Cannot override user using the Docker Compose user attribute

[eiqnepm]

Docker Compose

name: ganymede

networks:
  proxy:
    external: true

services:
  ganymede:
    depends_on:
      - ganymede-db
    environment:
      - DEBUG=false
      - TZ=REDACTED # Set to your timezone
      # Data paths in container; update the mounted volume paths as well
      - VIDEOS_DIR=/data/videos
      - TEMP_DIR=/data/temp
      - LOGS_DIR=/data/logs
      - CONFIG_DIR=/data/config
      # Database settings
      - DB_HOST=ganymede-db
      - DB_PORT=5432
      - DB_USER=ganymede
      - DB_PASS=PASSWORD
      - DB_NAME=ganymede-prd
      - DB_SSL=disable
      # - DB_SSL_ROOT_CERT= # path to cert in the container if DB_SSL is not disabled
      - TWITCH_CLIENT_ID=REDACTED # from your twitch application
      - TWITCH_CLIENT_SECRET=REDACTED # from your twitch application
      # Worker settings. Max number of tasks to run in parallel per type.
      - MAX_CHAT_DOWNLOAD_EXECUTIONS=3
      - MAX_CHAT_RENDER_EXECUTIONS=2
      - MAX_VIDEO_DOWNLOAD_EXECUTIONS=2
      - MAX_VIDEO_CONVERT_EXECUTIONS=3
      - MAX_VIDEO_SPRITE_THUMBNAIL_EXECUTIONS=2
      # Optional OAuth settings
      # - OAUTH_ENABLED=false
      # - OAUTH_PROVIDER_URL=
      # - OAUTH_CLIENT_ID=
      # - OAUTH_CLIENT_SECRET=
      # - OAUTH_REDIRECT_URL=http://IP:PORT/api/v1/auth/oauth/callback # Points to the API service
      # Optional Frontend settings
      - SHOW_SSO_LOGIN_BUTTON=true
      - FORCE_SSO_AUTH=false
      - REQUIRE_LOGIN=false
      # - CDN_URL= # Set this if you are hosting static files through another service (nginx, S3, etc). By default this does not need to be configured as Ganymede serves the static files.
    healthcheck:
      test: curl --fail http://localhost:4000/health || exit 1
      interval: 60s
      retries: 5
      start_period: 60s
      timeout: 10s
    image: ghcr.io/zibbp/ganymede
    labels:
      - traefik.enable=true
      - traefik.http.routers.ganymede.entryPoints=websecure
      - traefik.http.routers.ganymede.rule=Host(`ganymede.REDACTED`)
      - traefik.http.routers.ganymede.service=ganymede
      - traefik.http.services.ganymede.loadBalancer.server.port=4000
    networks:
      - default
      - proxy
    ports:
      - 4800:4000
    restart: no
    user: 1000:1000
    volumes:
      - /opt/ganymede/videos:/data/videos # update VIDEOS_DIR env var
      - /opt/ganymede/temp:/data/temp # update TEMP_DIR env var
      - /opt/ganymede/logs:/data/logs # queue logs
      - /opt/ganymede/config:/data/config # config and other miscellaneous files

  ganymede-db:
    environment:
      - POSTGRES_PASSWORD=PASSWORD
      - POSTGRES_USER=ganymede
      - POSTGRES_DB=ganymede-prd
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 30s
      timeout: 60s
      retries: 5
      start_period: 60s
    image: postgres:14
    ports:
      - 4801:5432
    restart: no
    volumes:
      - /opt/ganymede/data:/var/lib/postgresql/data

Details

groupmod: Permission denied.
groupmod: cannot lock /etc/group; try again later.
usermod: Permission denied.
usermod: cannot lock /etc/passwd; try again later.

-------------------------------------
User uid:    911
User gid:    1000
-------------------------------------

chown: changing ownership of '/data/logs': Operation not permitted
chown: changing ownership of '/data/config': Operation not permitted
chown: changing ownership of '/data/temp': Operation not permitted
chown: changing ownership of '/data/videos': Operation not permitted
chown: changing ownership of '/var/cache/fontconfig': Operation not permitted
error: failed switching to 'abc': operation not permitted
Traceback (most recent call last):
  File "/usr/bin/supervisord", line 33, in <module>
    sys.exit(load_entry_point('supervisor==4.2.5', 'console_scripts', 'supervisord')())
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/supervisor/supervisord.py", line 359, in main
    go(options)
  File "/usr/lib/python3/dist-packages/supervisor/supervisord.py", line 369, in go
    d.main()
  File "/usr/lib/python3/dist-packages/supervisor/supervisord.py", line 72, in main
    self.options.make_logger()
  File "/usr/lib/python3/dist-packages/supervisor/options.py", line 1488, in make_logger
    loggers.handle_file(
  File "/usr/lib/python3/dist-packages/supervisor/loggers.py", line 419, in handle_file
    handler = RotatingFileHandler(filename, 'a', maxbytes, backups)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/supervisor/loggers.py", line 213, in __init__
    FileHandler.__init__(self, filename, mode)
  File "/usr/lib/python3/dist-packages/supervisor/loggers.py", line 160, in __init__
    self.stream = open(filename, mode)
                  ^^^^^^^^^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/var/log/supervisord.log'

Details

$ ls -ln
total 20
drwxr-xr-x  2 1000 1000 4096 Jul 27 07:23 config
drwx------ 19 999  0    4096 Jul 27 07:38 data
drwxr-xr-x  2 1000 1000 4096 Jul 27 07:23 logs
drwxr-xr-x  2 1000 1000 4096 Jul 27 07:23 temp
drwxr-xr-x  2 1000 1000 4096 Jul 27 07:23 videos

I also tried adding PUID and PGID with no success

[darekwojciechowski]

The user: attribute is what's breaking it. Ganymede's entrypoint has to start as root. It runs groupmod/usermod on the abc user, chowns your mounted dirs, then drops privileges with gosu abc before starting supervisord. When you set user:, Docker starts the container as that UID, so every one of those steps fails and supervisord ends up with no write access to /var/log/supervisord.log.

That's also why PUID/PGID looked like they did nothing. The entrypoint does read them, but usermod -o -u "$PUID" abc needs root, so abc stayed at 911.

Drop user: and set PUID/PGID instead. Your host dirs are owned by 1000:1000, so:

services:
  ganymede:
    environment:
      - PUID=1000
      - PGID=1000

Then recreate and check the banner it prints on startup:

docker compose up -d --force-recreate ganymede
docker compose logs ganymede | head -20

You should see uid 1000 / gid 1000 and no Permission denied lines.

If you were setting user: to keep the app off root in the first place, you don't have to. The entrypoint only stays root long enough to fix ownership, then hands off to abc with gosu before supervisord starts anything.

[rakeshutekar]

The user: attribute can't work with this image, and it's not a bug — Ganymede uses the LinuxServer-style PUID/PGID pattern, which is mutually exclusive with user:. Use the env vars instead:

    environment:
      - PUID=1000
      - PGID=1000
    # remove:  user: 1000:1000

Here's why user: 1000:1000 breaks it, straight from the image. The container is built with a fixed internal user and gosu:

# Dockerfile
RUN useradd -u 911 -d /data abc && usermod -a -G users abc
...
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

and entrypoint.sh is designed to start as root, remap that abc user to whatever UID/GID you ask for, fix ownership, then drop privileges:

PUID=${PUID:-911}
PGID=${PGID:-911}

groupmod -o -g "$PGID" abc      # needs root
usermod  -o -u "$PUID" abc      # needs root
...
chown -R abc:abc ${CONFIG_DIR}  # needs root
gosu abc fc-cache -f            # drops to abc

When you set user: 1000:1000 in Compose, the entrypoint runs as UID 1000 from the very first line, so groupmod, usermod and the chown -R calls all fail with permission-denied (a non-root user can't modify accounts or chown files it doesn't own). You've overridden the exact privilege the init script needs to do its job. PUID/PGID is the supported knob because it lets the script keep root just long enough to set things up and then hand off to gosu abc, which is what ends up owning the actual app process — so the running process is still UID 1000, just reached the correct way.

Two things worth doing after switching:

• Make sure your bind-mounted dirs are owned by 1000:1000 on the host (chown -R 1000:1000 /opt/ganymede). The entrypoint chowns the container paths, but matching the host ownership avoids surprises.
• If your goal with user: was specifically to not run anything as root even during init, that pattern genuinely can't do that — the setup phase is root-by-design. If that's a hard requirement for you (e.g. a rootless-Docker or restricted-PSA environment), that's worth raising as a separate feature request, because it'd need the image to ship a pre-chowned, no-remap mode.