influxdb 2.9 not running with read-only/user

[loorisr]

Hello,

Following v2.9.1 update, it is not running anymore with any of these 3 options:

read_only: true
cap_drop: [ - ALL]
user: "1000"

How can I run it again with these option for safety please?

Thanks!

[JcDenis]

You can try 2.9.1-alpine that seems to work for me.

[loorisr]

With 2.9.1-alpine, I have the following errors (it was working with 2.8):

• with cap_drop - ALL

05/13/2026, 04:34:35 PM STDERR
chown: '/var/lib/influxdb2/engine': Operation not permitted
05/13/2026, 04:34:49 PM STDERR
chmod: /etc/influxdb2: Operation not permitted
05/13/2026, 04:34:49 PM STDERR
chown: '/var/lib/influxdb2: Operation not permitted
05/13/2026, 04:34:49 PM STDERR
chown: '/var/lib/influxdb2/engine': Operation not permitted

• with user: "1000"

05/13/2026, 04:35:54 PM STDERR
mkdir: can't create directory ''/': Permission denied

• with read_only: true

STDERR
mkdir: can't create directory ''/': Read-only file system

[dullerino]

I had a similar problem and I think the issue is related.

With 2.9.0 they changed the dasel version from v2.8.1 to v3.4.1 .
Around line 173 in "entrypoint.sh" dasel is used to read the "bolt-path" from the config file.
In my case this is a json config file.
With the old "dasel" version the following command

dasel -f "${INFLUXD_CONFIG_PATH}" -s "${primary_key}" -w -

returned

/var/lib/influxdb2/influxd.bolt

for the bolt-path.

But with the new version the new command

dasel -i "${config_format}" 'get("'"${primary_key}"'")' < "${INFLUXD_CONFIG_PATH}"

returns

"/var/lib/influxdb2/influxd.bolt"

The difference is the quotation mark at the start and the end which will be saved into the variable.
Because of this the command dirname at line 185 will set the variable bolt_dir to

 "/var/lib/influxdb2

with only one quotation mark at the beginning.

The command mkdir now in line 188 tries to create the folder "/var/lib/influxdb2 .
But because the second quotation mark at the end is missing it tries to create folder " in the root folder.
I'm running the container with the nobody user which does not have the right to do so.
So i got the following error message:

mkdir: cannot create directory '"': Permission denied

and the container stopped.

I fixed it by changing line 173 from

dasel -i "${config_format}" 'get("'"${primary_key}"'")' < "${INFLUXD_CONFIG_PATH}"

to

dasel -i "${config_format}" -o "yaml" 'get("'"${primary_key}"'")' < "${INFLUXD_CONFIG_PATH}"

This will return the bolt-path without quotation marks again e.g. /var/lib/influxdb2/influxd.bolt

I think this problem should only affect users who update an existing container, which has a json config file and is not running as root.