From b915e0731ad7a06177effbecb7ed699c5148540c Mon Sep 17 00:00:00 2001 From: librelad Date: Tue, 18 Aug 2026 04:08:56 +0100 Subject: [PATCH] fix(vikunja): run as the mount owner, and drop the docker socket MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found by installing it. Two problems, one fatal and one worse. The container crash-looped: the image runs as uid 1000, which under rootless Docker maps to host sub-UID 232071 while the bind mounts are owned by the install user, so Vikunja died on its first write to /app/vikunja/files and restarted forever. Its own error message diagnosed it exactly. Fixed with the existing USER_TAG mechanism the portal container already uses — 0:0 under rootless (container root IS the install user on the host), the real uid:gid under rooted — rather than hardcoding either. More seriously, the compose mounted the docker socket, copied in from a template that needed it. A task manager has no business talking to the daemon, and the socket is root-equivalent access on the host. Removed. Co-Authored-By: Claude Opus 5 --- containers/vikunja/docker-compose.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/containers/vikunja/docker-compose.yml b/containers/vikunja/docker-compose.yml index 0d66cd2..da942f5 100644 --- a/containers/vikunja/docker-compose.yml +++ b/containers/vikunja/docker-compose.yml @@ -9,14 +9,23 @@ services: vikunja-service: #LIBREPORTAL|SERVICE_TAG_1|vikunja-service container_name: vikunja-service image: vikunja/vikunja:latest #LIBREPORTAL|VIKUNJA_VERSION_TAG|latest + # The image runs as uid 1000, which under rootless Docker maps to a host + # sub-UID that owns nothing — Vikunja then dies on its first write to + # /app/vikunja/files and restarts forever. USER_TAG resolves to the + # identity that actually owns the bind mounts: 0:0 under rootless + # (container root == the install user on the host), the real uid:gid + # under rooted. + user: "USER_DATA" #LIBREPORTAL|USER_TAG|USER_DATA restart: unless-stopped hostname: vikunja # GLUETUN_OFF_BEGIN ports: - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1 # GLUETUN_OFF_END + # Deliberately NO docker socket mount: Vikunja is a task app and has no + # reason to talk to the daemon. Handing it the socket would be + # root-equivalent access on the host for no benefit. volumes: - - SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA # The image presets VIKUNJA_DATABASE_PATH=/db/vikunja.db, so the # database lives in /db and uploaded attachments in files/. - ./db:/db