Rootless container throws permission error

[chris-fj]

Description

I can't setup the container as rootless. Following the docs instructions to set up the user inside the containr provokes a permissions error that dissapears when I uncomment the user key so the problem is in the key. Am I misunderstanding the usage of the key user? I have to admit that the docs could benefit of having the rootless section explained a little better

Steps to reproduce

I'm using docker compose and my docker-compose.yml file looks like this

# docker-compose file for running paperless from the docker container registry.
# This file contains everything paperless needs to run.
# Paperless supports amd64, arm and arm64 hardware.
#
# All compose files of paperless configure paperless in the following way:
#
# - Paperless is (re)started on system boot, if it was running before shutdown.
# - Docker volumes for storing data are managed by Docker.
# - Folders for importing and exporting files are created in the same directory
#   as this file and mounted to the correct folders inside the container.
# - Paperless listens on port 8000.
#
# In addition to that, this docker-compose file adds the following optional
# configurations:
#
# - Instead of SQLite (default), PostgreSQL is used as the database server.
# - Apache Tika and Gotenberg servers are started with paperless and paperless
#   is configured to use these services. These provide support for consuming
#   Office documents (Word, Excel, Power Point and their LibreOffice counter-
#   parts.
#
# To install and update paperless with this file, do the following:
#
# - Copy this file as 'docker-compose.yml' and the files 'docker-compose.env'
#   and '.env' into a folder.
# - Run 'docker-compose pull'.
# - Run 'docker-compose run --rm webserver createsuperuser' to create a user.
# - Run 'docker-compose up -d'.
#
# For more extensive installation and update instructions, refer to the
# documentation.

version: "3.4"
services:
  broker:
    image: redis:7
    restart: unless-stopped
    networks:
      - internal
    volumes:
      - redisdata:/data

  db:
    image: postgres:15
    restart: unless-stopped
    networks:
      - internal
    volumes:
      - ./pgdata:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: paperless
      POSTGRES_USER: paperless
      POSTGRES_PASSWORD: 'REDACTED'

  webserver:
    image: paperlessngx/paperless-ngx:1.17
    user: 1000:100
    restart: unless-stopped
    depends_on:
      - db
      - broker
      - gotenberg
      - tika
    ports:
      - "8000:8000"
    healthcheck:
      test: ["CMD", "curl", "-fs", "-S", "--max-time", "2", "http://localhost:8000"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - ./data:/usr/src/paperless/data
      - ./media:/usr/src/paperless/media
      - ./export:/usr/src/paperless/export
      - ./consume:/usr/src/paperless/consume
    env_file: docker-compose.env
    environment:
      PAPERLESS_REDIS: redis://broker:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_TIKA_ENABLED: 1
      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000
      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
    networks:
      - internal

  gotenberg:
    image: gotenberg/gotenberg:7.8
    restart: unless-stopped

    networks:
      - internal
    # The gotenberg chromium route is used to convert .eml files. We do not
    # want to allow external content like tracking pixels or even javascript.
    command:
      - "gotenberg"
      - "--chromium-disable-javascript=true"
      - "--chromium-allow-list=file:///tmp/.*"

  tika:
    networks:
      - internal
    image: ghcr.io/paperless-ngx/tika:latest
    restart: unless-stopped

volumes:
  data:
  media:
  pgdata:
  redisdata:

networks:
  internal:

My docker-compose.env file looks like this

# The UID and GID of the user used to run paperless in the container. Set this
# to your UID and GID on the host so that you have write access to the
# consumption directory.
USERMAP_UID=1000
USERMAP_GID=100

# Additional languages to install for text recognition, separated by a
# whitespace. Note that this is
# different from PAPERLESS_OCR_LANGUAGE (default=eng), which defines the
# language used for OCR.
# The container installs English, German, Italian, Spanish and French by
# default.
# See https://packages.debian.org/search?keywords=tesseract-ocr-&searchon=names&suite=buster
# for available languages.
#PAPERLESS_OCR_LANGUAGES=tur ces

###############################################################################
# Paperless-specific settings                                                 #
###############################################################################

# All settings defined in the paperless.conf.example can be used here. The
# Docker setup does not use the configuration file.
# A few commonly adjusted settings are provided below.

# This is required if you will be exposing Paperless-ngx on a public domain
# (if doing so please consider security measures such as reverse proxy)
#PAPERLESS_URL=https://paperless.example.com

# Adjust this key if you plan to make paperless available publicly. It should
# be a very long sequence of random characters. You don't need to remember it.
#PAPERLESS_SECRET_KEY=change-me

# Use this variable to set a timezone for the Paperless Docker containers. If not specified, defaults to UTC.
PAPERLESS_TIME_ZONE=UTC

# The default language to use for OCR. Set this to the language most of your
# documents are written in.
PAPERLESS_OCR_LANGUAGE=eng

# Set if accessing paperless via a domain subpath e.g. https://domain.com/PATHPREFIX and using a reverse-proxy like traefik or nginx
#PAPERLESS_FORCE_SCRIPT_NAME=/PATHPREFIX
#PAPERLESS_STATIC_URL=/PATHPREFIX/static/ # trailing slash required
#
PAPERLESS_DBNAME=paperless
PAPERLESS_DBUSER=paperless
PAPERLESS_DBPASS=REDACTED

and uid/gid information:

id $(whoami)
uid=1000(<my-user>) gid=100(users) groups=473(docker),100(users)

I want to run the container in rootless mode so I added user: 1000:100 under webserver, which is the uid/gid of the user running the container, as per the docs:

Rootless

If you want to run Paperless as a rootless container, you will need to do the following in your docker-compose.yml:

set the user running the container to map to the paperless user in the container. This value (user_id below), should be the same id that USERMAP_UID and USERMAP_GID are set to in the next step. See USERMAP_UID and USERMAP_GID here.

Webserver logs

Adding the `user` key provokes the following error:


paperless-webserver-1  | Paperless-ngx docker container starting...
paperless-webserver-1  | Mapping UID and GID for paperless:paperless to 1000:100
paperless-webserver-1  | usermod: no changes
paperless-webserver-1  | groupmod: Permission denied.
paperless-webserver-1  | groupmod: cannot lock /etc/group; try again later.

that loops indefinitely

### Browser logs

_No response_

### Paperless-ngx version

1.17.1

### Host OS

arm64 openSUSE 15.4

### Installation method

Docker - official image

### Browser

_No response_

### Configuration changes

I think the only changes respect with the original compose file is that I used docker hub for the source of the images, changed the volumes to have them all in the same folder and added an internal network

### Other

_No response_

[stumpylog]

That was adding #1212, perhaps @theEndBeta could explain more

[tillmann]

I am currently having the same problem. From what I can see, running rootless as described in the documentation fails if

• we want to install additional ocr languages or if
• we run with uid/gid different from 1000/1000

because then we cannot run as user "paperless" as suggested by the documentation or by the discussion in #1212 .

[steakhutzeee]

I'm experiencing the same issue.

[jcrespy]

I forgot to write back here. I don't remember where i found this, but removing the user line completely from compose file fixed this for me. Unless something else change that I'm not aware of. Can you guys try this ?

[kingp0dd]

that makes the container run as root doesn't it?

[kingp0dd]

tried this again, it works if USERMAP_UID is indeed 1000. But my CIFS volume permissions UID is 1002, so it wouldn't work. Is it intended that rootless is only possible if UID is 1000? @theEndBeta @shamoon

[srwareham]

@kingp0dd The solution I described works for me with an arbitrary UID. Mine is something like 4104 and still works.

I did discover basically the same thing you did. If it doesn't run as 1000, the default setup here seems broken. I'd prefer to use docker-level restrictions on the user that runs the service, but that doesn't seem to work. So I've settled for having the docker config technically permit the service to run with whatever user it wants (i.e., isn't really rootless), but tell the service itself to run with my desired UID/GID. This at least gets the permissions correct for the files bind mounted to the host.

[bbqf]

I had the same issue, after experimenting with the options, here's how it works for me (deployed in k8s, directory mounted over nfs):
container spec:
securityContext:
runAsUser: 1000
runAsGroup: 1003
fsGroup: 1003
env:
- name: USERMAP_UID
value: "1000"
Do NOT set USERMAP_GID

everything works as it should for me (I am ok with the uid 1000, it doesn't matter how it's called on the host, it's called "paperless" within the container":

dh:/data$ kubectl exec -it paperless-ngx-5874d65479-hx7sz -n paperless-ngx -- /bin/sh
$ id -a
uid=1000(paperless) gid=1003 groups=1003
$ cd /usr/src/paperless
$ ls -al
total 52
drwxr-xr-x 1 paperless paperless 4096 Feb 20 08:20 .
drwxr-xr-x 1 root      root      4096 Jan 19 01:49 ..
drwxr-xr-x 2 paperless      1003 4096 Feb 20 08:20 __pycache__
drwxrwxr-x 2 paperless      1003 4096 Feb 20 08:20 consume
drwxr-xr-x 4 paperless      1003 4096 Feb 20 08:30 data
drwxr-xr-x 2 paperless      1003 4096 Jul 20  2022 export
-rw-r--r-- 1 paperless paperless 1369 Jan 19 01:48 gunicorn.conf.py
drwxr-xr-x 3 paperless      1003 4096 Feb 20 08:20 media
drwxr-xr-x 1 paperless paperless 4096 Feb 20 08:20 src
drwxr-xr-x 8 paperless paperless 4096 Jan 28 20:59 static

Note: don't forget to set PAPERLESS_CONSUMER_POLLING if you want to use consume directory mounted over nfs.

[lloydjatkinson]

I'm confused as to why rootless != multiple ocr languages - can the docker image not contain multiple languages so they don't need to be installed after?

[MrModest]

@stumpylog maybe use some workaround? like allow user to download all needed files and mount them to the container, so the paperless won't try to download and install them automatically, hence won't require root privileges 🤔

[gawa971]

Here's my workaround: I build a new container image which include my tesseract languages, based on the official paperless container image. It's a minimalist Dockerfile, a very small deviation from the official paperless image:

Dockerfile:

# Change the tag accordingly
FROM ghcr.io/paperless-ngx/paperless-ngx:2.12.1

# install my tesseract languages (here eng+deu+hin for instance. Add as many as you wish.)
RUN apt-get update && apt-get install -y tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-hin

To build the image on the host where you intend to run it: docker build -f Dockerfile -t my-local-paperless-ngx:2.12.1

Then, in your docker-compose.yml, use your image (that exist only locally on your host): localhost/my-local-paperless-ngx:2.12.1

Finally, to make sure your docker-entrypoint.sh never tries to perform a root action (apt) with the rootless/unprivileged user, you should unset the env variable PAPERLESS_OCR_LANGUAGES. It's basically telling your docker-entrypoint to stop trying to manage the installation of tesseract packages (since you baked them in the image yourself).

[MrModest]

Can I change the running user as well with the custom Dockerfile? Being depended on the custom ID 5050 is also a bit annoying since I have my own user that I use to run docker apps :D

[gawa971]

TBH I'm not really sure what you're trying to achieve. But maybe it can give you some ideas: here is a dockerfile you can try.

FROM ghcr.io/paperless-ngx/paperless-ngx:2.12.1

# install your tesseract packages
RUN apt-get update && apt-get install -y tesseract-ocr-eng tesseract-ocr-deu tesseract-ocr-hin tesseract-ocr-whatever...

# change UID and GID of user paperless inside container
# ( user paperless was initially created with 1000:1000 here: https://github.com/paperless-ngx/paperless-ngx/blob/f6135f9ad0a030893e7a3ee4fc4ff2c422ed524a/Dockerfile#L271-L272 )
RUN usermod --non-unique --uid 6666 paperless && groupmod --non-unique --gid 6666 paperless

# chown the app directory to make sure all files are owned by paperless with new UIDs:GIDs 6666:6666
RUN chown --recursive paperless:paperless /usr/src/paperless

# This is not necessary if you intend to override this in your docker-compose.yml file.
# You can uncomment this and NOT specify a `user: 6666:6666` in your docker-compose.yml file.
#USER 6666:6666

Then, start the container with the following config:

• in docker-compose.yml : set user: 6666:6666 for your container named webserver (the app paperless)
• in docker-compose.env : set the env vars USERMAP_UID and USERMAP_GID to 6666
• you should also probably do by yourself on your host a mkdir and chown of the paths you bind mount for paperless. (Although in theory, you chose 6666 because it was a uid of an existing linux user on your host, so if paperless detects it has to do this, it will probably succeed when running those commands)
  • mkdir -p consume data export media
  • chown --recursive 6666:6666 consume data export media

Now your docker container runs with an unprivileged user named "paperless" with id/gid 6666:6666. The entrypoint.sh won't fail with the usermod and groupmod commands because in your new image, this part of the script will run like this:

	local -r usermap_original_uid=$(id -u paperless) # var = 6666
	local -r usermap_original_gid=$(id -g paperless) # var = 6666
	local -r usermap_new_uid=${USERMAP_UID} # you set USERMAP_UID to 6666
	local -r usermap_new_uid=${USERMAP_UID} # you set USERMAP_GID to 6666

	if [[ ${usermap_new_uid} != "${usermap_original_uid}" ...... ]]; then # will give you : if 6666 != 6666 ....
                # .... so you will enter in this case
		usermod --non-unique --uid "${usermap_new_uid}" paperless
		groupmod --non-unique --gid "${usermap_new_gid}" paperless
	fi

[MrModest]

Somehow I missed your last reply. That looks like exactly what I wanted. I'll try it once I get time.

Than you 🙏

[github-actions[bot]]

This discussion has been automatically closed due to inactivity. Please see our contributing guidelines for more details.

[github-actions[bot]]

This discussion has been automatically locked since there has not been any recent activity after it was closed. Please open a new discussion for related concerns. See our contributing guidelines for more details.