Authentication with ultra-lite docker image

[Skaldhor]

According to the docs at https://docs.stirlingpdf.com/Configuration/Security/System%20and%20Security/#authentication-setup authentication with ultra-lite docker image should with ENVs

SECURITY_ENABLELOGIN: true
DISABLE_ADDITIONAL_FEATURES: false

However, when starting the container, there is no login and I'm automatically signed in as a default "User".

full compose would be:

# https://github.com/Stirling-Tools/Stirling-PDF
services:
  stirling-pdf:
    image: "ghcr.io/stirling-tools/stirling-pdf:latest-ultra-lite"
    hostname: "stirling-pdf"
    container_name: "stirling-pdf"
    environment:
      SECURITY_ENABLELOGIN: true
      DISABLE_ADDITIONAL_FEATURES: false
      SECURITY_LOGINMETHOD: "all"
      SECURITY_INITIALLOGIN_USERNAME: "admin"
      SECURITY_INITIALLOGIN_PASSWORD: "yourSecurePassword123"
      LANGS: "de_DE"  # en_US, en_GB, de_DE
    volumes:
      - "/volume1/docker/stirling-pdf/configs:/configs"
      - "/volume1/docker/stirling-pdf/logs:/logs"
    networks:
      - "reverse-proxy"
    mem_limit: "500m"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/api/v1/info/status"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
      start_interval: 2s
    restart: "unless-stopped"

networks:
  reverse-proxy:
    external: true

What am I missing here? Is auth really supported with the ultra-lite docker image?

[dosubot[bot]]

Hi @Skaldhor! I'm Dosu and I'm helping the Stirling-tools team.

Authentication is not supported in latest-ultra-lite, regardless of what environment variables you set. Setting DISABLE_ADDITIONAL_FEATURES: false in your compose file has no effect on that image.

The reason is that the ultra-lite image's JAR is compiled at build time with DISABLE_ADDITIONAL_FEATURES=true as a Gradle build argument — it's baked into the artifact itself, not a runtime toggle [1]. Login functionality lives in a separate "with-login" security JAR that gets downloaded at container startup by download-security-jar.sh, but only when DISABLE_ADDITIONAL_FEATURES is false at runtime [2]. Even though the ultra-lite entrypoint (init-without-ocr.sh) does contain logic to call that download script, the base JAR was already built without login features, so downloading a security JAR on top of it wouldn't fully resolve the issue — and the ultra-lite Dockerfile doesn't even include the download script [3]. The official ultra-lite compose example confirms this by hardcoding DISABLE_ADDITIONAL_FEATURES: "true" and SECURITY_ENABLELOGIN: "false" [4].

The docs page you linked does state the prerequisite clearly: "For security features to be enabled, you must use the security jar. For Docker users, this means setting DISABLE_ADDITIONAL_FEATURES to false" — but the security jar simply isn't what ships in the ultra-lite image.

To get authentication, switch to the latest or latest-fat tag. Those are built with DISABLE_ADDITIONAL_FEATURES=false [5], so your SECURITY_ENABLELOGIN=true setting will actually work there. Ultra-lite is intentionally a minimal, no-login variant designed for lightweight core PDF manipulation only [6].

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.