Rootless podman Forgejo: Permission denied issue

[Amparose]

I am trying (or failing) to set up a Rootless Podman Forgejo on Ubuntu. I keep getting a permissions error:

~/forgejo/compose ❯ podman-compose up forgejo
[...]
podman start -a forgejo
mkdir: can't create directory '/var/lib/gitea/git': Permission denied
[forgejo] | /var/lib/gitea/git is not writable
[forgejo] | docker setup failed

I have:

• Created an unprivileged git user to run the podman container.
• Tried chowning /home/git/forgejo/data as root:root after git:git didn't work.
• Tested podman unshare touch ~/forgejo/data/testfile works when data/ is owned by git:git but not root:root.

Using this folder structure:

/home
 ├── git/ ← dedicated user for Forgejo
 │    └── forgejo/
 │         ├── compose/
 │         │     ├── podman-compose.yaml
 │         │     ├── .env
 │         │     └── systemd/ ← Haven't got up to this part yet
 │         ├── data/
 │         └── config/

compose/.env

# Forgejo
FORGEJO_VERSION=13-rootless
FORGEJO_HTTP_PORT=3000
FORGEJO_SSH_PORT=2222

# User
UID=106
GID=105

# Domain
DOMAIN=git.blah.com

Found git user's UID:GID with:

❯ grep git /etc/passwd
git:x:106:105::/home/git:/bin/bash

compose/podman-compose.yaml

version: "3.9"

services:
  forgejo:
    image: codeberg.org/forgejo/forgejo:${FORGEJO_VERSION}
    container_name: forgejo
    user: "${UID}:${GID}"
    restart: "no"
    ports:
      - "127.0.0.1:${FORGEJO_HTTP_PORT}:3000"
      - "127.0.0.1:${FORGEJO_SSH_PORT}:22"
    volumes:
      - ../data:/var/lib/gitea
      - ../config:/etc/gitea
    environment:
      - FORGEJO__SERVER__ROOT_URL="https://${DOMAIN}/"

[Amparose]

I just tried the same set up with my admin user on the server (changing details to 1000:1000) and I get the same can't create directory '/var/lib/gitea/git'. Sigh, never-mind: looks like this whole thing is a Forgejo problem. I won't close this just yet in case anyone has a workaround.

[eriksjolund]

Probably you need to provide --userns keep-id:uid=1000,gid=1000 but in compose syntax.

This comment
containers/podman-compose#166 (comment)
makes me think you need to add

x-podman:
  in_pod: false

and

    user: "1000:1000"
    userns_mode: "keep-id:uid=1000,gid=1000"

I haven't tried podman-compose but I did some tests with podman run :

1. Create file ~/test.bash containing

   #!/bin/bash
   
   set -o errexit
   set -o nounset
   
   extra=$1
   
   dir=$(mktemp -d)
   cd $dir
   mkdir data
   mkdir config
   podman run -p 127.0.0.1:3000:3000 -p 127.0.0.1:2222:22 \
             --rm -v ./data:/var/lib/gitea:Z \
             -v ./config:/etc/gitea \
             --user 1000:1000 \
                $extra \
                 codeberg.org/forgejo/forgejo:13-rootless
   

test 1: failure

1. Run command

   bash test.bash ""
   

   The following output is printed

   mkdir: can't create directory '/var/lib/gitea/git': Permission denied
   /var/lib/gitea/git is not writable
   docker setup failed
   

test 2 : success

Test the same but this time add --userns keep-id:uid=1000,gid=1000

1. Run command

   bash test.bash "--userns keep-id:uid=1000,gid=1000"
   

   The following output is printed

   2025/12/06 20:16:49 cmd/web.go:252:runWeb() [I] Starting Forgejo on PID: 2
   2025/12/06 20:16:49 cmd/web.go:114:showWebStartupMessage() [I] Forgejo version: 13.0.3+gitea-1.22.0 built with GNU Make 4.4.1, go1.25.4 : bindata, timetzdata, sqlite, sqlite_unlock_notify
   2025/12/06 20:16:49 cmd/web.go:115:showWebStartupMessage() [I] * RunMode: prod
   2025/12/06 20:16:49 cmd/web.go:116:showWebStartupMessage() [I] * AppPath: /usr/local/bin/gitea
   2025/12/06 20:16:49 cmd/web.go:117:showWebStartupMessage() [I] * WorkPath: /var/lib/gitea
   2025/12/06 20:16:49 cmd/web.go:118:showWebStartupMessage() [I] * CustomPath: /var/lib/gitea/custom
   2025/12/06 20:16:49 cmd/web.go:119:showWebStartupMessage() [I] * ConfigFile: /var/lib/gitea/custom/conf/app.ini
   2025/12/06 20:16:49 cmd/web.go:120:showWebStartupMessage() [I] Prepare to run install page
   2025/12/06 20:16:49 cmd/web.go:314:listen() [I] Listen: http://0.0.0.0:3000
   2025/12/06 20:16:49 cmd/web.go:318:listen() [I] AppURL(ROOT_URL): http://localhost:3000/
   2025/12/06 20:16:49 ...s/graceful/server.go:50:NewServer() [I] Starting new Web server: tcp:0.0.0.0:3000 on PID: 2
   

about port number 2222

 - "127.0.0.1:${FORGEJO_SSH_PORT}:22"

I am not sure that is correct.

Maybe it should be

      - "127.0.0.1:${FORGEJO_SSH_PORT}:2222"

?

It looks like 2222 is the default port

https://codeberg.org/forgejo/forgejo/src/commit/cd441a54a737de129ab159812a0be3b351f6a4b1/docker/rootless/usr/local/bin/docker-setup.sh#L48

Using quadlet

If you want to use quadlets, take a look at my comment

https://codeberg.org/forgejo/forgejo/issues/6031#issuecomment-8792637

I did a quick experiment with quadlets. At least something is working

$ curl -s http://127.0.0.1:3000 | head -1
<!DOCTYPE html>

Probably the integration with the databse (postgresql) needs more work though.
I haven't done any testing.

[Amparose]

Thanks for testing and note about correct port 2222 for rootless image. I'll be checking your quadlet example when I get up to that as well. While it's likely that your tweak could work, I found that substituting the Forgejo image for Gitea's rootless one just works without the faffing around. Given that the [from what I can tell is broken] Forgejo rootless image has had this issue reported over a year ago... I think I'll just go with what works.