gitea: Gitea rootless setup error: mkdir: can't create directory '/var/lib/gitea/git': Permission denied

I am also facing this issue. It seems to me that this design is fundamentally broken. Running Gitea as root in a rootless container shouldn’t matter because the primary limiting factor in the security of the setup would be the security of the containerization technologies used. In my case, it is Podman. Sure, running Gitea as root can allow a malicious actor to do untold damage… to the container. If it somehow manages to exploit the container to the extent that it can infect the host system, well, the container is not running as root anyway - which is what matters. Ideally, the user that is running the container wouldn’t have sudo or any other administrative privileges either - aside from systemd-journal for looking at logs, for example. Conversely, running Gitea rootless in a rootful container has marginally better security than running rootful in a rootless container because an exploit in the containerization technologies doesn’t necessarily need root privileges inside of that container. If Gitea provides true support for running rootless containers, it should be considered to let Gitea inside the container run as root by default. Perhaps there is a better way by means of configuring the container’s run parameters, but so far I haven’t found the way that works for Gitea (for example, in my Joplin server I pass in --userns keep-id:uid=${id -u},gid=${id -g} to the podman run command in order to allow it to run as the correct user), and it would need to be documented in the setup. It’s also not reasonable to expect that all users will want to run their rootless container as the first user created on their system. My Gitea user is the 14th user that I’ve created on my system. Perhaps the setup script could use the id commands as above in place of hard-coded values? Furthermore, in this instance, using the $HOME environment variable in configuration settings also seems to be not ideal as well. The $HOME environment variable is a default environment variable, so setting it to something different will most certainly break things.

We have a similar issue in the helm chart: https://gitea.com/gitea/helm-chart/pulls/447

Writing into system-directories is not possible when running rootless. Maybe there could be a change for the rootless image WRT to to $HOME as proposed in the linked PR?

You can prevent Gitea from trying to create the directory by making it yourself. Inside ./data:

mkdir git

I looked into the source for a bit and i think that the problem is that gitea runs as 1000:1000 inside the container, while the permissions for the volume folders remain 0:0 inside. The line throwing the exception is here. You might get away with removing the USER line in the Dockerfile and setting I_AM_BEING_UNSAFE_RUNNING_AS_ROOT in the ini file (see here for further infos), but I don’t know enough to say how good an idea this is.