Question: Rootless container

[hollow-earth]

Is there the possibility of running the docker container rootless? I assume so because of #380 but I might be wrong.
I'm using the docker-compose file provided and I get the following error:

searxng | /usr/sbin/update-ca-certificates: line 109: can't create /etc/ssl/certs/ca-certificates.crt.new: Permission denied

It's pretty straightforward what the error is, a rootless container and therefore a user that is not root cannot write there.

In the documentation:

You can mount /usr/local/share/ca-certificates/ folder to add/remove additional certificates as needed.

They will be available on container (re)start or when running update-ca-certificates in the container shell.

In this case, would it be recommended to make my own certificate and mount said directory? Or is there a better way to do this?
Thank you.

[inetol]

We are not yet aiming to ensure that containers in rootless mode work flawlessly. But you shouldn't have any issues if you know how to handle containers in rootless mode.

searxng | /usr/sbin/update-ca-certificates: line 109: can't create /etc/ssl/certs/ca-certificates.crt.new: Permission denied

This error is not relevant if you are not loading custom CAs to SearXNG.
https://docs.searxng.org/admin/installation-docker.html#custom-certificates

[hollow-earth]

I'm relatively new to rootless so it may have been an error on my end. Here's what I did so far:

• Created a searxng user and group, added searxng to the docker group, and ran the docker rootless script (https://get.docker.com/rootless)
• Created the directory /opt/searxng and then cloned the repo. Edited the .env file and ran sed as described in the installation section.
• Added user: "1001:1001" to the docker container file under redis, caddy, and searxng - 1001:1001 is searxng:searxng

There might be something else wrong with my config because I'm also getting this message even after running chown and chgrp on the /etc/searxng directory on the host:

searxng | SearXNG 2025.11.15-45a4b8ad1
searxng | !!!
searxng | !!! WARNING
searxng | !!! "/etc/searxng" directory is not owned by "searxng:searxng"
searxng | !!! This may cause issues when running SearXNG
searxng | !!!
searxng | !!! Expected "searxng:searxng"
searxng | !!! Got "root:root"
searxng | !!!
searxng | !!!
searxng | !!! WARNING
searxng | !!! "/etc/searxng/settings.yml" file is not owned by "searxng:searxng"
searxng | !!! This may cause issues when running SearXNG
searxng | !!!
searxng | !!! Expected "searxng:searxng"
searxng | !!! Got "root:root"

Running ls /etc/ -l | grep searxng
drwxr-xr-x 2 searxng searxng 4096 Nov 17 17:52 searxng

Running id
uid=1001(searxng) gid=1001(searxng) groups=1001(searxng),1002(docker)

[inetol]

SearXNG expects the volume contents (mounted or not) owership to be 977:977 (or "searxng:searxng"), as weird issues might arise.

I don't know if the exact procedure applies on Docker, but on Podman you want to use --userns=keep-id,... to properly map the ownership of uid/gid. Although in my case I don't bother and I go rootful inside the containers running in isolated rootless users on the host, so I don't have to manually specify any mappings.

[hollow-earth]

It looks like the problem was my usage of the user command. SearXNG runs perfectly with a rootless container, but I have to explore a bit deeper to figure out what can and cannot run rootful within the container. Thank you for the help!

[inetol]

Before closing, we should fix the following error, or I will forget:

searxng | /usr/sbin/update-ca-certificates: line 109: can't create /etc/ssl/certs/ca-certificates.crt.new: Permission denied