archipelagoandClaude Fable 5 11a4f2910a fix(immich): declare the caps its root process needs over the subuid-owned data tree ...

capabilities:[] was latent — the long-lived legacy container predated
strict manifest enforcement, so nothing noticed that a recreate against
this manifest produces a root process without DAC_OVERRIDE that
EACCESes on upload/encoded-video and crash-loops (49 systemd restarts
on .228 when the 2026-07-05 secret-env migration finally recreated
it). Any reinstall or reboot-repair would have tripped the same wire.

Cap set mirrors immich-postgres minus SETUID/SETGID.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-05 16:33:30 -04:00

..

manifest.yml

fix(immich): declare the caps its root process needs over the subuid-owned data tree

2026-07-05 16:33:30 -04:00