rootless Image vs. app.ini discrepancy #15018

New Issue

GiteaMirror · 2025-11-02T11:28:07-06:00

GiteaMirror commented

2025-11-02 11:28:07 -06:00

Originally created by @homelan-git on GitHub (Oct 11, 2025).

Description

Hi, I followed Installation with Docker (rootless) and try to start Gitea with rootless Quadlet:

gitea.container:

[Unit]
Description=Gitea: Git with a cup of tea - A painless self-hosted Git service.
Requires=gitea-db.service
After=gitea-db.service

[Container]
Image=docker.io/gitea/gitea:1.24-rootless
ContainerName=gitea

Environment=GITEA__database__DB_TYPE=mysql
Environment=GITEA__database__NAME=gitea
Environment=GITEA__database__USER=gitea

Secret=gitea-mysql-password,type=env,target=GITEA__database__PASSWD

Volume=gitea-data:/var/lib/gitea:Z
Volume=gitea-config:/etc/gitea:Z

Pod=gitea.pod

[Service]
...

[Install]
...

and it starts, opening the "First Start" web page: Path to log directory is invalid: mkdir /var/lib/gitea/data: permission denied.
Running a shell inside this container shows:

gitea:/var/lib/gitea$ pwd
/var/lib/gitea
gitea:/var/lib/gitea$ tree . | grep -Ev "^\W{9}"
.
├── git
│   ├── lfs
│   └── repositories
├── gitea
│   ├── actions_artifacts
│   ├── actions_log
│   ├── attachments
│   ├── avatars
│   ├── conf
│   ├── home
│   ├── indexers
│   ├── jwt
│   ├── log
│   ├── packages
│   ├── queues
│   ├── repo-archive
│   ├── repo-avatars
│   ├── sessions
│   └── tmp
└── ssh [error opening dir]

Otherwise, the repo gitea\docker\rootless\etc\templates\app.ini has set

...
[session]
PROVIDER_CONFIG = $GITEA_WORK_DIR/data/sessions
[picture]
AVATAR_UPLOAD_PATH = $GITEA_WORK_DIR/data/avatars
REPOSITORY_AVATAR_UPLOAD_PATH = $GITEA_WORK_DIR/data/repo-avatars
[log]
ROOT_PATH = $GITEA_WORK_DIR/data/log
...

with dataprefixed - opposite to the rootless image. Shouldn't be the non-customized container working out of the box? Is it a bug a do I miss something (not mentioned on documentation on web)? What do I have to care about?

I read somewhere here that rootful and rootless have somehow evolved historically, but I haven't found anything concrete. From a security perspective, which is the better image for Podman rootless in production (non k8s)?

Gitea Version

1.26-rootless

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

Git Version

git version 2.49.1

Operating System

CoreOS

How are you running Gitea?

rootless using Podman Quadlet

Database

MySQL/MariaDB

Originally created by @homelan-git on GitHub (Oct 11, 2025). ### Description Hi, I followed [Installation with Docker (rootless)](https://docs.gitea.com/installation/install-with-docker-rootless) and try to start Gitea with rootless Quadlet: **gitea.container**: ```ini [Unit] Description=Gitea: Git with a cup of tea - A painless self-hosted Git service. Requires=gitea-db.service After=gitea-db.service [Container] Image=docker.io/gitea/gitea:1.24-rootless ContainerName=gitea Environment=GITEA__database__DB_TYPE=mysql Environment=GITEA__database__NAME=gitea Environment=GITEA__database__USER=gitea Secret=gitea-mysql-password,type=env,target=GITEA__database__PASSWD Volume=gitea-data:/var/lib/gitea:Z Volume=gitea-config:/etc/gitea:Z Pod=gitea.pod [Service] ... [Install] ... ``` and it starts, opening the "First Start" web page: `Path to log directory is invalid: mkdir /var/lib/gitea/data: permission denied`. Running a shell inside this container shows: ```bash gitea:/var/lib/gitea$ pwd /var/lib/gitea gitea:/var/lib/gitea$ tree . | grep -Ev "^\W{9}" . ├── git │ ├── lfs │ └── repositories ├── gitea │ ├── actions_artifacts │ ├── actions_log │ ├── attachments │ ├── avatars │ ├── conf │ ├── home │ ├── indexers │ ├── jwt │ ├── log │ ├── packages │ ├── queues │ ├── repo-archive │ ├── repo-avatars │ ├── sessions │ └── tmp └── ssh [error opening dir] ``` Otherwise, the repo `gitea\docker\rootless\etc\templates\app.ini` has set ```ini ... [session] PROVIDER_CONFIG = $GITEA_WORK_DIR/data/sessions [picture] AVATAR_UPLOAD_PATH = $GITEA_WORK_DIR/data/avatars REPOSITORY_AVATAR_UPLOAD_PATH = $GITEA_WORK_DIR/data/repo-avatars [log] ROOT_PATH = $GITEA_WORK_DIR/data/log ... ``` with `data`prefixed - opposite to the rootless image. Shouldn't be the non-customized container working out of the box? Is it a bug a do I miss something (not mentioned on documentation on web)? What do I have to care about? I read somewhere here that rootful and rootless have somehow evolved historically, but I haven't found anything concrete. From a security perspective, which is the better image for Podman rootless in production (non k8s)? ### Gitea Version 1.26-rootless ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots <img width="886" height="129" alt="Image" src="https://github.com/user-attachments/assets/8b4ddc6a-6ee0-46ad-8397-3d76b919c273" /> ### Git Version git version 2.49.1 ### Operating System CoreOS ### How are you running Gitea? rootless using Podman Quadlet ### Database MySQL/MariaDB

GiteaMirror added the type/bug label 2025-11-02 11:28:07 -06:00

GiteaMirror closed this issue

2025-11-02 11:28:08 -06:00

GiteaMirror commented

2025-11-02 11:28:09 -06:00

@TheFox0x7 commented on GitHub (Oct 11, 2025):

I cannot reproduce this with podman run --rm -p 3000:3000 -v test-data:/var/lib/gitea -v test-config:/etc/gitea docker.io/gitea/gitea:1.24-rootless

.
├── actions_artifacts
├── actions_log
├── custom
├── data
│   ├── attachments
│   ├── avatars
│   ├── gitea.db
│   ├── log
│   └── repo-avatars
├── git
│   ├── lfs
│   └── repositories
├── home
├── indexers
│   └── issues.bleve
├── jwt
│   └── private.pem
├── packages
├── queues
│   └── common
├── repo-archive
└── ssh
    ├── gitea.rsa
    └── gitea.rsa.pub

Do you have any other details on the installation?

The main difference I'm aware of is that rootful gitea runs sshd for ssh connections while rootless runs the internal ssh server.

@TheFox0x7 commented on GitHub (Oct 11, 2025): I cannot reproduce this with `podman run --rm -p 3000:3000 -v test-data:/var/lib/gitea -v test-config:/etc/gitea docker.io/gitea/gitea:1.24-rootless` ``` . ├── actions_artifacts ├── actions_log ├── custom ├── data │ ├── attachments │ ├── avatars │ ├── gitea.db │ ├── log │ └── repo-avatars ├── git │ ├── lfs │ └── repositories ├── home ├── indexers │ └── issues.bleve ├── jwt │ └── private.pem ├── packages ├── queues │ └── common ├── repo-archive └── ssh ├── gitea.rsa └── gitea.rsa.pub ``` Do you have any other details on the installation? The main difference I'm aware of is that rootful gitea runs sshd for ssh connections while rootless runs the internal ssh server.

GiteaMirror commented

2025-11-02 11:28:09 -06:00

@homelan-git commented on GitHub (Oct 18, 2025):

I'm sorry for the late answer.

I've deleted the old/previous volumes from rootfull? image. Now, re-created by podman, the fs-layout is as yours.

You mean the internal ssh server, written in Go in the gitea binary?

Which should be used these days?

@homelan-git commented on GitHub (Oct 18, 2025): I'm sorry for the late answer. I've deleted the old/previous volumes from rootfull? image. Now, re-created by podman, the fs-layout is as yours. You mean the internal ssh server, written in Go in the gitea binary? Which should be used these days?

GiteaMirror commented

2025-11-02 11:28:09 -06:00

@TheFox0x7 commented on GitHub (Oct 18, 2025):

Yes that's what I mean.
I don't think there's a set preference or a recommended one - at least I'm not aware of it. Whichever you pick you have to stick with it - you can't change it midway without manually migrating (which isn't documented)

I'm closing this since the issue was resolved.

@TheFox0x7 commented on GitHub (Oct 18, 2025): Yes that's what I mean. I don't think there's a set preference or a recommended one - at least I'm not aware of it. Whichever you pick you have to stick with it - you can't change it midway without manually migrating (which isn't documented) I'm closing this since the issue was resolved.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#15018