Enhancement: Support Docker rootless mode — fix data directory ownership for non-root container users

[IMNotMax]

Description

Summary

When ODS is installed on a host running Docker rootless (via rootlesskit), containers that run as a non-root user (n8n, hermes, whisper, tts, token-spy, privacy-shield, ape, langfuse) fail to start with EACCES: permission denied errors. The data directories created by the installer are owned by the host user (e.g. UID 1000), but in rootless mode, container UIDs are remapped to a different range (starting at 100000), so non-root container users cannot write to them.

Environment

• OS: Ubuntu (Linux)
• Docker: rootless mode (rootlesskit + dockerd-rootless.sh)
• subuid/subgid: maxs:100000:65536
• ODS version: ods-cli v2.5.3
• Install path: ~/ods (owned by maxs, UID 1000)

Use Case

Problem

In Docker rootless mode, UID mapping works as follows:

Container UID	Host UID
0 (root)	1000 (host user)
1000 (node, ubuntu, appuser, odser)	100000
10000 (hermes)	109000

The installer creates data directories under ~/ods/data/ owned by the host user (UID 1000). Containers running as root (UID 0) work fine because root in the container maps to the host user. However, containers running as a non-root user fail because their container UID maps to a host UID (100000+) that has no write permission on the directory.

Proposed Solution

Symptoms

n8n:

No encryption key found - Auto-generating and saving to: /home/node/.n8n/config
Error: EACCES: permission denied, open '/home/node/.n8n/config'
    at writeFileSync (node:fs:2437:20)
    at InstanceSettings.save (...)

Hermes:

mkdir: cannot create directory '/opt/data': Permission denied
Fixing ownership of /opt/data to hermes (10000)
Warning: chown failed (rootless container?) — continuing anyway
Dropping root privileges
mkdir: cannot create directory '/opt/data': Permission denied

Affected containers

Service	Container user	Container UID
n8n	node	1000
hermes	hermes	10000
whisper	ubuntu	1000
tts	appuser	1000
token-spy	odser	1000
privacy-shield	—	1000
ape	ape	100
langfuse-web	nextjs	1001

Containers running as root (open-webui, litellm, qdrant, embeddings, perplexica, searxng, llama-server, dashboard, dashboard-api) are not affected.

Reproduction

1. Install Docker rootless on a Linux host (e.g. dockerd-rootless.sh + rootlesskit).
2. Ensure subuid/subgid is configured: username:100000:65536.
3. Run the ODS installer as a non-root user.
4. Start ODS: ods start
5. Observe that n8n and hermes fail to start with EACCES / Permission denied errors.

Alternatives Considered

Workaround

Manually fix ownership of each affected data directory using a container with root privileges (which maps to the host user in rootless mode):

# n8n (container UID 1000)
docker run --rm --user 0:0 -v ~/ods/data/n8n:/data alpine sh -c "chown -R 1000:1000 /data"

# hermes (container UID 10000)
docker run --rm --user 0:0 -v ~/ods/data/hermes:/data alpine sh -c "chown -R 10000:10000 /data"

# whisper, tts, token-spy, privacy-shield (container UID 1000)
for svc in whisper tts token-spy privacy-shield; do
  docker run --rm --user 0:0 -v ~/ods/data/$svc:/data alpine sh -c "chown -R 1000:1000 /data"
done

# ape (container UID 100)
docker run --rm --user 0:0 -v ~/ods/data/ape:/data alpine sh -c "chown -R 100:100 /data"

# langfuse (container UID 1001)
docker run --rm --user 0:0 -v ~/ods/data/langfuse:/data alpine sh -c "chown -R 1001:1001 /data"

Then restart: ods restart

Suggested fix

The installer (or ods start / ods restart) should detect rootless mode and fix data directory ownership automatically. Possible approaches:

Option A — Detect rootless and chown after directory creation

After creating data directories in 06-directories.sh, check if Docker is running in rootless mode and, for each service that uses a non-root container user, chown the corresponding data directory to the container's UID:

# Detect rootless mode
_is_rootless_docker() {
    docker info --format '{{.SecurityOptions}}' 2>/dev/null | grep -q rootless
}

if _is_rootless_docker; then
    # Fix ownership for non-root containers
    _chown_data_dir "n8n" 1000
    _chown_data_dir "hermes" 10000
    _chown_data_dir "whisper" 1000
    _chown_data_dir "tts" 1000
    _chown_data_dir "token-spy" 1000
    _chown_data_dir "privacy-shield" 1000
    _chown_data_dir "ape" 100
    _chown_data_dir "langfuse" 1001
fi

Where _chown_data_dir uses a helper container (since the host user may not have sudo):

_chown_data_dir() {
    local svc="$1" uid="$2"
    local dir="$INSTALL_DIR/data/$svc"
    [[ -d "$dir" ]] || return 0
    docker run --rm --user 0:0 -v "$dir:/data" alpine \
        sh -c "chown -R ${uid}:${uid} /data" 2>/dev/null || true
}

Option B — Use docker run --user 0:0 for the chown in the entrypoint

Services like hermes already attempt a chown in their entrypoint (Fixing ownership of /opt/data to hermes (10000)), but it fails because the container has already dropped root privileges or because rootless remapping prevents it. Running the chown before dropping privileges, or using user: "0:0" in the compose file for the initial setup step, would fix this.

Option C — Document the rootless requirement

At minimum, detect rootless mode during ods doctor / ods preflight and warn the user that non-root containers need manual permission fixes, with the workaround commands printed.

Additional context

• Docker rootless is increasingly common for security best practices (running the Docker daemon as a non-root user).
• The hermes entrypoint already tries to chown /opt/data but fails with Warning: chown failed (rootless container?) — the detection is there but the fix is incomplete.
• This affects both fresh installs and reinstalls.

[IronicRayquaza]

This issue has been reffered to in my PR: #1708

[AniketBajaj2024]

Hi, I've put up a fix for this in PR : #1709

Root cause confirmed: in rootless mode, container UIDs are remapped so non-root container users (node/1000, hermes/10000, etc.) map to host UIDs 100000+ which have no write permission on installer-created directories.

Fix detects rootless mode at install time, on ods start, and onods restart, then uses a helper container running as root (which maps back to the host user) to chown each affected data directory to the correct container UID. Also adds a clear failure message to ods-preflight so rootless users get an actionable error instead of hunting through container logs.

Affected services covered: n8n, hermes, whisper, tts, token-spy, privacy-shield, ape, langfuse (all three users — nextjs, postgres, clickhouse).

Non-rootless installs are unaffected — the detection returns early if rootless is not active.

[IMNotMax]

[UPDATE - Script is modified to take in consideration /data /config-backups and .env file directly ]

Hi there, looks like there is another issue with the rootless docker thing.
Looks like you have to initialize the ODS_AGENT_HOST (it's working for me with the Ip of the VM 192.168.2.22 for example) and ODS_AGENT_BIND (0.0.0.0)

I'm testing things with my workaround : a script made by my local Hermes agent with GLM5.2 :P :

cat ods-fix-permissions.sh

#!/usr/bin/env bash
#
# ods-fix-permissions.sh
#
# Fixes data directory ownership for ODS containers running in Docker rootless mode.
# In rootless mode, container UIDs are remapped (e.g. container UID 1000 -> host UID 100000),
# so data directories owned by the host user are not writable by non-root container users.
#
# This script dynamically discovers all running ODS containers, detects the UID each
# container uses, and chowns the corresponding data directory to that UID using a helper
# container (root in container = host user in rootless mode).
#
# Usage:
#   ./ods-fix-permissions.sh              # fix all services
#   ./ods-fix-permissions.sh n8n           # fix a specific service
#   ./ods-fix-permissions.sh --dry-run     # show what would be done without changing anything
#
# Requires: Docker (rootless or rootful), the ODS install directory at ~/ods (or $ODS_DIR)
#

set -uo pipefail
# Do NOT use set -e: helper container commands may return non-zero
# (e.g. when a directory doesn't exist) and we want to continue.

ODS_DIR="${ODS_DIR:-$HOME/ods}"
DATA_DIR="$ODS_DIR/data"
DRY_RUN=false
TARGET=""

# Colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Parse args
for arg in "$@"; do
    case "$arg" in
        --dry-run) DRY_RUN=true ;;
        -h|--help)
            echo "Usage: $0 [--dry-run] [service_name]"
            echo "  --dry-run    Show what would be changed without making changes"
            echo "  service_name Fix only the specified service (e.g. n8n, hermes, comfyui)"
            exit 0
            ;;
        *) TARGET="$arg" ;;
    esac
done

# Check Docker is available
if ! command -v docker &>/dev/null; then
    echo -e "${RED}Error: docker not found in PATH${NC}"
    exit 1
fi

if [[ ! -d "$DATA_DIR" ]]; then
    echo -e "${RED}Error: ODS data directory not found at $DATA_DIR${NC}"
    echo "Set ODS_DIR environment variable if ODS is installed elsewhere."
    exit 1
fi

# Detect rootless mode
_is_rootless() {
    docker info --format '{{.SecurityOptions}}' 2>/dev/null | grep -q rootless
}

# Resolve a container's UID by trying multiple methods:
#   1. If Config.User is numeric (e.g. "1000:1000"), extract the UID
#   2. If container is running, exec id -u
#   3. If not running but user is a name, try docker run --entrypoint id <image> <user>
#   4. If empty or "root", return 0
get_container_uid() {
    local container_name="$1"
    local user_spec img uid

    user_spec=$(docker inspect "$container_name" --format '{{.Config.User}}' 2>/dev/null || echo "")

    # Numeric user spec (e.g. "1000:1000" or "1000")
    if [[ "$user_spec" =~ ^([0-9]+)(:[0-9]+)?$ ]]; then
        echo "${BASH_REMATCH[1]}"
        return 0
    fi

    # Container is running — exec id
    if docker ps --format '{{.Names}}' 2>/dev/null | grep -qx "$container_name"; then
        uid=$(docker exec "$container_name" id -u 2>/dev/null || echo "")
        if [[ -n "$uid" ]]; then
            echo "$uid"
            return 0
        fi
    fi

    # Not running but user is a named user — try resolving from image
    if [[ -n "$user_spec" && "$user_spec" != "root" && "$user_spec" != "0" && "$user_spec" != "0:0" ]]; then
        img=$(docker inspect "$container_name" --format '{{.Config.Image}}' 2>/dev/null || echo "")
        if [[ -n "$img" ]]; then
            uid=$(docker run --rm --entrypoint id "$img" "$user_spec" 2>/dev/null | grep -oP '^uid=\K[0-9]+' || echo "")
            if [[ -n "$uid" ]]; then
                echo "$uid"
                return 0
            fi
        fi
    fi

    # root or empty = 0
    echo "0"
}

# Map a container name (ods-<svc>) to the service name (strip ods- prefix)
get_service_name() {
    local container_name="$1"
    echo "${container_name#ods-}"
}

# Map service name to data directory name.
# Most services use data/<service-name>/ but some use a different path.
# We detect this dynamically by inspecting the container's volume mounts.
get_data_dirs_for_container() {
    local container_name="$1"
    # List all bind-mount sources that point into ~/ods/data/
    docker inspect "$container_name" --format '{{range .Mounts}}{{if eq .Type "bind"}}{{.Source}}{{println}}{{end}}{{end}}' 2>/dev/null \
        | grep -E "^${DATA_DIR}/[^/]" 2>/dev/null \
        | sed "s|^${DATA_DIR}/||" \
        | cut -d/ -f1 \
        | sort -u
}

# Chown a data directory to the given UID using a helper container
fix_dir() {
    local dir="$1" uid="$2"

    if [[ ! -d "$dir" ]]; then
        echo -e "    ${YELLOW}SKIP (directory does not exist): $dir${NC}"
        return 0
    fi

    local current_uid
    current_uid=$(docker run --rm --user 0:0 -v "$dir:/data" alpine stat -c '%u' /data 2>/dev/null || echo "?")

    if [[ "$current_uid" == "$uid" ]]; then
        echo -e "    ${GREEN}OK (already owned by $uid): $(basename "$dir")${NC}"
        return 0
    fi

    if $DRY_RUN; then
        echo -e "    ${BLUE}DRY-RUN: would chown $(basename "$dir") from $current_uid to $uid${NC}"
        return 0
    fi

    echo -e "    ${YELLOW}FIXING: chown $(basename "$dir") from $current_uid to $uid${NC}"
    docker run --rm --user 0:0 -v "$dir:/data" alpine \
        sh -c "chown -R ${uid}:${uid} /data && chmod -R u+rwX,g+rwX /data" 2>/dev/null && \
        echo -e "    ${GREEN}DONE${NC}" || \
        echo -e "    ${RED}FAILED${NC}"
}

# Fix a single file (for .env etc.)
fix_file() {
    local filepath="$1" uid="$2" gid="$3" mode="$4"
    local relpath="${filepath#$ODS_DIR/}"

    if [[ ! -e "$filepath" ]]; then
        echo -e "  ${YELLOW}SKIP (not found): $relpath${NC}"
        return 0
    fi

    local current_uid
    current_uid=$(docker run --rm --user 0:0 -v "$filepath:/data/file" alpine stat -c '%u' /data/file 2>/dev/null || echo "?")

    if [[ "$current_uid" == "$uid" ]]; then
        echo -e "  ${GREEN}OK (already $uid:$gid): $relpath${NC}"
    else
        if $DRY_RUN; then
            echo -e "  ${BLUE}DRY-RUN: would chown $relpath from $current_uid to $uid:$gid${NC}"
        else
            echo -e "  ${YELLOW}FIXING: chown $relpath from $current_uid to $uid:$gid${NC}"
            docker run --rm --user 0:0 -v "$filepath:/data/file" alpine \
                sh -c "chown ${uid}:${gid} /data/file && chmod ${mode} /data/file" 2>/dev/null && \
                echo -e "  ${GREEN}DONE${NC}" || \
                echo -e "  ${RED}FAILED${NC}"
        fi
    fi
}

echo ""
echo "=========================================="
echo "  ODS Permission Fixer (rootless mode)"
echo "=========================================="
echo ""

if ! _is_rootless; then
    echo -e "${YELLOW}Warning: Docker does not appear to be in rootless mode.${NC}"
    echo -e "${YELLOW}This script is designed for rootless deployments.${NC}"
    echo -e "${YELLOW}Proceeding anyway...${NC}"
    echo ""
fi

echo "ODS install dir:  $ODS_DIR"
echo "ODS data dir:    $DATA_DIR"
echo ""

if $DRY_RUN; then
    echo -e "${BLUE}DRY RUN — no changes will be made${NC}"
    echo ""
fi

# --- Discover all ODS containers dynamically ---
ALL_CONTAINERS=()
while IFS= read -r name; do
    [[ -n "$name" ]] && ALL_CONTAINERS+=("$name")
done < <(docker ps -a --format '{{.Names}}' 2>/dev/null | grep '^ods-' | sort)

if [[ ${#ALL_CONTAINERS[@]} -eq 0 ]]; then
    echo -e "${RED}No ODS containers found (looking for ods-* prefix)${NC}"
    exit 1
fi

if [[ -n "$TARGET" ]]; then
    # Filter to a single service
    target_container="ods-${TARGET}"
    found=false
    for c in "${ALL_CONTAINERS[@]}"; do
        if [[ "$c" == "$target_container" ]]; then
            ALL_CONTAINERS=("$c")
            found=true
            break
        fi
    done
    if ! $found; then
        echo -e "${RED}Container '$target_container' not found${NC}"
        echo "Available: ${ALL_CONTAINERS[*]}"
        exit 1
    fi
    echo "Targeting single service: $TARGET"
    echo ""
else
    echo "Discovered ${#ALL_CONTAINERS[@]} ODS containers"
    echo ""
fi

# --- Phase 1: Fix per-container data directories ---
echo "Phase 1: Scanning container data directories..."
echo ""

fixed_count=0
ok_count=0
skip_count=0
seen_dirs=()

for container_name in "${ALL_CONTAINERS[@]}"; do
    svc=$(get_service_name "$container_name")
    uid=$(get_container_uid "$container_name")

    echo -e "${BLUE}[$svc]${NC} container=$container_name UID=$uid"

    if [[ "$uid" == "0" ]]; then
        echo -e "    ${GREEN}Runs as root (UID 0) — no fix needed${NC}"
        ((ok_count++))
        echo ""
        continue
    fi

    # Find all data subdirs this container mounts
    data_dirs=$(get_data_dirs_for_container "$container_name")

    if [[ -z "$data_dirs" ]]; then
        echo -e "    ${YELLOW}No data/ bind mounts — skipping${NC}"
        ((skip_count++))
        echo ""
        continue
    fi

    for dirname in $data_dirs; do
        data_path="$DATA_DIR/$dirname"

        # Skip if already processed (multiple containers may share a dir)
        local_seen=false
        for sd in "${seen_dirs[@]:-}"; do
            if [[ "$sd" == "$data_path" ]]; then
                local_seen=true
                break
            fi
        done
        if $local_seen; then
            echo -e "    ${YELLOW}SKIP (already processed): $dirname${NC}"
            continue
        fi
        seen_dirs+=("$data_path")

        fix_dir "$data_path" "$uid"
    done

    echo ""
done

# --- Phase 2: Fix ODS root files ---
echo "Phase 2: Fixing ODS root files (.env)..."
echo ""

ROOT_FILES=(
    ".env:1000:1000:664"
    ".env.example:1000:1000:664"
    ".env.schema.json:1000:1000:664"
)

for entry in "${ROOT_FILES[@]}"; do
    IFS=':' read -r relpath uid gid mode <<< "$entry"
    filepath="$ODS_DIR/$relpath"
    fix_file "$filepath" "$uid" "$gid" "$mode"
done

echo ""

# --- Phase 3: Fix ODS data root directory and host-agent writable dirs ---
echo "Phase 3: Fixing ODS data root + host-agent writable directories..."
echo ""

# Directories that the host-agent (running as the host user, e.g. maxs UID 1000)
# needs to write to. In rootless mode these must be owned by UID 0 (container root
# = host user) so the host-agent process can create files in them.
# We use GID 1000 (container) so containers with UID 1000 can also write via group.
HOST_AGENT_DIRS=(
    "config-backups"
)

for dirname in "${HOST_AGENT_DIRS[@]}"; do
    dirpath="$DATA_DIR/$dirname"
    if [[ ! -d "$dirpath" ]]; then
        if $DRY_RUN; then
            echo -e "  ${BLUE}DRY-RUN: would create data/$dirname/ owned by 0:1000${NC}"
        else
            echo -e "  ${YELLOW}Creating data/$dirname/ (owned by 0:1000)${NC}"
            docker run --rm --user 0:0 -v "$DATA_DIR:/data" alpine \
                sh -c "mkdir -p /data/$dirname && chown 0:1000 /data/$dirname && chmod 775 /data/$dirname" 2>/dev/null && \
                echo -e "  ${GREEN}DONE${NC}" || echo -e "  ${RED}FAILED${NC}"
        fi
        ((fixed_count++))
    else
        current_uid=$(docker run --rm --user 0:0 -v "$dirpath:/data" alpine stat -c '%u:%g' /data 2>/dev/null || echo "?:?")
        if [[ "$current_uid" == "0:1000" ]]; then
            echo -e "  ${GREEN}OK (0:1000): data/$dirname/${NC}"
            ((ok_count++))
        else
            if $DRY_RUN; then
                echo -e "  ${BLUE}DRY-RUN: would chown data/$dirname/ from $current_uid to 0:1000${NC}"
            else
                echo -e "  ${YELLOW}FIXING: chown data/$dirname/ from $current_uid to 0:1000${NC}"
                docker run --rm --user 0:0 -v "$dirpath:/data" alpine \
                    sh -c "chown 0:1000 /data && chmod 775 /data" 2>/dev/null && \
                    echo -e "  ${GREEN}DONE${NC}" || echo -e "  ${RED}FAILED${NC}"
            fi
            ((fixed_count++))
        fi
    fi
done

# Fix data root directory itself.
# In rootless mode, both the host user and container UID 1000 need write access.
# Strategy: chown to 0:1000 (container) which maps to:
#   owner = host UID 1000 (maxs) → host scripts and host-agent can write
#   group = host GID 100999       → container UID 1000 (dashboard-api) can write via group
data_root="$ODS_DIR/data"
if [[ -d "$data_root" ]]; then
    current_uid=$(docker run --rm --user 0:0 -v "$data_root:/data" alpine stat -c '%u:%g' /data 2>/dev/null || echo "?:?")
    if [[ "$current_uid" == "0:1000" ]]; then
        echo -e "  ${GREEN}OK (root:1000, mode 775): data/${NC}"
        ((ok_count++))
    else
        if $DRY_RUN; then
            echo -e "  ${BLUE}DRY-RUN: would chown data/ from $current_uid to 0:1000 + chmod 775${NC}"
        else
            echo -e "  ${YELLOW}FIXING: chown data/ from $current_uid to 0:1000 + chmod 775${NC}"
            docker run --rm --user 0:0 -v "$data_root:/data" alpine \
                sh -c "chown 0:1000 /data && chmod 775 /data" 2>/dev/null && \
                echo -e "  ${GREEN}DONE${NC}" || echo -e "  ${RED}FAILED${NC}"
        fi
        ((fixed_count++))
    fi
fi

echo ""

# --- Phase 4: Ensure host-agent is reachable (rootless network fix) ---
echo "Phase 4: Checking host-agent network config..."
echo ""

env_file="$ODS_DIR/.env"
needs_bind=false
needs_host=false

# Check ODS_AGENT_BIND
has_bind=$(docker run --rm --user 0:0 -v "$env_file:/data/file" alpine sh -c "grep -q '^ODS_AGENT_BIND=0.0.0.0' /data/file && echo yes || echo no" 2>/dev/null || echo "no")
if [[ "$has_bind" == "no" ]]; then
    if $DRY_RUN; then
        echo -e "  ${BLUE}DRY-RUN: would add ODS_AGENT_BIND=0.0.0.0 to .env${NC}"
    else
        echo -e "  ${YELLOW}Adding ODS_AGENT_BIND=0.0.0.0 to .env${NC}"
        docker run --rm --user 0:0 -v "$env_file:/data/file" alpine sh -c "echo 'ODS_AGENT_BIND=0.0.0.0' >> /data/file" 2>/dev/null && \
            echo -e "  ${GREEN}DONE${NC}" || echo -e "  ${RED}FAILED${NC}"
        ((fixed_count++))
    fi
else
    echo -e "  ${GREEN}OK: ODS_AGENT_BIND=0.0.0.0 already in .env${NC}"
    ((ok_count++))
fi

# Check ODS_AGENT_HOST — needed in rootless so containers can reach the agent via LAN IP
if _is_rootless; then
    has_host=$(docker run --rm --user 0:0 -v "$env_file:/data/file" alpine sh -c "grep -q '^ODS_AGENT_HOST=' /data/file && echo yes || echo no" 2>/dev/null || echo "no")
    if [[ "$has_host" == "no" ]]; then
        # Auto-detect LAN IP
        lan_ip=$(ip -4 addr show scope global 2>/dev/null | grep -oP 'inet \K[\d.]+' | grep -v '^127\.' | grep -v '^172\.' | head -1)
        if [[ -z "$lan_ip" ]]; then
            lan_ip=$(hostname -I 2>/dev/null | awk '{print $1}')
        fi
        if [[ -n "$lan_ip" ]]; then
            if $DRY_RUN; then
                echo -e "  ${BLUE}DRY-RUN: would add ODS_AGENT_HOST=$lan_ip to .env${NC}"
            else
                echo -e "  ${YELLOW}Adding ODS_AGENT_HOST=$lan_ip to .env${NC}"
                docker run --rm --user 0:0 -v "$env_file:/data/file" alpine sh -c "echo 'ODS_AGENT_HOST=$lan_ip' >> /data/file" 2>/dev/null && \
                    echo -e "  ${GREEN}DONE${NC}" || echo -e "  ${RED}FAILED${NC}"
                ((fixed_count++))
            fi
        else
            echo -e "  ${RED}Could not auto-detect LAN IP for ODS_AGENT_HOST${NC}"
            ((skip_count++))
        fi
    else
        echo -e "  ${GREEN}OK: ODS_AGENT_HOST already in .env${NC}"
        ((ok_count++))
    fi
fi

echo ""

# --- Summary ---
echo "=========================================="
echo "  Summary"
echo "=========================================="
echo "  Fixed:     $fixed_count"
echo "  OK:        $ok_count"
echo "  Skipped:   $skip_count"
echo "=========================================="
echo ""

if [[ $fixed_count -gt 0 ]] && ! $DRY_RUN; then
    echo -e "${GREEN}Permissions corrected. Restart ODS to apply changes:${NC}"
    echo "  ods restart"
    echo ""
fi

if $DRY_RUN; then
    echo -e "${BLUE}This was a dry run. Re-run without --dry-run to apply changes.${NC}"
    echo ""
fi

[AniketBajaj2024]

@IMNotMax Hey,
Two things from your findings:

1. ODS_AGENT_HOST / ODS_AGENT_BIND — I think that's a separate issue from what this PR fixes. The permission fix is purely about data directory ownership (the EACCES errors). The agent host networking issue (rootlesskit's network namespace not matching the auto-detected gateway) would need its own fix. Worth opening a dedicated issue for it so it doesn't get buried here.

2. I missed comfyui . The comfyui Dockerfile creates user comfyui at UID 1000, so it has the same problem. I'm addingcomfyui:1000 to the UID map in the PR now.

Thanks

[IronicRayquaza]

Problem

Docker rootless mode introduced two separate issues:

1. Host agent connectivity

   • host.docker.internal is not automatically available inside rootless Docker containers, preventing containers from reaching the host agent.

2. Directory ownership

   • Container UIDs are remapped through the host user's subuid range, causing data directories created by the installer to be owned by the wrong host UID and therefore unwritable by some containers.

Changes

Rootless Agent Network Support

Added ods_fix_rootless_agent_network to automatically configure host-agent communication in rootless environments.

• Detects Docker rootless mode.
• Sets ODS_AGENT_BIND=0.0.0.0 so the host agent listens on all interfaces, including the Docker bridge.
• Automatically detects the host LAN IP (using ip with hostname -I as a fallback) and populates ODS_AGENT_HOST.
• Preserves existing user-defined ODS_AGENT_HOST values instead of overwriting custom configurations.

Automated Directory Permission Fixes

Improved rootless ownership handling for persistent data directories.

• Corrects remapped UID ownership for services (e.g. n8n, hermes) using transient Alpine containers.
• Requires no host sudo privileges.
• Ensures containers can write to their data directories after installation or update.

Automatic Recovery

The fixes now run automatically during Phase 6 (06-directories.sh) of installation and updates.

A manual recovery command is also available:

ods repair rootless-ownership

This command:

• Repairs rootless directory ownership.
• Rewrites the required .env values for host-agent connectivity.
• Restores a working rootless installation without requiring manual intervention.

Doctor Integration

Updated ods doctor to:

• Detect rootless ownership and host-agent networking issues.
• Recommend the appropriate automatic repair when problems are found.

Result

Rootless Docker installations now work out of the box without requiring manual permission changes or custom networking configuration. Existing custom agent host overrides continue to be respected.

[IMNotMax]

Yup, about ODS_AGENT_keys it's not the same issue BUT as a rootless user, I found I had to configure these keys. So it should be great to have these key initialized when you detect a rootless docker user.

And I also find the Tailscale is also impacted BUT looks like the Tailscale container cannot be used in rootless docker env. I will dig this one too and share my findings.
best !

[IMNotMax]

BTW, I just update the script above to use groups of permissions to manage access to the /data /config-backups and .env file
It should be more elegant as a workaround I think

[IMNotMax]

Hello again.
One step further, ODS-PROXY in rootless mode cannot listen to port <1024

This below allow it

sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80
echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee /etc/sysctl.d/99-rootless-ports.conf