langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 12:36:14 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

Enhancement: SELinux permisson issues with Redis and Postgres #10077

New Issue
Closed
opened 2026-02-21 18:42:30 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 18:42:30 -05:00
Owner
Copy Link
Copy Source

Originally created by @warhammer327 on GitHub (Mar 10, 2025).

Self Checks

  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

I'm using fedora 41 with SELinux enabled. Here are the steps I followed:

cd dify
git pull origin main
cd docker
docker compose up

Error I faced with Redis:

redis-1          | find: ./dump.rdb: Permission denied
redis-1          | find: ./dump.rdb: Permission denied
redis-1          | find: ./dump.rdb: Permission denied
redis-1 exited with code 1

Error I faced with postgresql:

db-1             | mkdir: can't create directory '/var/lib/postgresql/data/pgdata': Permission denied
db-1             | mkdir: can't create directory '/var/lib/postgresql/data/pgdata': Permission denied
db-1             | mkdir: can't create directory '/var/lib/postgresql/data/pgdata': Permission denied
db-1 exited with code 1

Here is the redis config.

redis:
    image: redis:6-alpine
    restart: always
    environment:
      REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456}
    volumes:
      # Mount the redis data directory to the container.
      - ./volumes/redis/data:/data
    # Set the redis password when startup redis server.
    command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456}
    healthcheck:
      test: [ 'CMD', 'redis-cli', 'ping' ]

I have found that error occurs because SELinux policies on Fedora are preventing the container from writing to that directory. It could be a common case for distros that have SELinux enabled.

I modified the redis config to:

  redis:
    image: redis:6-alpine
    restart: always
    environment:
      REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456}
    volumes:
      # Mount the redis data directory to the container.
      - redis_data:/data
    # Set the redis password when startup redis server.
    command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456}
    healthcheck:
      test: [ 'CMD', 'redis-cli', 'ping' ]

Changed - ./volumes/redis/data:/data to - redis_data:/data. And, added redis_data to volumes. Faced the similar issue with postgres volume. Fixed it the same way.

volumes:
  oradata:
  dify_es01_data:
  postgres_data:
  redis_data:

2. Additional context or comments

Correct me if I'm wrong but here is my understanding so far.

By using a named volume (for example redis_data) instead of mapping a host directory, we avoid permission issues with SELinux on Fedora. Docker will manage this volume and Redis will be able to write to it without permission problems.

This approach will be more reliable across different operating systems and container setups, especially on systems with stricter security policies like Fedora/RHEL with SELinux.

3. Can you help us with this feature?

  • I am interested in contributing to this feature.
Originally created by @warhammer327 on GitHub (Mar 10, 2025). ### Self Checks - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [x] Please do not modify this template :) and fill in all the required fields. ### 1. Is this request related to a challenge you're experiencing? Tell me about your story. I'm using fedora 41 with `SELinux enabled`. Here are the steps I followed: ``` cd dify git pull origin main cd docker docker compose up ``` Error I faced with Redis: ``` redis-1 | find: ./dump.rdb: Permission denied redis-1 | find: ./dump.rdb: Permission denied redis-1 | find: ./dump.rdb: Permission denied redis-1 exited with code 1 ``` Error I faced with postgresql: ``` db-1 | mkdir: can't create directory '/var/lib/postgresql/data/pgdata': Permission denied db-1 | mkdir: can't create directory '/var/lib/postgresql/data/pgdata': Permission denied db-1 | mkdir: can't create directory '/var/lib/postgresql/data/pgdata': Permission denied db-1 exited with code 1 ``` Here is the redis config. ``` redis: image: redis:6-alpine restart: always environment: REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456} volumes: # Mount the redis data directory to the container. - ./volumes/redis/data:/data # Set the redis password when startup redis server. command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456} healthcheck: test: [ 'CMD', 'redis-cli', 'ping' ] ``` I have found that error occurs because SELinux policies on Fedora are preventing the container from writing to that directory. It could be a common case for distros that have SELinux enabled. I modified the redis config to: ``` redis: image: redis:6-alpine restart: always environment: REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456} volumes: # Mount the redis data directory to the container. - redis_data:/data # Set the redis password when startup redis server. command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456} healthcheck: test: [ 'CMD', 'redis-cli', 'ping' ] ``` Changed `- ./volumes/redis/data:/data` to `- redis_data:/data`. And, added `redis_data` to `volumes`. Faced the similar issue with postgres volume. Fixed it the same way. ``` volumes: oradata: dify_es01_data: postgres_data: redis_data: ``` ### 2. Additional context or comments Correct me if I'm wrong but here is my understanding so far. By using a named volume (for example redis_data) instead of mapping a host directory, we avoid permission issues with SELinux on Fedora. Docker will manage this volume and Redis will be able to write to it without permission problems. This approach will be more reliable across different operating systems and container setups, especially on systems with stricter security policies like Fedora/RHEL with SELinux. ### 3. Can you help us with this feature? - [x] I am interested in contributing to this feature.
yindo closed this issue 2026-02-21 18:42:30 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#10077
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?