TSIDP errors when starting from docker compose file

[rht341]

When using the docker compose file, the following errors: appeared in the log:

root@tsidp:# docker compose pull
[+] Pulling 1/1
✔ tsidp Pulled 0.5s
root@tsidp:# docker compose up -d
[+] Running 2/2
✔ Network root_default Created 0.1s
✔ Container tsidp Started 0.7s
root@tsidp:~# docker compose logs -f
tsidp | 2025/10/30 16:46:23 ERROR failed to start tsnet server error="tsnet.Up: tsnet: logpolicy.Config.Save for /data/tailscaled.log.conf: open /data/tailscaled.log.conf.tmp1957653903: permission denied"

I did set the auth key in compose.yaml.

[rschio]

[!NOTE] > TS_STATE_DIR and TS_HOSTNAME are legacy names. These will be replaced by TSIDP_STATE_DIR and TSIDP_HOSTNAME in the future.

Using TSIDP_STATE_DIR and TSIDP_HOSTNAME solved this problem for me.

[nvrlivenvrdie]

If your willing to build your own docker image or for devs who see this
It appears to be a permission issue in the docker container

in the DockerFile, I added

RUN mkdir -p /data

as well as adding

RUN chown app:app /data

my docker file section after the changes looks like this

Final stage

FROM --platform=$TARGETPLATFORM alpine:latest
RUN apk --no-cache add ca-certificates
WORKDIR /app

RUN mkdir -p /data

RUN addgroup -g 1001 -S app &&
adduser -u 1001 -S app &&
chown app:app /data

that seemed to clear up any permission issues i was having

[buildplan]

I had the same issue - I was using bind mount in docker compose I fixed it with chmod 777 ./tsidp-data

[warnspread]

I think the README should be adjusted aswell. It still mentions TS_STATE_DIR and TS_HOSTNAME :)

[rschio]

It was my bad, the correct for now is TS_STATE_DIR and TS_HOSTNAME,

This is the right answer:

If your willing to build your own docker image or for devs who see this It appears to be a permission issue in the docker container

in the DockerFile, I added

RUN mkdir -p /data

as well as

RUN chown app:app /app && \ chown app:app /data

my docker file section after the changes looks like this

Final stage

FROM --platform=$TARGETPLATFORM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /app

RUN mkdir -p /data

RUN addgroup -g 1001 -S app && adduser -u 1001 -S app && chown app:app /app && chown app:app /data

that seemed to clear up any permission issues i was having

[warnspread]

For me only TSIDP_STATEDIR worked to get it running and TS_HOSTNAME to get the proper hostname assigned. Other settings exact as in the dovker-compose from the README

[nvrlivenvrdie]

For me only TSIDP_STATEDIR worked to get it running and TS_HOSTNAME to get the proper hostname assigned. Other settings exact as in the dovker-compose from the README

I believe the reason TSIDP_STATE_DIR "works" in this case, is because its not setting a statedir at all. It would be the same as just removing it completely from the compose file. If TS_STATE_DIR is not set, it defaults to ~/.config/ in the container

---

also to add, that will mean no persistence, so i imaging when taking down and bringing back up the container you'll probably start to get new tailscale hostnames? such as idp, idp-1, idp-2, idp-3