[Bug]: Docker not work

[nightlyworker]

Before you submit

• I searched existing issues and confirmed this is not a duplicate.
• I replaced the example text with the real behavior, reproduction steps, expected result, and version from the app's About menu or od --version.

What happened?

Could not fetch models: Authorization: Bearer <OD_API_TOKEN> required

Test failed: Authorization: Bearer <OD_API_TOKEN> required

I followed in details you quickastart guide, The OD_API_TOKEN is in my .env

I'm not able to go pass the onboarding BYOK screen.

....

Node.js heap cap inside the container.

NODE_OPTIONS=--max-old-space-size=192

Optional Codex CLI sandbox override. Set to danger-full-access only when

Codex fails with workspace-write sandbox setup errors inside the container.

OD_CODEX_SANDBOX=
OD_API_TOKEN=69ac0387ae21cf5f9f5163cf772dc434b8e38098f16e9a217ecbe3ff02458b56

Steps to reproduce

Follow your quickstart guide for docker

Expected behavior

It work

Open Design version

Current

Platform

Linux

Logs (optional)

Screenshots (optional)

No response

Additional context

No response

[open-design-bot]

🎉 ✨ Welcome to Open Design, @nightlyworker!

✨ 🔥 Lit the spark.

🌱 Every contribution adds energy to the project. Thanks for showing up and helping Open Design grow.

💛 Thanks for helping Open Design grow. Keep building in the open. 🚀

🔗 Share on X (English) · 分享到 X（中文）

[lefarcen]

Hey @nightlyworker, thanks for the detailed report — the exact Authorization: Bearer <OD_API_TOKEN> required message points at the daemon's API-auth path, not the BYOK provider itself.

This also looks very close to the Docker env/auth work already in flight in #4587, which is touching the same compose + token bootstrap path. One important note first: please rotate the OD_API_TOKEN you pasted here, since it's now public in the issue body.

To confirm whether your case matches that same path, could you share two things from the deploy/ directory right after the page loads?

• docker compose ps
• docker compose logs --tail=100 open-design

Also, are you opening http://localhost:7456 directly, or going through another host/domain/reverse proxy? That will tell us whether this is the localhost compose path or the non-loopback auth path.

[lefarcen]

Hey @IDKHowToCodeFR, appreciate you picking this up — and thanks for digging through the Docker bridge/NAT behavior so quickly. That proposed docs-first fix sounds like a good direction.

Roughly how long do you think it'll take from here: a few hours, 1–3 days, about a week, or longer?

[lefarcen]

Sounds good, @IDKHowToCodeFR — that 1–2 hour window is noted. The QUICKSTART.md + deploy/.env.example scope matches the issue well, so feel free to open the PR as soon as it's ready and we'll take it from there.

[Arnost55]

@nightlyworker hi. Just so you know it is already fixed. Tho i am waiting for the pull request to merge. If you really need it right now and cannot wait from excitment check out my repo which has it all fixed in this branch https://github.com/Arnost55/open-design/tree/fix/docker-env-not-picked-up

[lefarcen]

Hey @IDKHowToCodeFR, gentle check — still on this one? Anything blocking on your side?

[IkshaMalhotra]

@lefarcen I am responding on behalf of @IDKHowToCodeFR to address your status check. Their account was flagged by automated security systems shortly after opening PR #4836. The required documentation updates and code changes are complete. A reinstatement request is currently pending with GitHub Support. Account restoration and PR visibility are expected within 1 to 2 days. If the account restriction persists beyond this timeframe, the fix will be submitted using an alternate account.

[lefarcen]

Thanks for the update, @IkshaMalhotra — understood.

We'll keep this issue open while the account / PR visibility gets sorted out. Once PR #4836 is visible again, or the fix is re-submitted from the alternate account, just link it here and we'll pick it up from there.

[lefarcen]

Hey @nightlyworker — PR #4887 is up for this now.

It removes the Quickstart step that tells local Docker users to generate OD_API_TOKEN, and updates deploy/.env.example to say that OD_API_TOKEN should stay blank for the localhost Docker flow because Docker NAT makes those browser requests look non-loopback to the daemon auth middleware. Keeping this issue open until that PR lands.

[Arnost55]

There is no need for him to open a PR since i am waiting for my PR to be merged which covers all the fixes and has the api token removed.

[lefarcen]

Hey @IDKHowToCodeFR, quick check-in — are you still on this one, or is anything blocking on your side?

[lefarcen]

Hey @IDKHowToCodeFR, last nudge — if there's still no signal here, I'll re-open this for the community soon. Any update is enough to keep the claim.

[lefarcen]

Hey @IDKHowToCodeFR, gentle check — still on this one? Anything blocking?