[ERROR] Can't create 'data/rsa_key.pem': Permission denied

[riwich]

Hi,

Currently I run Vaultwarden in a Docker Container on a Rasperry Pi, all fine... But now, I want to move it to a Proxmox KVM but I'm unable to stage Valtwarden...

After many unsuccessful attempts with Debian, DietPi OS, Alpine, I don't know what to do... Maybe someone can help?
Other Docker containers work fine on this VM, only Vaultwarden won't start and reports these errors:
[2024-01-08 18:36:24.807][vaultwarden::util][ERROR] Can't create 'data/rsa_key.pem': Permission denied
[2024-01-08 18:36:24.807][vaultwarden][ERROR] Error creating keys, exiting...

I use Docker Compose with these values:

vault:
container_name: vault
restart: unless-stopped
user: 1000:1000
ports:
- 9005:80
volumes:
- ./container/vault:/data
environment:
- ADMIN_TOKEN="$$argon2id$$.......
image: vaultwarden/server:latest

(The admin token is of course complete in my configuration and was created exactly according to the instructions... )

and start the containers with:
sudo docker compose up -d

The identical, but older configuration, works fine on my old Rasperry Pi....

I am grateful for any help!

[hobgoblin-technology]

I'm having the same issue. I fixed it once by dumb luck, but the container setup didn't work for me so I tore it down. now pulling my hair out at this issue again.

[riwich]

I'm not sure if this is the solution, to me it sounds more like a workaround, but at least I got Vaultwarden running again.

How? By first completely removing the configuration directory for Vaultwarden (the directory before ":/data") and then recreating it manually as "user" (NOT AS root nor with sudo!!!). Then I reinstall Vaultwarden with "sudo docker compose up -d".

This is how it works for me.... I hope this works for you too!
Good luck!

[hobgoblin-technology]

did some investigating and it seems to be an SELinux issue on my end. you may be able to fix it with the following commands, although my machine is being a bit more stuborn.

ausearch -c 'vaultwarden' --raw | audit2allow -M my-vaultwarden semodule -X 300 -i my-vaultwarden.pp

[hobgoblin-technology]

Got an answer, at least for my problem. SELinux wasn't labeling the file in the right context, and using the above command didn't actually change that. I found it easier just to recreate the container appending :Z to the end of the folder sharing argument of podman. Sounds kinda convoluted, but here's the final command:
podman run -d --name vaultwarden -v /home/<username>/vw-data/:/data/:Z -p 127.0.0.1:8080:80 --restart unless-stopped vaultwarden/server:latest
This tells SELinux to change the file context to container_file_t, which I had tried changing it to after the fact with no success.
I hope this helps someone having a similar issue in a few years!
Edit: here's the blogpost which led me to this - https://blog.christophersmart.com/2021/01/31/podman-volumes-and-selinux/

[burneystarke]

I experienced this issue while changing the user:group to 3000:3000.

During the process I did a chmod -R 660 on my ./data directory.

This was resolved by setting the permission to 760. I have no idea why it would need execute on a pem file, but that resolved it for me.

[stefan0xC]

The execution bit means something else for directories. Cf. https://www.gnu.org/software/coreutils/manual/html_node/Mode-Structure.html or https://man.archlinux.org/man/chmod.1

[burneystarke]

This was the exact problem. I had to set my directories to include execute. Thanks for the linking the source on that.

[kuan51]

I just ran into this issue as well. I was wanting to avoid mounting this directory to my host filesystem. So I configured a docker volume for it. Removing user: 1000:1000 fixed the issue. Seems to be that if you are using a docker volume, setting the user creates a file access permissions issue. Removing the user line allowed vaultwarden to start up.

Working compose section:

vaultwarden:
    image: vaultwarden/server:alpine
    container_name: vaultwarden
    env_file:
      - vaultwarden.env
    environment:
      - USE_SYSLOG=true
      - LOG_LEVEL=warn
      - EXTENDED_LOGGING=true
    volumes:
      - vaultwarden:/data/
    restart: always
    networks:
      - vaultwarden
    depends_on:
      vaultwarden-db:
        condition: service_healthy
    healthcheck:
      test: curl -s -L http://localhost:80/alive
      start_period: 5s
      interval: 30s
      timeout: 5s
      retries: 55

volumes:
  vaultwarden:
  vaultwarden_db:

[destratify]

that did it for me! thanks so much!