Fresh install: every upload fails because the media volume is owned by root #914

New issue

Closed

opened 2026-09-28 17:08:46 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-09-28 17:08:46 +00:00

Collaborator

Found by the lane 8 P6 delegate in a fresh e2e stack.

The cause. The media named volume mounts at /app/media, but no backend image creates that directory. On first mount, Docker makes the mount point owned by root. main.py's os.makedirs(..., exist_ok=True) then does nothing, and the backend runs as appuser, so every upload, whether a portrait, attachment, handout or map, fails with a 500 PermissionError.

Who is affected. Any fresh install, including a new self-hoster on v4.5.0. Existing volumes are fine: dev's /app/media is appuser-owned from May, and prod is the same age.

The fix. Create /app/media in backend-base, owned by appuser, alongside /app/backups. I checked it on a backend-prod image with a fresh named volume: the mount point is appuser-owned and writable.

Found by the lane 8 P6 delegate in a fresh e2e stack. **The cause.** The `media` named volume mounts at `/app/media`, but no backend image creates that directory. On first mount, Docker makes the mount point owned by root. `main.py`'s `os.makedirs(..., exist_ok=True)` then does nothing, and the backend runs as `appuser`, so every upload, whether a portrait, attachment, handout or map, fails with a 500 `PermissionError`. **Who is affected.** Any fresh install, including a new self-hoster on v4.5.0. Existing volumes are fine: dev's `/app/media` is `appuser`-owned from May, and prod is the same age. **The fix.** Create `/app/media` in `backend-base`, owned by `appuser`, alongside `/app/backups`. I checked it on a `backend-prod` image with a fresh named volume: the mount point is `appuser`-owned and writable.