media: set UMASK=002 on all linuxserver containers#599
Merged
Conversation
Without UMASK, linuxserver images default to 022, which creates files as 0644 and directories as 0755. The deploy group is GID 1000 and all containers run PGID=1000, so the host and container identities align — but files created inside the Completed/Series/Films trees are not group-writable. UMASK=002 makes new files 0664 and directories 0775, matching the parent directories (0775 deploy:deploy) set by the tmpfiles z-rules. This ensures Samba (running as a different uid in the deploy group), the *arr import/delete cycle, and any future group-identity tooling can all write freely without needing to be the owning UID. Applies to: qbittorrent, prowlarr (downloads pod), sonarr, radarr, bazarr.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Without an explicit UMASK, linuxserver images default to 022, which creates files as 0644 and directories as 0755 inside the media volumes. All containers run with PUID/PGID=1000, matching the NixOS
deployuser (UID=1000, GID=1000), so the owning UID is always correct. The problem is the missing group-write bit.The tmpfiles
zrules set the top-level directories (/srv/media/Completed,/srv/media/Series,/srv/media/Films) to 0775 withdeploy:deploy. Any subdirectories qbittorrent creates inside those directories are 0755 — not group-writable — because UMASK=022 strips the group write bit from newly created entries.This breaks two things:
enschede-t1000-1run under a different UID in thedeploygroup; without group-write they cannot write back to the library.Setting UMASK=002 makes new files 0664 and new directories 0775, matching the intended parent-directory permissions throughout the media tree.
Applies to: qbittorrent, prowlarr (co-located in the downloads pod), sonarr, radarr, and bazarr.
Note on existing files: UMASK only affects newly created entries. Any files already on disk with 0644/0755 permissions will need a one-time
chmod -R g+rw /srv/mediaonenschede-t1000-1to align with the new default.