host, only inside the images, so chown stalwart:stalwart will fail.

Why install.sh does not hit this

The installer does this for you, which is the main reason to prefer it over a manual docker compose up on a first run. It also warns you when it cannot, because it is not running as root:

!  not running as root - if the containers fail to start, run:
   sudo chown -R 2000:2000 stalwart/etc stalwart/data
   sudo chown -R 1001:1001 data

Related symptom

If Stalwart starts but you see No TLS certificates available and ports 465/993 accept a connection but never complete a handshake, that is a different problem — no certificate is installed yet. Run sudo ./deploy/setup-tls.sh, then docker restart raymail-stalwart.