[Support] Permission setup with specified consume / data folders #13176

max3-2 · 2026-07-20T12:42:03Z

max3-2
Jul 20, 2026

What's your question or issue?

So i just set up a paperless on RPi (Debian-like). I moved all folders to an external drive (USB) so I dont use the internal card too much. I set the paths in the docker yaml. At this point, everything is ok. Now comes my special case that seems to be too simple to not be supported, or maybe I just need another way of achieving what I want: Have consume exposed as samba share

uid 1000 is pi, gid 1000 is pi, gid 1004 is smb.

I have new users on my pi which are in a special gid 1004. No ssh, just samba to the consume folder. I do not want them to have access anywhere else. I know samba blocks this if only one folder is open but I would like to kep permissions clean.
chown 1000:1004 on consume, so only consume works for samba external users, all other folder 1000:1000. paperless has consume access due to uid 1000
docker compose up messes with my permissions by setting them 1000:1000 or uid:gid as set in docker.env on all folder alike

Main culprit

I end up with either all paperless folders on 1000:1000: Samba does not work anymore in that folder
I end up with all folders on uid:gid, e.g., 1000:1004. Samba works, all other stuff works via uid 1000. But now all my paperless data is (theroretically) exposed for samba users with gid 1004. Even though there the second layer with samba block and login, I do not really like that

Long story short

Need separate permissions on paperless folders, 1000:1000 on all but consume where i need 1000:1004. Or skip permission check by docker compose up. Or a better way to do that....

What have you tried?

Even if not set in the env file, during docker compose up paperless sets permissions to 1000:1000 on all folders (media, export, consume, ....). If set, permissions are set to uid:gid same on all folders.
I did not find a way to skip the permission change or have it apply to only some folders.

Paperless-ngx version

2.20.15

Host OS

Rapsberry Pi Arm64

Installation method

Docker - official image

System status

No response

Relevant logs or output

No response

darekwojciechowski · 2026-07-20T15:37:46Z

darekwojciechowski
Jul 20, 2026

There is a supported way to stop it touching your permissions: run the container as a non-root user. The chown only happens on the root-start path.

The relevant script is s6-rc.d/init-folders/run. In root mode it ends with:

find "${dir}" -not \( -user paperless -and -group paperless \) -exec chown --changes paperless:paperless {} +

across export, data, media, consume and scratch — which is exactly the behaviour you're hitting. But init-start sets USER_IS_NON_ROOT whenever id -u isn't 0, and in that branch init-folders only warns about ownership it doesn't like. It never chowns anything.

So in your compose file:

services:
  webserver:
    user: "1000:1000"
    group_add:
      - "1004"

Then set the permissions you actually want on the host — 1000:1000 everywhere, 1000:1004 on consume — and they'll survive restarts. Paperless still writes to consume fine, since uid 1000 owns it. group_add is there so the container can also read anything group-owned by 1004 that samba users drop in.

Two things to adjust while you're in there:

Remove USERMAP_UID/USERMAP_GID from your docker.env. They're ignored in non-root mode and the container will log a warning about it.

Pre-create every directory on the host before starting, because the container can no longer create what it lacks permission for: export, data, media, consume, plus data/index, media/documents, media/documents/originals and media/documents/thumbnails.

You'll know it worked when the startup log says [init-folders] Running in non-root mode, checking directories instead of the root-privileges line, and ls -l on the host still shows 1000:1004 on consume afterwards.

One extra suggestion for the samba side: chmod g+s on consume so files dropped in by your 1004 users inherit the group instead of landing with the creator's primary group.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

[Support] Permission setup with specified consume / data folders #13176

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Uh oh!

[Support] Permission setup with specified consume / data folders #13176

Uh oh!

Uh oh!

max3-2 Jul 20, 2026

What's your question or issue?

Main culprit

Long story short

What have you tried?

Paperless-ngx version

Host OS

Installation method

System status

Relevant logs or output

Replies: 1 comment

Uh oh!

darekwojciechowski Jul 20, 2026

max3-2
Jul 20, 2026

darekwojciechowski
Jul 20, 2026