[BUG] s6-applyuidgid: fatal: unable to set supplementary group list: Operation not permitted

[spatterIight]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The current behavior is as follows:

1. Configure the container to run as read-only as a non-root user
2. Configure a claim token environment variable
3. Start the container

The containers fails to start with the following log and error:

Apr 13 21:30:57 smirnoff systemd[1]: Started Plex (plex-test).
Apr 13 21:30:57 smirnoff plex-test[2441570]: /package/admin/s6-overlay/libexec/preinit: info: /run belongs to uid 0 instead of 942 - fixing it
Apr 13 21:30:57 smirnoff plex-test[2441570]: ╔═════════════════════════════════════════════════════════════════════════╗
Apr 13 21:30:57 smirnoff plex-test[2441570]: ║                                                                         ║
Apr 13 21:30:57 smirnoff plex-test[2441570]: ║    You are running this container read-only and as a non-root user:     ║
Apr 13 21:30:57 smirnoff plex-test[2441570]: ║              This combination of settings is not supported              ║
Apr 13 21:30:57 smirnoff plex-test[2441570]: ║                  and may result in unwanted behaviour.                  ║
Apr 13 21:30:57 smirnoff plex-test[2441570]: ║                                                                         ║
Apr 13 21:30:57 smirnoff plex-test[2441570]: ╚═════════════════════════════════════════════════════════════════════════╝
Apr 13 21:30:57 smirnoff plex-test[2441570]: [migrations] started
Apr 13 21:30:57 smirnoff plex-test[2441570]: [migrations] no migrations found
Apr 13 21:30:57 smirnoff plex-test[2441570]: ───────────────────────────────────────
Apr 13 21:30:57 smirnoff plex-test[2441570]:       ██╗     ███████╗██╗ ██████╗
Apr 13 21:30:57 smirnoff plex-test[2441570]:       ██║     ██╔════╝██║██╔═══██╗
Apr 13 21:30:57 smirnoff plex-test[2441570]:       ██║     ███████╗██║██║   ██║
Apr 13 21:30:57 smirnoff plex-test[2441570]:       ██║     ╚════██║██║██║   ██║
Apr 13 21:30:57 smirnoff plex-test[2441570]:       ███████╗███████║██║╚██████╔╝
Apr 13 21:30:57 smirnoff plex-test[2441570]:       ╚══════╝╚══════╝╚═╝ ╚═════╝
Apr 13 21:30:57 smirnoff plex-test[2441570]:    Brought to you by linuxserver.io
Apr 13 21:30:57 smirnoff plex-test[2441570]: ───────────────────────────────────────
Apr 13 21:30:57 smirnoff plex-test[2441570]: To support LSIO projects visit:
Apr 13 21:30:57 smirnoff plex-test[2441570]: https://www.linuxserver.io/donate/
Apr 13 21:30:57 smirnoff plex-test[2441570]: ───────────────────────────────────────
Apr 13 21:30:57 smirnoff plex-test[2441570]: GID/UID
Apr 13 21:30:57 smirnoff plex-test[2441570]: ───────────────────────────────────────
Apr 13 21:30:57 smirnoff plex-test[2441570]: User UID:    942
Apr 13 21:30:57 smirnoff plex-test[2441570]: User GID:    1001
Apr 13 21:30:57 smirnoff plex-test[2441570]: ───────────────────────────────────────
Apr 13 21:30:57 smirnoff plex-test[2441570]: Linuxserver.io version: 1.41.6.9685-d301f511a-ls262
Apr 13 21:30:57 smirnoff plex-test[2441570]: Build-date: 2025-04-10T16:42:57+00:00
Apr 13 21:30:57 smirnoff plex-test[2441570]: ───────────────────────────────────────
Apr 13 21:30:57 smirnoff plex-test[2441570]:     
Apr 13 21:30:57 smirnoff plex-test[2441570]: Temporarily starting Plex Media Server.
Apr 13 21:30:57 smirnoff plex-test[2441570]: Waiting for Plex to generate its config
Apr 13 21:30:57 smirnoff plex-test[2441570]: s6-applyuidgid: fatal: unable to set supplementary group list: Operation not permitted

It is possible to work-around this error as follows:

1. Remove the plex claim token environment variable
2. Restart the container
3. Re-add the plex claim token
4. Restart the container
5. Observe the container starting and running as normal

Expected Behavior

The expected behavior is for the container to run normally at first time setup, without having to remove and re-add the claim token environment variable.

Steps To Reproduce

See current behavior

Environment

- OS: Ubuntu 24
- How docker service was installed: `ansible-role-docker` by `geerlingguy`

CPU architecture

x86-64

Docker creation

https://github.com/spatterIight/ansible-role-plex/tree/develop

Container logs

See current behavior

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[spatterIight]

BTW, I do recognize the logs clearly state This combination of settings is not supported, so I understand if this issue is not solvable. Regardless, I wanted to document this interesting behavior, and the work-around!

Thanks

[benkrejci]

Thank you this unblocked me!

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.