Selfhosted docker unable to run as non-root user

I am unable to run sourcebot as a non-root user. This is the error message I get when attempting to use a different user:

[Warning] AUTH_SECRET is not set.
[Info] Loading environment variables from /data/sourcebot/.authjs-secret
[Warning] AUTH_URL is not set.
[Info] Running database migration...
[Info] Running database migration...
Internal Error: EACCES: permission denied, open '/app/.yarn/install-state.gz'
Error: EACCES: permission denied, open '/app/.yarn/install-state.gz'
Internal Error: EACCES: permission denied, open '/app/.yarn/install-state.gz'
Error: EACCES: permission denied, open '/app/.yarn/install-state.gz'
sourcebot exited with code 0

It seems that everything in /app has root:root ownership, but it looks like non-root users should still be able to read the files in /app, so I'm not really sure what the problem is.

For reference:

/app # ls -la /app/.yarn/install-state.gz
-rw-r--r--    1 root     root       1331645 May 10 13:36 /app/.yarn/install-state.gz

Here's my overly complex docker compose file if anyone was curious:

# Sourcebot
# config.json docs: https://docs.sourcebot.dev/self-hosting/more/declarative-config
services:
  sourcebot:
    container_name: sourcebot
    image: ghcr.io/sourcebot-dev/sourcebot:latest
    restart: unless-stopped
    # TODO raise an issue to allow running as non-root - some permission error occurs
    #user: 2414:2414
    user: 0:0
    networks:
      - caddy_net-sourcebot
      - default
#    ports:
#      - "3000:3000"
    env_file:
      - ../timezone.env
    environment:
      - CONFIG_PATH=/config/config.json
      - DATA_DIR=/data
      - DATA_CACHE_DIR=/data/sourcebot
      - SOURCEBOT_TELEMETRY_DISABLED=true
      - DATABASE_URL=postgresql://postgres@postgres/sourcebot
      - REDIS_URL=redis://redis:6379
    volumes:
      - "/opt/containers/sourcebot/data:/data"
      - "./config:/config:ro"
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:3000/api/health || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    depends_on:
      - postgres
      - redis
  postgres:
    image: postgres:17-alpine
    restart: unless-stopped
    user: 2414:2414
    env_file:
      - ../timezone.env
    environment:
      - POSTGRES_DB=sourcebot
      - POSTGRES_HOST_AUTH_METHOD=trust
    volumes:
      - "/opt/containers/sourcebot/db:/var/lib/postgresql/data"
  redis:
    image: redis:8.0-alpine
    restart: unless-stopped
    user: 2414:2414
    env_file:
      - ../timezone.env
    volumes:
      - "/opt/containers/sourcebot/redis:/data"
networks:
  caddy_net-sourcebot:
    name: caddy_net-sourcebot
    external: true

Unfortunately this isn't a case we've really tested before. Is this a blocker for you to deploy Sourcebot? I'd love to understand why the non-root user is used here

I prefer to use non-root users for all of my containers in my homelab. It makes them slightly more secure and is best practice.

Definitely not a blocker, as I'll just go ahead and use the root user, but I like to report this kind of thing when I come across it.

I just hit the issue as well. We have policies in place to limit the use of root user as most as possible in our Kubernetes clusters. I temporarily made an exception for this container.

Same issue observed when trying to deploy on an OpenShift cluster with default restricted SCC (non-root).

Tried a workaround by adding an init container which is supposed to chown / chmod the /data/.sourcebot/ directory however I get chown: … Operation not permitted.
In the actual sourcebot pod logs there are entries such as:
su: must be suid to work properly and persistent waiting for database (localhost:5432 no response).

Most likely all of this is related to how OpenShift enforces security / permissions and that the container image or scripts use su (or expect root-like permissions) which are disallowed under the default SCC.

Any idea if Sourcebot is expected to support OpenShift’s non-root default SCC without customization (like SCC change or image changes)? If there are any workarounds or suggestions for deployment in OpenShift, please advise as I wasn't able to find anything related to this matter in the docs. Thanks in advance!

su: must be suid to work properly and persistent waiting for database (localhost:5432 no response).

That's postgres specific. You can run a postgres instance externally and point sourcebot to it via an env-var.
I don't know if that's the only thing in the container that needs su like rights or if that's just the first hurdle.

su: must be suid to work properly and persistent waiting for database (localhost:5432 no response).

That's postgres specific. You can run a postgres instance externally and point sourcebot to it via an env-var. I don't know if that's the only thing in the container that needs su like rights or if that's just the first hurdle.

Thanks, pointing it to an external postgresql was just the beginning however after a few other tweaks I was able to get it up and running.

I managed to get this working with a non-root user, but had to make some changes to the image as per PR I linked above. It would be nice if some of the interested folks reviewed/tested the changes just to confirm no additional permissions needs to be added.

This seems to be working mounting a dir that is owned by the user being used (sourcebot:1500):

mkdir /tmp/sourcebot
sudo chown 1500:1500 /tmp/sourcebot
docker run \
    -p 3000:3000 \
    --rm \
    -v /tmp/sourcebot:/data \
    --name sourcebot \
   docker.io/paulinhu/sourcebot:non-root

@retrodaredevil

would be nice if some of the interested folks reviewed/tested the changes just to confirm no additional permissions needs to be added.

CC @kquinsland @retrodaredevil @gaeljw @fdc-kspasova @66115707

@pjbgf

@pjbgf

Without mounting a directory for the data, the container fails to start at the Postgres stage:

$ podman run --rm -p 3000:3000 --user 1500:1500 docker.io/paulinhu/sourcebot:non-root

2025-09-21 14:34:51.612 UTC [15] LOG:  starting PostgreSQL 16.10 on x86_64-alpine-linux-musl, compiled by gcc (Alpine 13.2.1_git20231014) 13.2.1 20231014, 64-bit
2025-09-21 14:34:51.613 UTC [15] LOG:  listening on IPv6 address "::1", port 5432
2025-09-21 14:34:51.613 UTC [15] LOG:  listening on IPv4 address "127.0.0.1", port 5432
2025-09-21 14:34:51.613 UTC [15] FATAL:  could not create lock file "/run/postgresql/.s.PGSQL.5432.lock": Permission denied
2025-09-21 14:34:51.615 UTC [15] LOG:  database system is shut down
postgres failed to run

When mounting a directory for the data, it fails sooner:

$ mkdir /tmp/sourcebot
$ sudo chown 1500:1500 /tmp/sourcebot
$ podman run --rm -p 3000:3000 --user 1500:1500 -v /tmp/sourcebot:/data docker.io/paulinhu/sourcebot:non-root

[Info] Sourcebot version: 
[Warning] NEXT_PUBLIC_POSTHOG_PAPIK was not set. Setting SOURCEBOT_TELEMETRY_DISABLED.
[Info] Disabling telemetry since SOURCEBOT_TELEMETRY_DISABLED was set.
mkdir: can't create directory '/data/.sourcebot': Permission denied

I've used podman and --user 1500:1500.

I haven't tried with in a Kubernetes context but I'd assume a similar behaviour.

@gaeljw

@gaeljw Thank you for testing this. Please note that the user belongs to different groups due to the components running on this container (e.g. postgres, redis, etc). By running --user <UID>:<GID you are dropping all the additional groups:

 > docker run --rm --entrypoint sh docker.io/paulinhu/sourcebot:non-root -c id
uid=1500(sourcebot) gid=65533(nogroup) groups=70(postgres),101(redis),1000(node),65533(nogroup),65533(nogroup)
 > docker run --rm --entrypoint sh --user 1500 docker.io/paulinhu/sourcebot:non-root -c id
uid=1500(sourcebot) gid=65533(nogroup) groups=70(postgres),101(redis),1000(node),65533(nogroup),65533(nogroup)
 > docker run --rm --entrypoint sh --user 1500:1500 docker.io/paulinhu/sourcebot:non-root -c id
uid=1500(sourcebot) gid=1500(sourcebot) groups=1500(sourcebot)

Please try again by dropping the group or the flag altogether. However, if you believe we must run under a specific GID, then we would need to increase that GID (or the user) access accordingly.

Fixed in #599

Navigation Menu

Repository navigation

Selfhosted docker unable to run as non-root user #302

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Selfhosted docker unable to run as non-root user #302

Description

Activity

msukkari commented on May 10, 2025

retrodaredevil commented on May 10, 2025

gaeljw commented on Jun 6, 2025

fdc-kspasova commented on Sep 11, 2025

kquinsland01 commented on Sep 11, 2025

fdc-kspasova commented on Sep 15, 2025

pjbgf commented on Sep 17, 2025

brendan-kellam commented on Sep 17, 2025

gaeljw commented on Sep 21, 2025

pjbgf commented on Sep 22, 2025

brendan-kellam commented on Mar 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions