PUID and PGID have no effect as shipped — setting them changes nothing and the process always runs as 1000:1000.
README:269-270 documents them as working overrides ("Process UID override, eg. Unraid would be 99"). The remap in entrypoint.sh:38 is gated on running as root (if [[ "$(id -u)" == "0" ]]), but Containerfile:47 drops privileges at build time with USER ${PUID}:${PGID} — and those are ENV defaults of 1000, so that bakes in USER 1000:1000. id -u is never 0, execution always falls through to :53 ("Running as non-root (1000:1000), skipping remap"), and fix_permissions never runs either.
On the Unraid case the README names, that means more than wrong ownership: against a host directory owned by 99:100, the uid-1000 process can't write at all, so the user gets permission errors rather than misowned files.
Fix is to drop the build-time USER so the remap branch can run and setpriv drops privileges itself, which is what the entrypoint was written to do — or keep the non-root default and document that starting as root (user: "0:0") is what enables remapping.
Read from source; not run.
Found with Claude Code.
PUIDandPGIDhave no effect as shipped — setting them changes nothing and the process always runs as1000:1000.README:269-270 documents them as working overrides ("Process UID override, eg. Unraid would be 99"). The remap in
entrypoint.sh:38is gated on running as root (if [[ "$(id -u)" == "0" ]]), butContainerfile:47drops privileges at build time withUSER ${PUID}:${PGID}— and those areENVdefaults of 1000, so that bakes inUSER 1000:1000.id -uis never0, execution always falls through to:53("Running as non-root (1000:1000), skipping remap"), andfix_permissionsnever runs either.On the Unraid case the README names, that means more than wrong ownership: against a host directory owned by
99:100, the uid-1000 process can't write at all, so the user gets permission errors rather than misowned files.Fix is to drop the build-time
USERso the remap branch can run andsetprivdrops privileges itself, which is what the entrypoint was written to do — or keep the non-root default and document that starting as root (user: "0:0") is what enables remapping.Read from source; not run.
Found with Claude Code.