Official docker Piwigo Image tips (feedbacks) and issues

[Phil353556]

Hello,

I plan to migrate my piwigo installation to a docker configuration with the official image.
So first, I test it on pi test platform:
HW: Raspberry Pi 4 Model B Rev 1.5
OS: Debian GNU/Linux 13 (trixie) aarch64
Kernel: Linux 6.12.47+rpt-rpi-v8
docker --version: Docker version 29.1.2, build 890dcca

I follow the documentation available here: https://piwigo.org/guides/install/docker
(note: screenshots are from 15.7.0 piwigo version not 16.1;-) )

1/ in the compose.yaml file, the following standza

   networks:
      piwigo-network:
        external: false

is well placed (at the beginning of the file) IF docker is only used for piwigo (and its DB).
Otherwise the standza must be placed at the end of the file (after piwigo-main: and piwigo-db: , not the beginning, otherwise docker displays the following message:

 $ docker compose up -d
validating /home/user/docker/docker-compose.yaml: networks.piwigo-db additional properties 'environment', 'image', 'networks', 'restart', 'volumes' not allowed

This is in the case of only one docker-compose.yaml file for many containers (not only for piwigo)

2/ "Step 2 - Configure the reverse proxy"
Not yet tested. In the future it will be configured with a traefik container

3/ Both containers are up and running

docker logs docker-piwigo-main-1  shows
...
cont-init: info: running /etc/cont-init.d/10-piwigo-setup
Installing piwigo version 16.1.0
No user script found; you can optionally add one in ./piwigo-data/scripts/user.sh
...

However there is nothing in the documentation about scripts? What kind of scripts can be placed there?

The installation is successful

4/ owner/group issues
piwigo directory and files belongs to dhcpcd for the owner and _ssh for the group

from the container, /var/www/html/piwigo belongs to nginx:nginx (or UID 100 and GID 101)

mysql directory and files belongs to 999 for the owner and systemd-journal for the group
because there is no userid on the pi with 999 as uid, the gid 999 maps to systemd-journal group.

from the container, /var/lib/mysql belongs to mysql:mysql (or UID 999 and GID 999)

scripts directory belong to root:root , why not.

It is not possible to basicaly copy image files and video in ./piwigo-data/piwigo

$ cp  ~/2025-12-27_15-19-20_IMG_7913.JPG .
cp: impossible de créer le fichier standard './2025-12-27_15-19-20_IMG_7913.JPG': Permission non accordée

How to map uid:gid of the user to avoid dhcpcd:_ssh between the OS and the container?

On raspberry pi os:

$ grep 100 /etc/passwd
dhcpcd:x:100:65534:DHCP Client Daemon:/usr/lib/dhcpcd:/bin/false

 $ grep 101 /etc/group
_ssh:x:101:

5/ For testing, copy of an image file with sudo in ./galleries and changing owner/group to dhcpcd: _ssh
Nothing happens during piwigo synchronization [ admin -> tools -> synchro (and yes directories and files) not directories only ]

It works when a sub-directory is added with an image in it

Then all thumbtails are correctly generated and checksum calculation is ok, too.

Thanks for your help
Regards
Phil

[Renarde-dev]

Hi, thanks a lot for your feedback.

I'm not sure I understand point 1, we should put the network declaration bellow ?

We have a small snippet in the README (https://github.com/Piwigo/piwigo-docker?tab=readme-ov-file#advanced-options) about scripts but since it's reserved to advanced users so I didn't add it to the doc.
All dependency are already included for the most common plugins.

The permission issue you encountered while copying file is a problem and I need to think of a way to solve it.
You are right that most of the file belong to the nginx user uid=100(nginx) gid=101(nginx) groups=101(nginx),82(www-data),101(nginx) to allow php and nginx to serve piwigo properly.
Exception being the script to allow user to install extra packages and the mysql folder that is handled by the official mysql/mariadb container.
I'm working on other things right now but I want to implement your feedback.

[Phil353556]

Hi @Renarde-dev,
Thanks for your answer.

point 1:
The placement of the network standza depends if the docker file used is dedicated to piwigo (and its db) or not.
If docker only manages the two containers: docker-piwigo-main-1 and docker-piwigo-db-1
then that's ok with the example supplied. The network standza can stay at the beginning of the compose.yaml file.
If docker manages piwigo (main and db) but also others containers, which are nothing to see with piwigo, then the network standza must be AFTER the standza piwigo-main: and piwigo-db: the end of the compose.yaml file,
Otherwise the error message, I shared, is displayed

A suggestion:
To allow automatic updates for piwigo-main and piwigo-db, and others containers too, the following container is run: watchtower, can be a recommendation
with this standza:

to allow automatic containers updates

watchtower:
image: nickfedor/watchtower:latest
container_name: watchtower
volumes:
- /var/run/docker.sock:/var/run/docker.sock
environment:
- TZ=Europe/Paris
- WATCHTOWER_SCHEDULE=0 0 3 * * * # Tous les jours à 3h00
- WATCHTOWER_CLEANUP=true # Nettoyage des anciennes images
restart: unless-stopped

-------------------------------------------------

examples of logs: / sorry no update since 24 december :-(

$ docker logs watchtower
time="2025-12-24T12:32:29+01:00" level=info msg="Watchtower 1.13.1 using Docker API v1.51"
time="2025-12-24T12:32:29+01:00" level=info msg="Using no notifications"
time="2025-12-24T12:32:29+01:00" level=info msg="Next scheduled run: 2025-12-25 03:00:00 CET in 14 hours, 27 minutes, 30 seconds"
time="2025-12-25T03:00:12+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2025-12-26T03:00:12+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2025-12-27T03:00:11+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2025-12-28T03:00:18+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2025-12-29T03:00:17+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2025-12-30T03:00:11+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2025-12-31T03:00:14+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-01T03:00:13+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-02T03:00:18+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-03T03:00:13+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-04T03:00:12+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-05T03:00:18+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-06T03:00:21+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-07T03:00:15+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0
time="2026-01-08T03:00:12+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=0

About rights, I would kindly suggest:
in the docker file, it should be possible to indicate the UID and the GID of the user, where the container piwigo run.
In my case:
directory piwigo-data/piwigo should belong to myself (user and group) not dhcpcd: _ssh
UID=1000
GID=1000
OR belong to www-data:www-data on my system it is UID:33 and GID:33

$ id www-data
uid=33(www-data) gid=33(www-data) groupes=33(www-data)

Please, tell me when updates are done, I will be very happy to test to help piwigo :-)
Thanks
Phil

[Renarde-dev]

Hi,
We are oppose to add an optional container to our compose file.
The current update flow is easy enough, users can add watchtower as their own discretion.

We use the default nginx user id in our image (100/101) and I should add a disclaimer to change owners when adding files but I don't want to change folder permision out of fear something breaks.
If you want to be able to copy file freely maybe set an acl on the directory ?
sudo setfacl -m u:<MyUser>:rwx ./piwigo-data/piwigo-data/piwigo/galleries/

[Phil353556]

Hi,
-Ok for watchtower
Note that watchtower is a must when using docker
Update to piwigo 16.2 done during the night

time="2026-01-10T03:00:56+01:00" level=info msg="Found new image" container=docker-piwigo-main-1 image="piwigo/piwigo:latest" new_id=8bca5f22953e
time="2026-01-10T03:07:55+01:00" level=info msg="Stopping container" container=docker-piwigo-main-1 id=59781581d874 signal=SIGTERM timeout=30s
time="2026-01-10T03:08:21+01:00" level=info msg="Started new container" container=docker-piwigo-main-1 id=59781581d874 new_id=b5736723f595
time="2026-01-10T03:08:56+01:00" level=info msg="Removing image" image_id=560897fe9690 image_name="piwigo/piwigo:latest" notify=yes
time="2026-01-10T03:08:57+01:00" level=info msg="Update session completed" failed=0 notify=no scanned=6 updated=1

-Ok about rights, that you're decision.
even if seeing dhcpcd _ssh as user and group and 999 systemd-journal for these directories is strange,

Many thanks for the command setatcl ,
it is sudo setfacl -m u:<MyUser> :rwx ./piwigo-data/piwigo/galleries/
the command shared as a piwigo-data too much
Tested (add an album and photos in this album, synchronize: ok, checksum: ok , thumbtails generation : it works like a charm.

Thanks for your time
Phil

[Renarde-dev]

I will add the command to a future wiki.

For rights I can't change mysql container ( it's the upstream for mariadb ).
Script directory is own by root to allow package install if another extension requires it.

[Phil353556]

Hi @Renarde-dev
"For rights I can't change mysql container ( it's the upstream for mariadb )."
Ok for mariadb, I understand

Some details on acl commands, may be useful for all users, to be added to the "future" wiki?

• only for existing files and directories:
  setfacl -R -m u:<MyUser>:rwX ./piwigo-data/piwigo/galleries/

• inheritance for new files:
  setfacl -R -m u:<MyUser>:rwX,d:u:<MyUser>:rwX ./piwigo-data/piwigo/galleries/

• To check current ACL rights:
  getfacl -R ./piwigo-data/piwigo/galleries/

regards
Phil

[Renarde-dev]

Thank you !

I'm working on the update guide first by I will try to add that as soon as I can.