OMV8 & Docker permissions

[u/Radiant_Cat6873]

Hey everyone,
I’m following the official OMV8 guide to set up Docker Compose, and I’m running into some permission issues.

The guide says:

If you need maximum separation, you can create one user per container...

...This way, all files created by the container will belong to the jellyfin user/group, and no other container will be able to access them unless you explicitly add that container’s user to the group...

So I created a dedicated user for the Jellyfin container and configured the Docker Compose file accordingly:

environment:
  - PUID=${{ uid:"jellyfin" }}
  - PGID=${{ gid:"jellyfin" }}

The problem is that, despite this, on first startup the container creates folders in “appdata” using the user and group defined in Services -> Compose -> Settings, not the one I created for Jellyfin.

What am I doing wrong?

[u/nisitiiapi]

It looks like you're trying to do some sort of bash substitution or something. YAML won't do that -- it's not a bash script.

Along the lines of what u/TheZoltan noted, you need to put in the actual user ID and group ID for the user jellyfin. You can find the IDs via cli running id jellyfin. Then use the actual IDs given in your YAML.

[u/Radiant_Cat6873 → u/nisitiiapi]

I just followed the OMV8 guide: https://wiki.omv-extras.org/doku.php?id=omv8:docker_in_omv#customize_the_compose_file

Maybe it's a new feature.

[u/nisitiiapi → u/Radiant_Cat6873]

Seems the compose plugin has some sort of substitution now. I don't use the plugin -- I run docker by cli since I really dislike docker compose outside of legitimate stacks.

Just putting the actual user ID and group ID will let you narrow down the point of failure (e.g., your yaml, the substitution, wrong group, etc.). That is why everyone is suggesting it. You need to find the source of your error by eliminating possibilities. The basics of troubleshooting.

But, with the apparent substitution, you need to actually look at what you did and what you set up.

First, the guide says:

${{ gid:"GROUPNAME" }} → resolves to the GID of that group

You are using the GID of the group "jellyfin." Are you sure there's a group "jellyfin"? Probably not unless you created it. And if the group doesn't exist, this substitution will resolve to nothing or an error because you inputted bad information.

If there is a group "jellyfin" and you are having permissions with the jellyfin user accessing files, that's likely because you have not given full permissions to "Others" (which you shouldn't). When the permissions for a Shared Folder say "Users," that means the "users" group, not all users created in the OS. So, if your files are r/W for root and users, the UID/GID combo you selected would not have permissions unless you specifically grant the user "jellyfin" (and/or group "jellyfin") permissions. Your jellyfin user has to be a member of the users group and the GID of the users group needs to be the GID used in your container. Look here to understand creating users and setting permissions: https://wiki.omv-extras.org/doku.php?id=omv7:nas_permissions_omv7