dtoro
5153aeebec
Without keep-id the container's UID:GID maps into the rootless podman subuid range (524288+), so the sidecar couldn't create `/photoprism/originals/.duplicates/` — the archive endpoint failed with "mkdir: permission denied", and rename / folder ops would have hit the same wall. The PhotoPrism container already has this override for the same reason; mirror it for the sidecar. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
35 lines
1.4 KiB
YAML
35 lines
1.4 KiB
YAML
# Podman-rootless overlay for the PhotoPrism stack.
|
|
#
|
|
# Apply alongside the base compose file:
|
|
# podman-compose --env-file .env.photoprism \
|
|
# -f docker-compose.photoprism.yml \
|
|
# -f docker-compose.photoprism.podman.yml \
|
|
# up -d
|
|
#
|
|
# Adds the podman-specific bits that would break a vanilla docker compose run:
|
|
# - userns_mode: keep-id maps container UID to the invoking host UID, so
|
|
# PhotoPrism (running as PP_UID:PP_GID inside) can actually read the
|
|
# bind-mounted originals volume on the host (which is owned by the host
|
|
# user, not by uid 1000-in-the-container-namespace).
|
|
# - the explicit security_opt entries on the base file work in podman as-is.
|
|
|
|
services:
|
|
# MariaDB writes to a named volume managed by podman; its in-container
|
|
# `mysql` user expects to own that volume. keep-id breaks this by mapping
|
|
# in-container UID 999 to a podman-subuid that doesn't own the volume,
|
|
# so let mariadb use the default userns mapping (root-in-namespace).
|
|
mariadb:
|
|
# No userns_mode override — use podman defaults.
|
|
init: true
|
|
|
|
# PhotoPrism does need keep-id, so its container UID maps back to the
|
|
# host UID that owns the bind-mounted originals/.
|
|
photoprism:
|
|
userns_mode: keep-id
|
|
|
|
# Sidecar mutates the originals tree (rename / folder ops / heap
|
|
# convert / .duplicates archive) — same keep-id mapping so its writes
|
|
# land as the host user, not as a podman-subuid the host doesn't own.
|
|
sidecar:
|
|
userns_mode: keep-id
|