influxdata / influxdata/influxdb
v1.7.0+: nginx [alert] on every startup — `influxui` (uid 1500) is not a member of the `nginx` group
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
## Summary
Since v1.7.0 the container runs as non-root `influxui` (uid 1500). On every startup, nginx emits two `[alert]` warnings:
```
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)
```
Non-fatal — nginx then loads `/app-root/nginx.conf` and switches to `/var/log/nginx/error.log` — but the alert pollutes logs and triggers downstream alerting in production deployments.
## Root cause
`/var/lib/nginx/` in the image is mode `750`, owned by `nginx:nginx` (gid `101`). `influxui` is **not a member of the `nginx` group**, so it cannot traverse `/var/lib/nginx/`. nginx attempts to open its compile-time default error log (`/logs/error.log`, where prefix is `/var/lib/nginx`) **before** reading `nginx.conf`; that open() fails on the parent-directory traversal.
## Suggested fix
Add `influxui` to the `nginx` group during image build (one line in the Dockerfile, e.g. `addgroup influxui nginx` on Alpine). Group `101` already has the required permissions on `/var/lib/nginx/` and its symlinked `logs` target.
Reproduction (1 command)
```bash
docker run --rm influxdata/influxdb3-ui:latest 2>&1 | grep -i alert
```
Output:
```
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)
```
Evidence — permission state inside the image
```bash
$ docker run --rm -u 0 --entrypoint sh influxdata/influxdb3-ui:latest -c \
"stat -c 'mode=%a owner=%U group=%G' /var/lib/nginx/; \
getent group nginx; \
ls -la /var/lib/nginx/"
mode=750 owner=nginx group=nginx
nginx:x:101:nginx
drwxr-x--- 4 nginx nginx 4096 Apr 14 18:05 .
drwxr-xr-x 1 root root 4096 Apr 14 18:05 ..
drwxr-xr-x 2 root root 4096 Apr 14 18:05 html
lrwxrwxrwx 1 root root 14 Apr 14 18:05 logs -> /var/log/nginx
lrwxrwxrwx 1 root root 22 Apr 14 18:05 modules -> /usr/lib/nginx/modules
lrwxrwxrwx 1 root root 10 Apr 14 18:05 run -> /run/nginx
drwx------ 2 nginx nginx 4096 Apr 14 18:05 tmp
```
```bash
$ docker run --rm influxdata/influxdb3-ui:latest sh -c "id; ls /var/lib/nginx/"
uid=1500(influxui) gid=1500(influxui) groups=1500(influxui)
ls: can't open '/var/lib/nginx/': Permission denied
```
`/var/lib/nginx/logs` is a symlink to `/var/log/nginx`, which **is** owned by `influxui:influxui`. So once `nginx.conf` is loaded the actual logging works fine — only the compile-time-default open() before config load fails.
nginx compile-time defaults (relevant lines from `nginx -V`):
```
--prefix=/var/lib/nginx
--pid-path=/run/nginx/nginx.pid
```
Verified workaround for users hitting this now
Add gid `101` (the `nginx` group) as a supplementary group in Compose:
```yaml
services:
influxdb3-explorer:
image: influxdata/influxdb3-ui:latest
group_add:
- "101"
```
Or with `docker run`: `--group-add 101`.
After this, the alert no longer appears; only the normal config-test output remains.
Environment
- Image: `influxdata/influxdb3-ui:latest`
- Digest: `sha256:0d61aa4df9bbbf34b520d1de13f532b9fea70c8f0a459e75db40766b5505d6f1`
- Backend App Version (per startup log): `1.7.0`
- Reproduced on: Docker 29.4.0 / macOS, also seen in production on Ubuntu (Dokploy)
Contributor guide
Research direction
Start with the image Dockerfile and the nginx group configuration described in the issue. Reproduce with the provided docker run command, then verify the image starts without the permission-denied [alert] messages while retaining normal nginx startup output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, nginx
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100