Access denied due to failsafe; check server log

[JeanMerand]

Hi,
I've installed Copy-Party on my UnRAID NAS server, but I have this message:, and I don't know what it means or what I've to do ?
Any idea ?

Thank you,

[9001]

I don't know anything about unraid so I can't help with the details, but here's the technical explanation:

The problem is that you are telling the docker image that it should read and use a particular copyparty config file, but you are not giving it the config file you are telling it to load. The UI is saying you should check the serverlog, and you will find something similar to the following error there:

EDIT: Like the error message says, it could also happen if you do give it a valid config file, but without specifying any volumes inside the config file.

(in copyparty, a volume is the filesystem-path to a folder that you want to share from the server filesystem, and what name you would like to give it in the copyparty web-ui)

[JeanMerand]

Hi,
Thank you for taking the time to answer.
I'm not a super expert of UnRAID either, just a user for my DIY NAS on which I've installed this solution (instead of TrueNas or Proxmox).

This is deployed as a docker by using templates in which you can enter some variable as you would do with Docker compose, so at the end it's like using a Docker.

here is the output of the logs (those from UnRAID), and yes I see the sentence you've highlighted in RED.:

13:52:22.433 auth hint: enable upload deduplication with --dedup (but see readme for consequences)
13:52:22.441 root max clients: 1024
13:52:22.445 tcpsrv available @ http://127.0.0.1:3923/ (1-lo)
13:52:22.445 tcpsrv available @ http://[::1]:3923/ (1-lo)
13:52:22.445 tcpsrv available @ http://172.17.0.9:3923/ (109-eth0, external)

13:52:22.447 optional-dependencies OK: sqlite, pillow, pillow-webp, ffmpeg, ffprobe, argon2, pyzmq, NG: vips, mutagen, pillow-heif, pillow-avif, see --deps (this is fine btw)
13:52:22.447 thumb decoder preference: pil, ff
13:52:22.449 thumb 0 dirs.hist/
13:52:22.632 tcpsrv listening @ [::]:3923 f3 p1
13:52:22.632 hsrv subscribed @ [::]:3923 f3 p1
13:52:22.632 root workers OK

13:52:22.633 up2k / all-default
13:52:22.633 up2k 0 volumes in 0.00 sec
13:52:22.635 cert using default TLS certificate; https will be insecure: /cfg/copyparty/cert.pem
13:52:37.946 192.168.1.32 61283 GET / @*
13:52:38.016 192.168.1.32 61283 GET /favicon.ico @*
2025-05-01
01:52:22.520 thumb 0 dirs.hist/
13:52:22.521 thumb 0 dirs.hist/
2025-05-02
01:52:22.604 thumb 0 dirs.hist/
13:52:22.605 thumb 0 dirs.hist/
2025-05-03
01:52:22.621 thumb 0 dirs.hist/
13:52:22.621 thumb 0 dirs.hist/
16:45:55.305 192.168.1.32 63407 GET / @*
16:45:55.396 192.168.1.32 63407 GET /favicon.ico @*
2025-05-04
01:52:22.621 thumb 0 dirs.hist/
13:35:00.741 192.168.1.46 50367 GET / @*
13:35:01.031 192.168.1.46 50369 GET /favicon.ico @*
OPYTHAT
13:35:14.938 192.168.1.46 50369 shut(9): [Errno 107] Socket not connected
13:35:14.939 192.168.1.46 50367 shut(5): [Errno 107] Socket not connected
13:35:14.985 hsrv ok bye
13:35:14.985 tcpsrv ok bye
13:35:14.985 up2k writing snapshot
13:35:15.182 root nailed it
copyparty v1.17.0 "mixtape.m3u" (2025-04-26)
CPython v3.12.10 on Linux64 [GCC 14.2.0]
sqlite 3.48.0*1 | jinja 3.1.6 | pyftpd 1.5.10 | tftp 0.4.0

2025-05-04
13:37:59.334 root opening sessions-db /cfg/copyparty/sessions.db
13:37:59.353 auth warning: tried to read config-files from folder '/cfg' but it does not contain any .conf files; the following files/subfolders were ignored: copyparty
13:37:59.353 auth loaded 1 config files:
└/z/initcfg
13:37:59.353 auth Read-access has been disabled due to failsafe: Docker detected, but the config does not define any volumes. This failsafe is to prevent unintended access if this is due to accidental loss of config. You can override this safeguard and allow read/write to all of /w/ by adding the following arguments to the docker container: -v .::rw
13:37:59.353 auth volumes and permissions:

"/" /w
| read: --none--
| write: --none--
| move: --none--
| delete: --none--
| dots: --none--
| get: --none--
| upGet: --none--
| html: --none--
| uadmin: --none--

13:37:59.353 auth hint: enable searching and upload-undo with argument -e2dsa
13:37:59.353 auth hint: enable upload deduplication with --dedup (but see readme for consequences)
13:37:59.356 root max clients: 1024
13:37:59.362 tcpsrv available @ http://127.0.0.1:3923/ (1-lo)
13:37:59.362 tcpsrv available @ http://[::1]:3923/ (1-lo)
13:37:59.362 tcpsrv available @ http://172.17.0.9:3923/ (118-eth0, external)

13:37:59.363 optional-dependencies OK: sqlite, pillow, pillow-webp, ffmpeg, ffprobe, argon2, pyzmq, NG: vips, mutagen, pillow-heif, pillow-avif, see --deps (this is fine btw)
13:37:59.363 thumb decoder preference: pil, ff
13:37:59.365 thumb 0 dirs.hist/
13:37:59.565 tcpsrv listening @ [::]:3923 f3 p1
13:37:59.566 hsrv subscribed @ [::]:3923 f3 p1
13:37:59.566 root workers OK

13:37:59.567 up2k / all-default
13:37:59.567 up2k 0 volumes in 0.00 sec
13:37:59.572 cert using default TLS certificate; https will be insecure: /cfg/copyparty/cert.pem

a path is defined behing /w in read/write... so it seems that it just doesn't work.

Thank you for your help.

[9001]

I'm guessing there's an issue with UnRAID's integration of copyparty; I'm only seeing a way to configure /w (which is the folder that becomes accessible through the web-ui), but there should also be a way to configure /cfg (where you put your config files).

Copyparty expects you to give it a config-file, and it is supposed to be given to copyparty inside the /cfg volume. The config-file is where you configure accounts, passwords, and all other server settings.

Since UnRAID is a paid product, and this sounds like an UnRAID-specific issue, I'd suggest taking this up with UnRAID support.

[JeanMerand]

Yes, There is a way to configure cfg folder:

So i'll try to put the copyparty.conf here if I understood correctly

[JeanMerand]

Hi,

I could make it work by adding "-v .::rw"
If you are an UnRAID user and you use "grtgbln's Repository", you can try this.

[9001]

please beware that this disables the authentication system, and will share the "working directory" with read-write permissions (and just those permissions, not move/delete) for ALL USERS without authentication. Note that the meaning of "working directory" depends on UnRAID's choices while integrating copyparty.

The better alternative is to give copyparty a config file; this will also make the logfile have colors like in my screenshot (the default is black and white). Here are two examples:

• https://github.com/9001/copyparty/blob/hovudstraum/docs/examples/docker/basic-docker-compose/copyparty.conf
• https://github.com/9001/copyparty/blob/hovudstraum/docs/examples/windows.md

[JeanMerand]

Ok, I understand.
Since I'm the only user on my NAS I think this is not a big problem but I'll see how to use the conf file.
Thank you for the support and for the tool, that seems very good (now I can test it :-))