[Feature]: running proxy (nginx) as a non-root user

[MichaelBui]

Feature detail

Expectation:
To be able to run the whole system as a non-root user so that the user's dir can be shared with other apps (e.g: via data sync, symlink,...)

Current situation:
This line (nginx/start.sh#L15) will fail if running the proxy container as a non-root user:

envsubst '$IMMICH_WEB_SCHEME $IMMICH_WEB_HOST  $IMMICH_SERVER_SCHEME $IMMICH_SERVER_HOST' < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf

Other solutions are also welcome & appreciated!

Platform

Server

[BadCo-NZ]

I have been looking into this myself as I attempt to deploy immich in my homelab.

Came across this that might be useful:
https://github.com/nginxinc/docker-nginx-unprivileged

[BadCo-NZ]

Also from https://hub.docker.com/_/nginx:

Running nginx as a non-root user

---

It is possible to run the image as a less privileged arbitrary UID/GID. This, however, requires modification of nginx configuration to use directories writeable by that specific UID/GID pair:

$ docker run -d -v $PWD/nginx.conf:/etc/nginx/nginx.conf nginx

where nginx.conf in the current directory should have the following directives re-defined:

pid /tmp/nginx.pid;

And in the http context:

http {
   client_body_temp_path /tmp/client_temp;
   proxy_temp_path       /tmp/proxy_temp_path;
   fastcgi_temp_path     /tmp/fastcgi_temp;
   uwsgi_temp_path       /tmp/uwsgi_temp;
   scgi_temp_path        /tmp/scgi_temp;
...
}

Alternatively, check out the official Docker NGINX unprivileged #image.

[Pheggas]

I understand your approach with Nginx but if you don't mind changing reverse proxy, go with Traefik. It can be detached from any other container (like Immich for example) and can be run as non-root user. I'm not sure if i satisfied your post but let me know.