Latest version (1.5.0) restart

[er2de2]

After updating to the latest version, I have constant restarts of the wiredoor container.
I reverted to version 1.4.1 and everything works fine.
???

[dmesad]

Hi! Thanks for reporting this.

The latest release runs services as a non-root user by default, which can surface permission issues that were masked before. To help us debug the constant restarts, could you please share logs or details?

[er2de2]

docker compose logs -f
wiredoor exited with code 1
That's all.
Grafana, Crowdsec, Prometheus status healthy.

[dmesad]

The /data directory may still have root ownership from the previous version.

Please try running this command to fix permissions:

docker compose exec -u root wiredoor chown -R 1000:1000 /data

After that, restart the container and let us know if the issue persists.

docker compose up -d --force-recreate wiredoor

[er2de2]

After executing the command docker compose exec -u root wiredoor chown -R 1000:1000 /data
and restarting the wiredoor container, it has the status “running.”
Unfortunately, none of my applications are available.
Part of the logs:

`wiredoor | time="2025-09-10T17:26:30+02:00" level=warning msg="process reaping disabled, not pid 1"
wiredoor | time="2025-09-10T17:26:30+02:00" level=info msg="read crontab: /etc/crontabs/node"
wiredoor | {"level":30,"time":1757517995444,"pid":17,"hostname":"c50eb2f0c3b2","msg":"Saving Wireguard config to /etc/wireguard/wg0.conf"}
wiredoor | {"level":50,"time":1757517995701,"pid":17,"hostname":"c50eb2f0c3b2","err":{"type":"Error","message":"EACCES: permission denied, mkdir '/opt/oauth2-proxy'","stack":"Error: EACCES: permission denied, mkdir '/opt/oauth2-proxy'\n at Object.mkdirSync (node:fs:1363:26)\n at FileManager.mkdirSync (/app/dist/src/utils/file-manager.js:44:30)\n at ProcessManager. (/app/dist/src/services/oauth2-proxy/process-manager.js:43:36)\n at Generator.next ()\n at /app/dist/src/services/oauth2-proxy/process-manager.js:8:71\n at new Promise ()\n at __awaiter (/app/dist/src/services/oauth2-proxy/process-manager.js:4:12)\n at ProcessManager.addOauthProcess (/app/dist/src/services/oauth2-proxy/process-manager.js:41:16)\n at DomainsService. (/app/dist/src/services/domains-service.js:201:56)\n at Generator.next ()","errno":-13,"code":"EACCES","syscall":"mkdir","path":"/opt/oauth2-proxy"},"msg":"EACCES: permission denied, mkdir '/opt/oauth2-proxy'"}
wiredoor | {"level":50,"time":1757517995706,"pid":17,"hostname":"c50eb2f0c3b2","err":{"type":"Error","message":"ENOENT: no such file or directory, open '/opt/oauth2-proxy/door.banasik.ovh-emails'","stack":"Error: ENOENT: no such file or directory, open '/opt/oauth2-proxy/door.banasik.ovh-emails'\n at async open (node:internal/fs/promises:641:25)\n at async Object.writeFile (node:internal/fs/promises:1215:14)","errno":-2,"code":"ENOENT","syscall":"open","path":"/opt/oauth2-proxy/door.banasik.ovh-emails"},"msg":"Unable to initialize Domains"}
wiredoor | {"level":30,"time":1757517995737,"pid":17,"hostname":"c50eb2f0c3b2","msg":"Saved HTTP location config for https://door.banasik.ovh/ to /etc/nginx/locations/door.banasik.ovh/__main.conf"}
wiredoor | {"level":50,"time":1757517995789,"pid":17,"hostname":"c50eb2f0c3b2","err":{"type":"Error","message":"Command failed: nginx -t\nnginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)\nnginx: the configuration file /etc/nginx/nginx.conf syntax is ok\n2025/09/10 17:26:35 [emerg] 98#98: open() "/var/log/nginx/error.log" failed (13: Permission denied)\nnginx: configuration file /etc/nginx/nginx.conf test failed\n","stack":"Error: Command failed: nginx -t\nnginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)\nnginx: the configuration file /etc/nginx/nginx.conf syntax is ok\n2025/09/10 17:26:35 [emerg] 98#98: open() "/var/log/nginx/error.log" failed (13: Permission denied)\nnginx: configuration file /etc/nginx/nginx.conf test failed\n\n at genericNodeError (node:internal/errors:983:15)\n at wrappedFn (node:internal/errors:537:14)\n at ChildProcess.exithandler (node:child_process:417:12)\n at ChildProcess.emit (node:events:519:28)\n at maybeClose (node:internal/child_process:1101:16)\n at ChildProcess._handle.onexit (node:internal/child_process:304:5)","code":1,"killed":false,"signal":null,"cmd":"nginx -t"},"msg":"Command failed: nginx -t\nnginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)\nnginx: the configuration file /etc/nginx/nginx.conf syntax is ok\n2025/09/10 17:26:35 [emerg] 98#98: open() "/var/log/nginx/error.log" failed (13: Permission denied)\nnginx: configuration file /etc/nginx/nginx.conf test failed\n"}
wiredoor | {"level":40,"time":1757517995792,"pid":17,"hostname":"c50eb2f0c3b2","msg":"Nginx config test failed for /etc/nginx/locations/door.banasik.ovh/__main.conf"}

[dmesad]

The container is now running, but the errors are due to missing permissions on some directories that NGINX and OAuth2 Proxy need to write to. Since the latest release runs as non-root (UID 1000), the volumes mounted from your host that were previously owned by root also need their ownership updated.

Please run these commands to fix it:

docker compose exec -u root wiredoor chown -R 1000:1000 /data
docker compose exec -u root wiredoor chown -R 1000:1000 /opt/oauth2-proxy
docker compose exec -u root wiredoor chown -R 1000:1000 /var/log/nginx
docker compose exec -u root wiredoor chown -R 1000:1000 /etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt
docker compose pull wiredoor
docker compose up -d --force-recreate wiredoor

That should resolve the issue. Thank you for your patience while we adapt the container to run as non-root.

[er2de2]

It's better now, my applications are working, but I can't connect via https. I get warnings from my browser saying “Not connected: potential security risk.”

wiredoor | time="2025-09-10T17:57:28+02:00" level=warning msg="process reaping disabled, not pid 1" wiredoor | time="2025-09-10T17:57:28+02:00" level=info msg="read crontab: /etc/crontabs/node" wiredoor | {"level":30,"time":1757519852585,"pid":17,"hostname":"18ad3071c900","msg":"Saving Wireguard config to /etc/wireguard/wg0.conf"} wiredoor | {"level":50,"time":1757519852784,"pid":17,"hostname":"18ad3071c900","err":{"type":"Error","message":"EACCES: permission denied, mkdir '/opt/oauth2-proxy'","stack":"Error: EACCES: permission denied, mkdir '/opt/oauth2-proxy'\n at Object.mkdirSync (node:fs:1363:26)\n at FileManager.mkdirSync (/app/dist/src/utils/file-manager.js:44:30)\n at ProcessManager.<anonymous> (/app/dist/src/services/oauth2-proxy/process-manager.js:43:36)\n at Generator.next (<anonymous>)\n at /app/dist/src/services/oauth2-proxy/process-manager.js:8:71\n at new Promise (<anonymous>)\n at __awaiter (/app/dist/src/services/oauth2-proxy/process-manager.js:4:12)\n at ProcessManager.addOauthProcess (/app/dist/src/services/oauth2-proxy/process-manager.js:41:16)\n at DomainsService.<anonymous> (/app/dist/src/services/domains-service.js:201:56)\n at Generator.next (<anonymous>)","errno":-13,"code":"EACCES","syscall":"mkdir","path":"/opt/oauth2-proxy"},"msg":"EACCES: permission denied, mkdir '/opt/oauth2-proxy'"} wiredoor | {"level":50,"time":1757519852786,"pid":17,"hostname":"18ad3071c900","err":{"type":"Error","message":"ENOENT: no such file or directory, open '/opt/oauth2-proxy/door.banasik.ovh-emails'","stack":"Error: ENOENT: no such file or directory, open '/opt/oauth2-proxy/door.banasik.ovh-emails'\n at async open (node:internal/fs/promises:641:25)\n at async Object.writeFile (node:internal/fs/promises:1215:14)","errno":-2,"code":"ENOENT","syscall":"open","path":"/opt/oauth2-proxy/door.banasik.ovh-emails"},"msg":"Unable to initialize Domains"}

[dmesad]

docker compose exec -u root wiredoor chown -R 1000:1000 /etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt

[er2de2]

no change

wiredoor | time="2025-09-10T18:06:29+02:00" level=warning msg="process reaping disabled, not pid 1" wiredoor | time="2025-09-10T18:06:29+02:00" level=info msg="read crontab: /etc/crontabs/node" wiredoor | {"level":30,"time":1757520392839,"pid":17,"hostname":"e9d5c0e7abb5","msg":"Saving Wireguard config to /etc/wireguard/wg0.conf"} wiredoor | {"level":50,"time":1757520392971,"pid":17,"hostname":"e9d5c0e7abb5","err":{"type":"Error","message":"EACCES: permission denied, mkdir '/opt/oauth2-proxy'","stack":"Error: EACCES: permission denied, mkdir '/opt/oauth2-proxy'\n at Object.mkdirSync (node:fs:1363:26)\n at FileManager.mkdirSync (/app/dist/src/utils/file-manager.js:44:30)\n at ProcessManager.<anonymous> (/app/dist/src/services/oauth2-proxy/process-manager.js:43:36)\n at Generator.next (<anonymous>)\n at /app/dist/src/services/oauth2-proxy/process-manager.js:8:71\n at new Promise (<anonymous>)\n at __awaiter (/app/dist/src/services/oauth2-proxy/process-manager.js:4:12)\n at ProcessManager.addOauthProcess (/app/dist/src/services/oauth2-proxy/process-manager.js:41:16)\n at DomainsService.<anonymous> (/app/dist/src/services/domains-service.js:201:56)\n at Generator.next (<anonymous>)","errno":-13,"code":"EACCES","syscall":"mkdir","path":"/opt/oauth2-proxy"},"msg":"EACCES: permission denied, mkdir '/opt/oauth2-proxy'"} wiredoor | {"level":50,"time":1757520392973,"pid":17,"hostname":"e9d5c0e7abb5","err":{"type":"Error","message":"ENOENT: no such file or directory, open '/opt/oauth2-proxy/door.banasik.ovh-emails'","stack":"Error: ENOENT: no such file or directory, open '/opt/oauth2-proxy/door.banasik.ovh-emails'\n at async open (node:internal/fs/promises:641:25)\n at async Object.writeFile (node:internal/fs/promises:1215:14)","errno":-2,"code":"ENOENT","syscall":"open","path":"/opt/oauth2-proxy/door.banasik.ovh-emails"},"msg":"Unable to initialize Domains"} wiredoor | {"level":30,"time":1757520392988,"pid":17,"hostname":"e9d5c0e7abb5","msg":"Saved HTTP location config for https://door.banasik.ovh/ to /etc/nginx/locations/door.banasik.ovh/__main.conf"}

[er2de2]

Nothing change.
I still get a message about an unsecured site.
When I click “I accept the risk,” my page opens with the message:
Nothing here yet!

This domain is connected to Wiredoor, but no service has been exposed yet. Please check back later or contact the administrator.

[er2de2]

Logs:
docker compose logs wiredoor -f wiredoor | time="2025-09-10T19:15:18+02:00" level=warning msg="process reaping disabled, not pid 1" wiredoor | time="2025-09-10T19:15:18+02:00" level=info msg="read crontab: /etc/crontabs/node" wiredoor | {"level":30,"time":1757524520534,"pid":17,"hostname":"bf9e39b35be4","msg":"Saving Wireguard config to /etc/wireguard/wg0.conf"} wiredoor | {"level":50,"time":1757524520625,"pid":17,"hostname":"bf9e39b35be4","err":{"type":"Error","message":"EACCES: permission denied, open '/etc/supervisor/conf.d/oauth2-proxy-d1.conf'","stack":"Error: EACCES: permission denied, open '/etc/supervisor/conf.d/oauth2-proxy-d1.conf'\n at async open (node:internal/fs/promises:641:25)\n at async Object.writeFile (node:internal/fs/promises:1215:14)","errno":-13,"code":"EACCES","syscall":"open","path":"/etc/supervisor/conf.d/oauth2-proxy-d1.conf"},"msg":"Unable to initialize Domains"} wiredoor | {"level":30,"time":1757524520632,"pid":17,"hostname":"bf9e39b35be4","msg":"Saved HTTP location config for https://door.banasik.ovh/ to /etc/nginx/locations/door.banasik.ovh/__main.conf"}

[er2de2]

For now, I'm going back to the 1.4.1 version.

[dmesad]

If you don’t want to run the container as non-root, you can force it to run as root by editing your docker-compose.yml and adding the user directive:

services:
  wiredoor:
    image: wiredoor/wiredoor:latest
    user: root
    # ...

This way the container will behave the same as in previous releases.

However, we recommend the non-root setup for better security.

Thanks to your feedback I was able to reproduce the issue and I’ve added the proper upgrade steps to the release notes.