github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-06 16:11:34 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[GH-ISSUE #5986] Make it easier to run the container as a non-root user #3744

New Issue
Open
opened 2026-04-12 14:33:15 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-04-12 14:33:15 -05:00
Owner
Copy Link

Originally created by @chgl on GitHub (Jul 26, 2024).
Original GitHub issue: https://github.com/ollama/ollama/issues/5986

Currently, the container runs as the root user by default (UID=0), this makes most things easy, but isn't the best for security reasons.

I would suggest adding a new non-0 UID user (e.g. ollama) with a dedicated home folder to the image. This should make using the image in restricted settings much easier.

I'd be happy to contribute this feature. Building a custom image from the official ollama:0.3.0 with a new user already works well:

FROM docker.io/ollama/ollama:0.3.0

RUN groupadd -r -g 65532 ollama && useradd --create-home --shell /bin/bash --uid 65532 -g ollama ollama

USER 65532:65532
Originally created by @chgl on GitHub (Jul 26, 2024). Original GitHub issue: https://github.com/ollama/ollama/issues/5986 Currently, the container runs as the root user by default (UID=0), this makes most things easy, but isn't the best for security reasons. I would suggest adding a new non-0 UID user (e.g. `ollama`) with a dedicated home folder to the image. This should make using the image in restricted settings much easier. I'd be happy to contribute this feature. Building a custom image from the official ollama:0.3.0 with a new user already works well: ```sh FROM docker.io/ollama/ollama:0.3.0 RUN groupadd -r -g 65532 ollama && useradd --create-home --shell /bin/bash --uid 65532 -g ollama ollama USER 65532:65532 ```
GiteaMirror added the dockerfeature request labels 2026-04-12 14:33:15 -05:00
GiteaMirror commented 2026-04-12 14:33:17 -05:00
Author
Owner
Copy Link

@StefanPeetz commented on GitHub (Dec 4, 2024):

To run on Openshift it would be great to have a solution that supports dynamic User and GroupIDs

<!-- gh-comment-id:2517185907 --> @StefanPeetz commented on GitHub (Dec 4, 2024): To run on Openshift it would be great to have a solution that supports dynamic User and GroupIDs
GiteaMirror commented 2026-04-12 14:33:17 -05:00
Author
Owner
Copy Link

@CleyFaye commented on GitHub (Dec 23, 2024):

I'm not sure how "good practice" this is regarding docker in general, but running the current ollama/ollama image as a specific user (using --user or user in a docker compose file) works fine, the only quirk is that with no user actually setup it looks for its config in /.ollama instead of /root/.ollama. Mounting that directory is enough to get the container starting and operating as expected, while running under a custom user.

<!-- gh-comment-id:2559986976 --> @CleyFaye commented on GitHub (Dec 23, 2024): I'm not sure how "good practice" this is regarding docker in general, but running the current ollama/ollama image as a specific user (using `--user` or `user` in a docker compose file) works fine, the only quirk is that with no user actually setup it looks for its config in `/.ollama` instead of `/root/.ollama`. Mounting that directory is enough to get the container starting and operating as expected, while running under a custom user.
GiteaMirror commented 2026-04-12 14:33:17 -05:00
Author
Owner
Copy Link

@qhaas commented on GitHub (Feb 24, 2025):

running the current ollama/ollama image as a specific user (using --user or user in a docker compose file) works fine, the only quirk is that with no user actually setup it looks for its config in /.ollama instead of /root/.ollama.

This works with docker / docker-compose, but if issue #228 is resolved, we could set this path via environment variable.

<!-- gh-comment-id:2679596087 --> @qhaas commented on GitHub (Feb 24, 2025): > running the current ollama/ollama image as a specific user (using `--user` or `user` in a docker compose file) works fine, the only quirk is that with no user actually setup it looks for its config in `/.ollama` instead of `/root/.ollama`. This works with docker / docker-compose, but if issue #228 is resolved, we could set this path via environment variable.
GiteaMirror commented 2026-04-12 14:33:17 -05:00
Author
Owner
Copy Link

@kitarp29 commented on GitHub (Nov 1, 2025):

Hi @dhiltgen
If you want I can make changes in the Go binary itself to check if the uiser is non-root and also check for the Bits.
Something like this:

        // Get fileInfo from the Executable's path
	mode := fileInfo.Mode()
	hasSetuid := mode&os.ModeSetuid != 0
	hasSetgid := mode&os.ModeSetgid != 0

	// If neither special bit is present, optionally warn about running as root
	if !hasSetuid && !hasSetgid {
		if os.Geteuid() == 0 {
			fmt.Fprintln(os.Stderr, "Warning: running ollama as root is not recommended")
		}
		return
	}


}
<!-- gh-comment-id:3475852624 --> @kitarp29 commented on GitHub (Nov 1, 2025): Hi @dhiltgen If you want I can make changes in the Go binary itself to check if the uiser is non-root and also check for the Bits. Something like this: ``` // Get fileInfo from the Executable's path mode := fileInfo.Mode() hasSetuid := mode&os.ModeSetuid != 0 hasSetgid := mode&os.ModeSetgid != 0 // If neither special bit is present, optionally warn about running as root if !hasSetuid && !hasSetgid { if os.Geteuid() == 0 { fmt.Fprintln(os.Stderr, "Warning: running ollama as root is not recommended") } return } }
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label docker feature request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#3744
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?