External library scanning fails if subfolder is not readable

[lumpiluk]

The bug

I had one subfolder in my library that was owned by a different user and therefore not readable by Immich (cf. #13214).
This apparently led to photos not being scanned if they were in folders lexicographically after said subfolder (though apparently not exclusively, since some earlier photos were also affected, but videos were not affected at all).

Deleting this subfolder and re-scanning solved the issue.

Expected behavior:
I assumed unreadable folders would simply be ignored. Alternatively, a warning in the admin user interface would have been helpful (maybe in the form of more detailed status indication on the Jobs page?)

The OS that Immich Server is running on

Ubuntu 24.04 / Docker

Version of Immich Server

v1.117.0

Version of Immich Mobile App

irrelevant

Platform with the issue

• Server
• Web
• Mobile

Your docker-compose.yml content

name: immich

services:
  immich-server:
    user: ${UPLOAD_UID}:${UPLOAD_GID}
    container_name: immich_server
    image: ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
    # extends:
    #   file: hwaccel.transcoding.yml
    #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
    volumes:
      # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
      - ${UPLOAD_LOCATION}:/usr/src/app/upload
      - type: bind
        source: ${EXTERNAL_LIBRARY}
        target: /mnt/external
        read_only: true
      - /etc/localtime:/etc/localtime:ro
    env_file:
      - .env
    ports:
      - 2283:3001
    depends_on:
      - redis
      - database
    restart: always
    healthcheck:
      disable: false

  immich-machine-learning:
    container_name: immich_machine_learning
    # For hardware acceleration, add one of -[armnn, cuda, openvino] to the image tag.
    # Example tag: ${IMMICH_VERSION:-release}-cuda
    image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
    # extends: # uncomment this section for hardware acceleration - see https://immich.app/docs/features/ml-hardware-acceleration
    #   file: hwaccel.ml.yml
    #   service: cpu # set to one of [armnn, cuda, openvino, openvino-wsl] for accelerated inference - use the `-wsl` version for WSL2 where applicable
    volumes:
      - model-cache:/cache
    env_file:
      - .env
    restart: always
    healthcheck:
      disable: false

  redis:
    container_name: immich_redis
    image: docker.io/redis:6.2-alpine@sha256:2d1463258f2764328496376f5d965f20c6a67f66ea2b06dc42af351f75248792
    healthcheck:
      test: redis-cli ping || exit 1
    restart: always

  database:
    container_name: immich_postgres
    image: docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0@sha256:90724186f0a3517cf6914295b5ab410db9ce23190a2d9d0b9dd6463e3fa298f0
    environment:
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_DB: ${DB_DATABASE_NAME}
      POSTGRES_INITDB_ARGS: '--data-checksums'
    volumes:
      # Do not edit the next line. If you want to change the database storage location on your system, edit the value of DB_DATA_LOCATION in the .env file
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    healthcheck:
      test: pg_isready --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' || exit 1; Chksum="$$(psql --dbname='${DB_DATABASE_NAME}' --username='${DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [ "$$Chksum" = '0' ] || exit 1
      interval: 5m
      start_interval: 30s
      start_period: 5m
    command: ["postgres", "-c", "shared_preload_libraries=vectors.so", "-c", 'search_path="$$user", public, vectors', "-c", "logging_collector=on", "-c", "max_wal_size=2GB", "-c", "shared_buffers=512MB", "-c", "wal_compression=on"]
    restart: always

volumes:
  model-cache:

Your .env content

# The location where your uploaded files are stored
UPLOAD_LOCATION=/mnt/ls-main2/data/immich
# The location where your database files are stored
DB_DATA_LOCATION=/srv/containers/immich/db

# To set a timezone, uncomment the next line and change Etc/UTC to a TZ identifier from this list: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones#List
TZ=Europe/Berlin

# The Immich version to use. You can pin this to a specific version like "v1.71.0"
IMMICH_VERSION=v1.117.0

# Connection secret for postgres. You should change it to a random password
# Please use only the characters `A-Za-z0-9`, without special characters or spaces
DB_PASSWORD=REDACTED

# Custom variables:
# Required for Docker to write to my NFS shares:
UPLOAD_UID=1000
UPLOAD_GID=1000
EXTERNAL_LIBRARY=/mnt/ls-main2/data/pictures

# The values below this line do not need to be changed
###################################################################################
DB_USERNAME=postgres
DB_DATABASE_NAME=immich

Reproduction steps

1. Added external library (which contained a subfolder owned by a different user and group)
2. Started with only one subfolder as import path
3. Scanned library etc.
4. Set the whole external library as import path
5. Scanned library etc.

Relevant log output

No response

Additional information

No response

[etnoy]

Thanks for the report. Adding it to my list

[lumpiluk]

Oh, is this a duplicate of #12713? Sorry I didn't see it earlier

[etnoy]

It appears so. I'll close this one for now. Duplicate of #12713

[etnoy]

Are you running the docker as root, or as a non-root user?

[lumpiluk]

The docker compose command is run as root and in my compose.yaml I have this line:

immich-server:
    user: 1000:1000

The files are on an NFS share.

[etnoy]

Thanks, I missed the user: part of the docker compose. Now it makes sense :)