From 11a4f2910abcdd7ae9eb94bed33ee159dffa4043 Mon Sep 17 00:00:00 2001 From: archipelago Date: Sun, 5 Jul 2026 16:33:30 -0400 Subject: [PATCH] fix(immich): declare the caps its root process needs over the subuid-owned data tree MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit capabilities:[] was latent — the long-lived legacy container predated strict manifest enforcement, so nothing noticed that a recreate against this manifest produces a root process without DAC_OVERRIDE that EACCESes on upload/encoded-video and crash-loops (49 systemd restarts on .228 when the 2026-07-05 secret-env migration finally recreated it). Any reinstall or reboot-repair would have tripped the same wire. Cap set mirrors immich-postgres minus SETUID/SETGID. Co-Authored-By: Claude Fable 5 --- apps/immich/manifest.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/immich/manifest.yml b/apps/immich/manifest.yml index e29c7c01..73fff674 100644 --- a/apps/immich/manifest.yml +++ b/apps/immich/manifest.yml @@ -30,7 +30,13 @@ app: disk_limit: 200Gi security: - capabilities: [] + # Runs as container root over a data tree the legacy installer chowned + # to the subuid range (host 100000 = container uid 1). Without + # DAC_OVERRIDE the server EACCESes writing upload/encoded-video the + # moment the container is recreated against this manifest (latent until + # the 2026-07-05 secret-env migration recreated it). Same cap set as + # immich-postgres minus the setuid pair it doesn't use. + capabilities: [CHOWN, DAC_OVERRIDE, FOWNER] readonly_root: false network_policy: isolated