Problem applying storage template - EACCES: permission denied

[leocb]

The bug

Files are being uploaded to the server and show up on UIs, I can access and download the photos with full quality, however, the files are not being moved to the "library" folder

The OS that Immich Server is running on

Ubuntu 24.04 LTS

Version of Immich Server

v1.126.1

Version of Immich Mobile App

v1.126.1

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

#
# WARNING: Make sure to use the docker-compose.yml of the current release:
#
# https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
#
# The compose file on main may not be compatible with the latest release.
#

name: immich

services:
  immich-server:
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}

    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - /etc/localtime:/etc/localtime:ro
      - ${LIBRARY_LOCATION}:/usr/src/app/upload/library
    
    #HW Accelartion for videos (AMD)
    devices:
      - /dev/dri:/dev/dri
      
    env_file:
      - stack.env
    ports:
      - 2283:2283
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - stack.env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/redis:6.2-alpine@sha256:905c4ee67b8e0aa955331960d2aa745781e6bd89afc44a8584bfd13bc890f0ae
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    healthcheck:
      test: >-
        pg_isready --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" || exit 1;
        Chksum="$$(psql --dbname="$${POSTGRES_DB}" --username="$${POSTGRES_USER}" --tuples-only --no-align
        --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')";
        echo "checksum failure count is $$Chksum";
        [ "$$Chksum" = '0' ] || exit 1
      interval: 5m
      # start_interval: 30s
      start_period: 5m
    command: >-
      postgres
      -c shared_preload_libraries=vectors.so
      -c 'search_path="$$user", public, vectors'
      -c logging_collector=on
      -c max_wal_size=2GB
      -c shared_buffers=512MB
      -c wal_compression=on
    restart: always

    
  immich-frame:
    container_name: immich_frame
    image: ghcr.io/immichframe/immichframe:latest
    restart: always
    ports:
      - 5091:8080
    environment:
      ImmichServerUrl: [redacted]
      ApiKey: [redacted]
      Interval: 15
      TransitionDuration: 1
      RenewImagesDuration: 30
      ShowClock: false
      ShowPhotoDate: false
      ShowImageDesc: false
      ShowImageLocation: false
      ImageZoom: false
      UnitSystem: metric
      

volumes:
  model-cache:

Your .env content

UPLOAD_LOCATION=/docker/immich/meta
DB_DATA_LOCATION=/docker/immich/postgres
IMMICH_VERSION=release
DB_PASSWORD=[redacted]
DB_USERNAME=postgres
DB_DATABASE_NAME=immich
LIBRARY_LOCATION=/mnt/GlaDOS/Dropbox/Fotos/Celulares

Reproduction steps

1. Try to upload a image
2. Uploads succeeds but moving the file to storage template folder fails

Relevant log output

[Nest] 7  - 02/10/2025, 11:16:24 PM   ERROR [Microservices:StorageTemplateService] Problem applying storage template
[Nest] 7  - 02/10/2025, 11:16:24 PM   ERROR [Microservices:StorageTemplateService] Error: EACCES: permission denied, copyfile 'upload/upload/bcc3623b-13a9-4496-b0d4-dc95056e0a52/c3/eb/c3eb44e8-5dce-414f-a6da-521eda82b4c8.jpg' -> 'upload/library/Leo/2025/02-February/20250210_201614.jpg'
    at async Object.copyFile (node:internal/fs/promises:620:10)
    at async StorageCore.moveFile (/usr/src/app/dist/cores/storage.core.js:148:17)
    at async /usr/src/app/dist/services/storage-template.service.js:161:17
    at async /usr/src/app/dist/repositories/database.repository.js:211:23
[Nest] 7  - 02/10/2025, 11:16:24 PM   ERROR [Microservices:StorageTemplateService] Object(3) {
  id: 'ecd14d93-6dc0-40e3-981a-7e8302222451',
  oldPath: 'upload/upload/bcc3623b-13a9-4496-b0d4-dc95056e0a52/c3/eb/c3eb44e8-5dce-414f-a6da-521eda82b4c8.jpg',
  newPath: 'upload/library/Leo/2025/02-February/20250210_201614.jpg'
}

Additional information

I have this setup:

1. TrueNAS server (Glados dataset)
2. Compute server (atlas)

• Glados dataset is already set to ACL type NFSv4 and mode passthrough on TrueNAS
• See attached image for ACL settings, but I basically let it be as permissive as possible.
• Glados is mounted on the atlas at an OS level using NFS, fstab: nas.local:/mnt/Aperture/GlaDOS /mnt/GlaDOS nfs rw,noatime,rsize=131072,wsize=131072,hard,intr,timeo=150,retrans=3 0
• Immich is running on atlas with docker compose, I configured it all with portainer

What I know:

• Immich can create folders but don't copy the files.
• If I enter the container with docker exec -it <CONTAINER_ID> bash I can touch and chown the files in the library folder, no problem. If I cp with the paths provided in the logs, it works and files are copied
• This all started after the update on December 17, 2024 (V1.123) - before that update, this setup worked just fine

TrueNAS ACL: