influxdata / influxdata/influxdb

v1.7.0+: nginx [alert] on every startup — `influxui` (uid 1500) is not a member of the `nginx` group

Open Beginner friendly
#27,377 2 comments 0 reactions 0 assignees View on GitHub
v3 v3-data-explorer
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

## Summary

Since v1.7.0 the container runs as non-root `influxui` (uid 1500). On every startup, nginx emits two `[alert]` warnings:

```
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)
```

Non-fatal — nginx then loads `/app-root/nginx.conf` and switches to `/var/log/nginx/error.log` — but the alert pollutes logs and triggers downstream alerting in production deployments.

## Root cause

`/var/lib/nginx/` in the image is mode `750`, owned by `nginx:nginx` (gid `101`). `influxui` is **not a member of the `nginx` group**, so it cannot traverse `/var/lib/nginx/`. nginx attempts to open its compile-time default error log (`/logs/error.log`, where prefix is `/var/lib/nginx`) **before** reading `nginx.conf`; that open() fails on the parent-directory traversal.

## Suggested fix

Add `influxui` to the `nginx` group during image build (one line in the Dockerfile, e.g. `addgroup influxui nginx` on Alpine). Group `101` already has the required permissions on `/var/lib/nginx/` and its symlinked `logs` target.

Reproduction (1 command)

```bash
docker run --rm influxdata/influxdb3-ui:latest 2>&1 | grep -i alert
```

Output:
```
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)
nginx: [alert] could not open error log file: open() "/var/lib/nginx/logs/error.log" failed (13: Permission denied)
```

Evidence — permission state inside the image

```bash
$ docker run --rm -u 0 --entrypoint sh influxdata/influxdb3-ui:latest -c \
"stat -c 'mode=%a owner=%U group=%G' /var/lib/nginx/; \
getent group nginx; \
ls -la /var/lib/nginx/"
mode=750 owner=nginx group=nginx
nginx:x:101:nginx
drwxr-x--- 4 nginx nginx 4096 Apr 14 18:05 .
drwxr-xr-x 1 root root 4096 Apr 14 18:05 ..
drwxr-xr-x 2 root root 4096 Apr 14 18:05 html
lrwxrwxrwx 1 root root 14 Apr 14 18:05 logs -> /var/log/nginx
lrwxrwxrwx 1 root root 22 Apr 14 18:05 modules -> /usr/lib/nginx/modules
lrwxrwxrwx 1 root root 10 Apr 14 18:05 run -> /run/nginx
drwx------ 2 nginx nginx 4096 Apr 14 18:05 tmp
```

```bash
$ docker run --rm influxdata/influxdb3-ui:latest sh -c "id; ls /var/lib/nginx/"
uid=1500(influxui) gid=1500(influxui) groups=1500(influxui)
ls: can't open '/var/lib/nginx/': Permission denied
```

`/var/lib/nginx/logs` is a symlink to `/var/log/nginx`, which **is** owned by `influxui:influxui`. So once `nginx.conf` is loaded the actual logging works fine — only the compile-time-default open() before config load fails.

nginx compile-time defaults (relevant lines from `nginx -V`):
```
--prefix=/var/lib/nginx
--pid-path=/run/nginx/nginx.pid
```

Verified workaround for users hitting this now

Add gid `101` (the `nginx` group) as a supplementary group in Compose:

```yaml
services:
influxdb3-explorer:
image: influxdata/influxdb3-ui:latest
group_add:
- "101"
```

Or with `docker run`: `--group-add 101`.

After this, the alert no longer appears; only the normal config-test output remains.

Environment

- Image: `influxdata/influxdb3-ui:latest`
- Digest: `sha256:0d61aa4df9bbbf34b520d1de13f532b9fea70c8f0a459e75db40766b5505d6f1`
- Backend App Version (per startup log): `1.7.0`
- Reproduced on: Docker 29.4.0 / macOS, also seen in production on Ubuntu (Dokploy)

Contributor guide

Open the contributing guide

Research direction

Start with the image Dockerfile and the nginx group configuration described in the issue. Reproduce with the provided docker run command, then verify the image starts without the permission-denied [alert] messages while retaining normal nginx startup output.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, nginx
Domain
devops, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.