Lychee container not starting, chmod: changing permissions of '/data': Operation not permitted

[mashb1t]

Lychee version

v7.1.1

Did you check the latest Lychee version?

Yes, I did

Which PHP version are you using?

PHP 8.5

Detailed description of the problem

lychee-api     | 🚀 Starting Lychee entrypoint...
lychee-api     | 🔍 Validating environment variables...
lychee-api     | ✅ Valid database connection type: sqlite
lychee-api     | ✅ Valid environment: production
lychee-api     | ✅ Core variables validated
lychee-api     | 🎉 Environment validation complete!
lychee-api     | Validating and setting PUID/PGID
lychee-api     |   User UID: 1000
lychee-api     |   User GID: 1000
lychee-api     | 🔍 Validating permissions...
lychee-api     | chmod: changing permissions of '/data': Operation not permitted
lychee-api     | chmod: changing permissions of '/data/caddy': Operation not permitted
lychee-api     | chmod: changing permissions of '/config': Operation not permitted
lychee-api     | chmod: changing permissions of '/config/caddy': Operation not permitted
lychee-api exited with code 1 (restarting)

Steps to reproduce the issue

1. copy content of docker-compose.yaml and .env.example into a new empty directory
2. generate and set APP_KEY in .env via echo "APP_KEY=base64:$(openssl rand -base64 32)"
3. docker compose up -d (no previously existing data)
4. see errors in docker compose logs -f, container for API doesn't start

Also doesn't work when using the same volume structure as in v6.10.2.

When starting the container without entrypoint via docker run --rm -it --entrypoint bash ghcr.io/lycheeorg/lychee:v7.1.1, the owner of /data and /config is www-data, but no matter which PUID and PGID is set in the .env, the operation in

Lychee/docker/scripts/05-permissions-check.sh

Line 13 in b3df54e

chown -R www-data:www-data /data /config

is always not permitted.

Even commenting PUID and PGID + setting RUN_AS_ROOT: "yes" doesn't resolve the issue:

lychee-api     | 🚀 Starting Lychee entrypoint...
lychee-api     | 🔍 Validating environment variables...
lychee-api     | ✅ Valid database connection type: sqlite
lychee-api     | ✅ Valid environment: production
lychee-api     | ✅ Core variables validated
lychee-api     | 🎉 Environment validation complete!
lychee-api     | Validating and setting PUID/PGID
lychee-api     |   User UID: 33
lychee-api     |   User GID: 33
lychee-api     | 🔍 Validating permissions...
lychee-api     | chmod: changing permissions of '/data': Operation not permitted
lychee-api     | chmod: changing permissions of '/data/caddy': Operation not permitted
lychee-api     | chmod: changing permissions of '/config': Operation not permitted
lychee-api     | chmod: changing permissions of '/config/caddy': Operation not permitted
lychee-api exited with code 1 (restarting)

I assume this is due to user execution changes introduced in #3953.

Diagnostics [REQUIRED]

none, as Lychee sadly doesn't start

Browser & System [REQUIRED]

Chrome (latest), but not relevant here
Debian 6.12.48-1
Docker 28.5.2

Please confirm (incomplete submissions will not be addressed)

• I have provided easy and step-by-step instructions to reproduce the bug.
• I understand my bug report will be removed if I haven't met the criteria above.
• I understand that if I am requested to provide more information, I must do so within 14 days or the bug report will be closed.

[mashb1t]

@ildyria the issue is caused by the latest commit

5268c60#diff-8a15da845ab2ddffa632f3c487c2060f8154e6a51e2561f8a54d17414ef7a21bR13-R14

Lychee/docker/scripts/05-permissions-check.sh

Lines 13 to 14 in 5268c60

	chown -R www-data:www-data /data /config
	chmod -R 775 /data /config

Commenting out these lines works and makes the app boot again.

User 1000 can't chown a directory which it doesn't have permissions to as it's owned by www-data in

Lychee/Dockerfile

Line 160 in b3df54e

&& chown -R www-data:www-data /data /config \

The solution IMO is either to change the default owner to 1000 or to remove these 2 lines as they only probably would work when the container is started with PUID 33 (www-data).

[ildyria]

That is so weird, because on my Sonology those were the two lines that fixed the complaint when starting caddy as www-data user (which is assigned to PUID/GUID defined in the variable, in my case 1026:100).
Also the chown is executed as root in the entrypoint.sh, so the fact that it does not allow the chown is very weird..

[ildyria]

I don't get it.

echo "who am i"
id
chown -R www-data:www-data /data /config
chmod -R 775 /data /config

lead to

lychee-api      | 🔍 Validating permissions...
lychee-api      | who am i
lychee-api      | uid=0(root) gid=0(root) groups=0(root)
lychee-api      | chmod: changing permissions of '/data': Operation not permitted
lychee-api      | chmod: changing permissions of '/data/caddy': Operation not permitted
lychee-api      | chmod: changing permissions of '/config': Operation not permitted
lychee-api      | chmod: changing permissions of '/config/caddy': Operation not permitted
Container lychee-api Error dependency lychee_api failed to start
dependency failed to start: container lychee-api is unhealthy

[ildyria]

PR created. Currently building, will test on my Synology if it still works. This is so frustrating.

[mashb1t]

yeah, that's also what left me puzzled...
thanks anyways for creating #3976 :)

[ildyria]

Fixed on edge once the build on master is done.