When setting UID different from 1000: cannot lock /etc/passwd

[kingp0dd]

Description

Trying to run as non-root, but when setting a different UID (other than 1000), it fails to start.

Steps to reproduce

  paperless-ngx:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless-ngx
    restart: unless-stopped
    user: "3002"

# The UID and GID of the user used to run paperless in the container. Set this
# to your UID and GID on the host so that you have write access to the
# consumption directory.
USERMAP_UID=3002
USERMAP_GID=3002

Webserver logs

Paperless-ngx docker container starting...
Mapping UID and GID for paperless:paperless to 3002:3002
usermod: Permission denied.
usermod: cannot lock /etc/passwd; try again later.

Browser logs

No response

Paperless-ngx version

2.7.2

Host OS

Debian 12

Installation method

Docker - official image

Browser

No response

Configuration changes

No response

Other

No response

Please confirm the following

• I believe this issue is a bug that affects all users of Paperless-ngx, not something specific to my installation.
• I have already searched for relevant existing issues and discussions before opening this report.
• I have updated the title field above with a concise description.

[shamoon]

Did you search? #2460

[kingp0dd]

Did you search? #2460

Yes, the one that looks similar to my issue was: #4531 but it is closed already with no solutions.

I check the one you linked (#2460), but his solution was already what I did as stated in my first post. Anything else from the logs that I might need to check to solve this?

additional info:

when I change the UID and GID to 1000 in the config I mentioned in my first post:

docker-compose.yml

  paperless-ngx:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless-ngx
    restart: unless-stopped
    user: "1000"

---
paperless.env

# The UID and GID of the user used to run paperless in the container. Set this
# to your UID and GID on the host so that you have write access to the
# consumption directory.
USERMAP_UID=1000
USERMAP_GID=1000

It works without changing anything else.
Is it intended that only 1000 can be used?

[stumpylog]

I really don't understand the fascination with rootless. It seems like nothing but an issue generator.

Anyway, presumably some people have been able to run the container with rootless, but I don't and don't have experience with it. If you find anything out that can be documented, let us know or open a PR for it.

[kingp0dd]

If you can point me to the right direction of debugging this, I can provide more info. So far, this is what I know:

Non-root works only if using UID:GID 1000:1000.

Non-root (using 3002)

compose:
  paperless-ngx:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless-ngx
    restart: unless-stopped
    user: "3002"

paperless.env:
# The UID and GID of the user used to run paperless in the container. Set this
# to your UID and GID on the host so that you have write access to the
# consumption directory.
USERMAP_UID=3002
USERMAP_GID=3002

docker logs:
Paperless-ngx docker container starting...
Mapping UID and GID for paperless:paperless to 3002:3002
usermod: Permission denied.
usermod: cannot lock /etc/passwd; try again later.

Non-root (using 1000)

compose:
  paperless-ngx:
    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    container_name: paperless-ngx
    restart: unless-stopped
    user: "1000"

paperless.env:
# The UID and GID of the user used to run paperless in the container. Set this
# to your UID and GID on the host so that you have write access to the
# consumption directory.
USERMAP_UID=1000
USERMAP_GID=1000

docker logs:
this starts the container successfully

[shamoon]

See #1212 (comment)

As noted, no one here is going to work on this so theres really no reason keep an issue open so I'm going to convert it to a discussion. We would welcome PRs if there are improvements to be made, feel free to ping the author of these original changes, they have been largely unchanged since they were added.

[andretone]

Hi, I have the same problem.

The error is thrown by this line

paperless-ngx/docker/docker-entrypoint.sh

Line 13 in 7be7185

usermod -o -u "${usermap_new_uid}" paperless

	if [[ ${usermap_new_uid} != "${usermap_original_uid}" || ${usermap_new_gid} != "${usermap_original_gid}" ]]; then
		echo "Mapping UID and GID for paperless:paperless to $usermap_new_uid:$usermap_new_gid"
		usermod -o -u "${usermap_new_uid}" paperless
		groupmod -o -g "${usermap_new_gid}" paperless
	fi

I think the command is launched from the user specified by the docker compose, that is not root and it cannot have permission to launch usermod properly.
Other commands may throw similar errors, like here:

paperless-ngx/docker/docker-entrypoint.sh

Line 99 in 7be7185

chown -R paperless:paperless "${tmp_dir}"

How to reproduce:

• Follow kingp0dd configuration
• Map every volume with a local directory, with correct permissions <useruid>:<usergid>