Repository navigation
Can't start container - Permission denied #52
Description
PermissionError: [Errno 13] Permission denied: '/home/llms/.llms/extensions'
when start compose file
services:
llms:
image: ghcr.io/servicestack/llms:latest
container_name: llms-py
ports:
# Only reachable from this machine. Use "8000:8000" to expose it on your LAN.
- 7841:8000
volumes:
# User-modifiable config kept outside the container.
# llms.json and providers.json are auto-created on first run.
- ${APP_DATA}/llms:/home/llms/.llms
extra_hosts:
# Lets the container reach services on the host (ollama, LM Studio, ...)
# via http://host.docker.internal:11434 etc.
- host.docker.internal:host-gateway
restart: unless-stopped
healthcheck:
test:
- CMD
- python
- -c
- import urllib.request;
urllib.request.urlopen('http://localhost:8000').read()
interval: 30s
timeout: 10s
retries: 3
start_period: 10sLooking at config it should start with root user. What permissions may be denied?
Activity
mythz commentedon Oct 20, 2026
The image runs as the non-root
llmsuser (UID 1000). Since your Compose file doesn’t specifyuser:, it inherits that setting.Your bind mount replaces
/home/llms/.llmswith${APP_DATA}/llmson the host, so that host directory must be writable by UID 1000. If it didn’t exist before starting Compose, Docker may have created it as root.For a directory dedicated to llms data, run this on the host, with
APP_DATAset to the same value used by Compose:Alternatively, add
user: "UID:GID"to thellmsservice, replacingUID:GIDwith the numeric IDs of the host account that owns the directory.If it still fails, please share the output of:
ls -ldn "${APP_DATA}/llms"Also let us know whether you’re using rootless Docker or an SELinux-enabled host, since those can require different mount permissions.
constgen commentedon Oct 20, 2026
This did work.
Added
user: ${PUID}:${GUID}mythz commentedon Oct 20, 2026
Thanks for confirming! I’ve prepared an update to the Compose files to support configurable user and group IDs:
The docs and installer have also been updated to explain the required bind-mount permissions. These changes don’t require a new Docker image release.
Your existing fix can stay as-is. We use
PGIDfor the group ID in the updated examples, but yourGUIDvariable works equally well if that’s how you’ve defined it.constgen commentedon Oct 21, 2026
You are right. Just didn't notice that