diff --git a/.github/DISCUSSION_TEMPLATE/beta-support.yml b/.github/DISCUSSION_TEMPLATE/beta-support.yml index 478d3e541d..326115f782 100644 --- a/.github/DISCUSSION_TEMPLATE/beta-support.yml +++ b/.github/DISCUSSION_TEMPLATE/beta-support.yml @@ -26,8 +26,8 @@ body: id: version attributes: label: Beta Version - description: Visible on the System Metrics page in the Web UI. Please include the full version including the build identifier (eg. 0.18.0-beta1, 0.18.0-8b72c7a, etc.) - placeholder: "0.18.0-beta1" + description: Visible on the System Metrics page in the Web UI. Please include the full version including the build identifier (eg. 0.19.0-beta1, 0.19.0-8b72c7a, etc.) + placeholder: "0.19.0-beta1" validations: required: true - type: dropdown diff --git a/.github/DISCUSSION_TEMPLATE/report-a-bug.yml b/.github/DISCUSSION_TEMPLATE/report-a-bug.yml index ec28ceb66b..9935439d69 100644 --- a/.github/DISCUSSION_TEMPLATE/report-a-bug.yml +++ b/.github/DISCUSSION_TEMPLATE/report-a-bug.yml @@ -6,7 +6,9 @@ body: value: | Use this form to submit a reproducible bug in Frigate or Frigate's UI. - **⚠️ If you are running a beta version (0.18.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.** + If you are running on Proxmox, please see the [Proxmox FAQ](https://github.com/blakeblackshear/frigate/discussions/23916) and reproduce the issue on a standard Docker install first (bare metal, or a VM running plain Debian/Ubuntu) before submitting here. + + **⚠️ If you are running a beta version (0.19.0-beta or similar), please use the [Beta Support template](https://github.com/blakeblackshear/frigate/discussions/new?category=beta-support) instead.** Before submitting your bug report, please ask the AI with the "Ask AI" button on the [official documentation site][ai] about your issue, [search the discussions][discussions], look at recent open and closed [pull requests][prs], read the [official Frigate documentation][docs], and read the [Frigate FAQ][faq] pinned at the Discussion page to see if your bug has already been fixed by the developers or reported by the community. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2814bb92b0..3ea85f59de 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -303,7 +303,7 @@ jobs: # /run must allow exec: S6_READ_ONLY_ROOT has s6 copy its service # scripts there and run them, and --tmpfs defaults to noexec docker run -d --name frigate-ro --shm-size 256m \ - --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \ + --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000 \ --user 1000:1000 \ --security-opt no-new-privileges:true \ -v /tmp/frigate-config-ro:/config \ @@ -405,7 +405,7 @@ jobs: # the config dir above now holds a go2rtc-owned go2rtc_homekit.yml, # which user: keeps readable but not writable (no supplementary groups) docker run -d --name frigate-rod-user --shm-size 256m \ - --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755 \ + --read-only --tmpfs /tmp:rw,size=1g --tmpfs /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000 \ --user 1000:1000 \ -v /tmp/frigate-config-rod:/config \ -v /tmp/frigate-media-rod:/media/frigate \ diff --git a/docs/docs/configuration/non_root.md b/docs/docs/configuration/non_root.md index c7b6c32263..f6e9dd1e08 100644 --- a/docs/docs/configuration/non_root.md +++ b/docs/docs/configuration/non_root.md @@ -313,8 +313,16 @@ To remove root from the container entirely, add Docker's `user:`: ```yaml user: "1000:1000" # NOT compatible with PUID/PGID, see the run modes table + tmpfs: + - /tmp:size=256m + - /tmp/cache:size=1000000000 + - /run:exec,nosuid,nodev,mode=0755,uid=1000,gid=1000,size=16m # uid must match user: ``` +`/run` has to be owned by that uid as well. s6 writes its runtime state there before anything else starts, and with no root in the container a root-owned `/run` stops it during init with `cannot create /run/test of writability`. Keep `uid` and `gid` in the tmpfs options matching `user:`, and don't carry that pair back into the default mode, where a root-owned `/run` is what keeps the unprivileged services out of s6's runtime state. + +This only bites once root is genuinely gone. s6's init helper is setuid, so `user:` on its own still lets init regain root and correct `/run` itself. The `no-new-privileges:true` above is what blocks that, which is also what makes the `/run` ownership mandatory. Dropping it would hide the problem by handing init root again. + Two things change, and the first one will break a working install if you skip it. The startup device grants can't run, because there is no root left to run them, so every device you pass stops working until you grant that uid access yourself with `group_add:` or a udev rule; see [Manual setup](#manual-setup). Expect this to surface as a driver error rather than a permission error, like `No VA display found` from VAAPI. And every service then runs as that one uid, so go2rtc no longer gets its own restricted user. `/config` and `/media/frigate` have to be owned by that uid already, since Frigate never adjusts ownership in this mode. Switching an existing install over also leaves `/config/go2rtc_homekit.yml` owned by the go2rtc user, which this mode can't write; `chown` it to your uid or HomeKit pairing changes stop persisting. Frigate warns and starts either way. This mode can also take `cap_drop: [ALL]`, which the default mode cannot: starting as root needs `CAP_CHOWN` for the ownership sweep, `CAP_SETUID` and `CAP_SETGID` to drop to the runtime user, and `CAP_FOWNER` for the device grants.