Permission denied to upload with Docker Swarm and NFS

I recently got a new minipc and am in the process of trying (and failing) to migrate services to it. The problem is that I want storage to be on the nas machine (running truenas) still and that opened up a can of worms I was not ready for πŸ˜… I decided to try using Docker Swarm because I need a few other services to run directly on the nas, while being accessible through the traefik instance on the minipc and this seemed like a sensible way to do that. For storage, I'm creating NFS shares on the truenas machine and then mounting them using docker as volumes. Something somewhere is wrong I honestly have no idea what's happing, but I'm getting this error
[Nest] 7 - 09/27/2025, 6:24:31 PM ERROR [Microservices:StorageService] Failed to read (/usr/src/app/upload/encoded-video/.immich): Error: EACCES: permission denied, open '/usr/src/app/upload/encoded-video/.immich'
microservices worker error: Error: Failed to read: "<UPLOAD_LOCATION>/encoded-video/.immich (/usr/src/app/upload/encoded-video/.immich) - Please see link for more information.", stack: Error: Failed to read: "<UPLOAD_LOCATION>/encoded-video/.immich (/usr/src/app/upload/encoded-video/.immich) - Please see link for more information."
at StorageService.verifyReadAccess (/usr/src/app/server/dist/services/storage.service.js:129:19)
at async /usr/src/app/server/dist/services/storage.service.js:56:21
at async /usr/src/app/server/dist/repositories/database.repository.js:379:27
at async /usr/src/app/server/node_modules/.pnpm/kysely@0.28.2/node_modules/kysely/dist/cjs/kysely.js:535:20
at async DefaultConnectionProvider.provideConnection (/usr/src/app/server/node_modules/.pnpm/kysely@0.28.2/node_modules/kysely/dist/cjs/driver/default-connection-provider.js:12:20)
at async /usr/src/app/server/dist/repositories/database.repository.js:376:13
microservices worker exited with code 1
Killing api process
[Nest] 7 - 09/27/2025, 6:24:31 PM ERROR [Microservices:StorageService] Failed to read (/usr/src/app/upload/encoded-video/.immich): Error: EACCES: permission denied, open '/usr/src/app/upload/encoded-video/.immich'
microservices worker error: Error: Failed to read: "<UPLOAD_LOCATION>/encoded-video/.immich (/usr/src/app/upload/encoded-video/.immich) - Please see link for more information.", stack: Error: Failed to read: "<UPLOAD_LOCATION>/encoded-video/.immich (/usr/src/app/upload/encoded-video/.immich) - Please see link for more information."
at StorageService.verifyReadAccess (/usr/src/app/server/dist/services/storage.service.js:129:19)
at async /usr/src/app/server/dist/services/storage.service.js:56:21
at async /usr/src/app/server/dist/repositories/database.repository.js:379:27
at async /usr/src/app/server/node_modules/.pnpm/kysely@0.28.2/node_modules/kysely/dist/cjs/kysely.js:535:20
at async DefaultConnectionProvider.provideConnection (/usr/src/app/server/node_modules/.pnpm/kysely@0.28.2/node_modules/kysely/dist/cjs/driver/default-connection-provider.js:12:20)
at async /usr/src/app/server/dist/repositories/database.repository.js:376:13
microservices worker exited with code 1
Killing api process
7 Replies
Immich
Immichβ€’6d ago
:wave: Hey @OffsetMonkey538, Thanks for reaching out to us. Please carefully read this message and follow the recommended actions. This will help us be more effective in our support effort and leave more time for building Immich :immich:. References - Container Logs: docker compose logs docs - Container Status: docker ps -a docs - Reverse Proxy: https://immich.app/docs/administration/reverse-proxy - Code Formatting https://support.discord.com/hc/en-us/articles/210298617-Markdown-Text-101-Chat-Formatting-Bold-Italic-Underline#h_01GY0DAKGXDEHE263BCAYEGFJA Checklist I have... 1. :ballot_box_with_check: verified I'm on the latest release(note that mobile app releases may take some time). 2. :ballot_box_with_check: read applicable release notes. 3. :ballot_box_with_check: reviewed the FAQs for known issues. 4. :ballot_box_with_check: reviewed Github for known issues. 5. :ballot_box_with_check: tried accessing Immich via local ip (without a custom reverse proxy). 6. :ballot_box_with_check: uploaded the relevant information (see below). 7. :ballot_box_with_check: tried an incognito window, disabled extensions, cleared mobile app cache, logged out and back in, different browsers, etc. as applicable (an item can be marked as "complete" by reacting with the appropriate number) Information In order to be able to effectively help you, we need you to provide clear information to show what the problem is. The exact details needed vary per case, but here is a list of things to consider: - Your docker-compose.yml and .env files. - Logs from all the containers and their status (see above). - All the troubleshooting steps you've tried so far. - Any recent changes you've made to Immich or your system. - Details about your system (both software/OS and hardware). - Details about your storage (filesystems, type of disks, output of commands like fdisk -l and df -h). - The version of the Immich server, mobile app, and other relevant pieces. - Any other information that you think might be relevant. Please paste files and logs with proper code formatting, and especially avoid blurry screenshots. Without the right information we can't work out what the problem is. Help us help you ;) If this ticket can be closed you can use the /close command, and re-open it later if needed.
OffsetMonkey538
OffsetMonkey538OPβ€’6d ago
.env:
# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=veryCoolPassword
# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=release

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=veryCoolPassword
Immich
Immichβ€’6d ago
Successfully submitted, a tag has been added to inform contributors. :white_check_mark:
OffsetMonkey538
OffsetMonkey538OPβ€’6d ago
oh and I'm launching with set -a && . .env && docker stack deploy -c docker-compose.yml immich
Zeus
Zeusβ€’6d ago
You should probably start with docker compose We can’t really provide swarm specific help or frankly even NFS permission help in general
Immich
Immichβ€’3d ago
This thread has been closed. To re-open, use the button below.
OffsetMonkey538
OffsetMonkey538OPβ€’3d ago
-# Turns out it was indeed an NFS problem. I thought the maproot setting applied globally to all exports, so I thought all the libraries were accessible as root, but turns out that's not the case πŸ˜…

Did you find this page helpful?