[Immich] Attempt to run "update" script fails on sharp tarball extraction; breaks server build

[frontend-report]

Script: Immich

Reported by: @TheRealTomDavidson

Guidelines

• Read and understood guidelines: yes
• Verbose mode used: yes

Issue occurs during: Script Update

Environment

• Linux distribution: Debian
• Proxmox version: 9.1
• Default settings: Yes
• Advanced settings: No
• Exact command: bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/immich.sh)"

Description

Attempting to run both the curl script above or just the default "update" command at CLI inside an unprivileged LXC container (at Immich level 2.7.x) fails when attempting to execute a fchown on a tarball during the installation/build of sharp. This breaks the web server, and I'm not sure how to recover from it.

Steps to reproduce

Just run an update on an unprivileged LXC, in my experience.

Error output

Reading package lists...
Building dependency tree...
Reading state information...
libmimalloc3 is already the newest version (3.3.2+ds-1).
libde265-dev is already the newest version (1.1.1-1).
Summary:
Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 578
^M^[[K ✔️ ^[[1;92mInstalled/upgraded Testing repo packages^[[m
Already up to date.
^M^[[K ✔️ ^[[1;92mImage-processing libraries up to date^[[m
^M^[[K ✔️ ^[[1;92mUpdate available: Immich 1.3.3 → 3.0.3^[[m
^M^[[K ✔️ ^[[1;92mStopped Services^[[m
^M^[[K ✔️ ^[[1;92mNo update available: VectorChord (1.1.1) - update held back: updated together with Immich after testing^[[m
^M^[[K ✔️ ^[[1;92mDeployed: Immich (3.0.3)^[[m
Hit:1 http://security.debian.org trixie-security InRelease
Hit:2 http://deb.debian.org/debian trixie InRelease
Hit:3 http://deb.debian.org/debian trixie-updates InRelease
Hit:4 https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease
Hit:5 https://deb.nodesource.com/node_24.x nodistro InRelease
Hit:6 https://mise.jdx.dev/deb stable InRelease
Hit:7 https://repo.jellyfin.org/debian trixie InRelease
Hit:8 http://deb.debian.org/debian testing InRelease
Reading package lists...
Building dependency tree...
Reading state information...
133 packages can be upgraded. Run 'apt list --upgradable' to see them.
Reading package lists...
Building dependency tree...
Reading state information...
nodejs is already the newest version (24.18.0-1nodesource1).
0 upgraded, 0 newly installed, 0 to remove and 133 not upgraded.
^M^[[K ✔️ ^[[1;92mUpdate Node.js 24^[[m

changed 1 package in 157ms
^M^[[K ✔️ ^[[1;92mInstalled corepack^[[m
^M^[[K ✔️ ^[[1;92mEnabled corepack^[[m
Preparing pnpm@11.6.0 for immediate activation...
Scope: 3 of 12 workspace projects
Scope: all 12 workspace projects
✓ Lockfile passes supply-chain policies (verified 20h ago)
.. | Progress: resolved 1, reused 0, downloaded 0, added 0
.. | +2465 ++++++++++++++++++++++++++++
.. | Progress: resolved 2465, reused 2450, downloaded 0, added 2317
.. | Progress: resolved 2465, reused 2450, downloaded 0, added 2465, done
.../node_modules/@parcel/watcher install$ node scripts/build-from-source.js
.../core-js@3.49.0/node_modules/core-js postinstall$ node -e "try{require('./postinstall')}catch(e){}"
.../node_modules/@swc/core postinstall$ node postinstall.js
.../node_modules/protobufjs postinstall$ node scripts/postinstall
.../sharp@0.34.5/node_modules/sharp install$ node install/check.js || npm run build
.../core-js@3.49.0/node_modules/core-js postinstall: Done
.../node_modules/@parcel/watcher install: Done
.../node_modules/protobufjs postinstall: Done
.../node_modules/cpu-features install$ node buildcheck.js > buildcheck.gypi && node-gyp rebuild
.../node_modules/@swc/core postinstall: Done
.../node_modules/@scarf/scarf postinstall$ node ./report.js
.../sharp@0.34.5/node_modules/sharp install: Done
.../bcrypt@6.0.0/node_modules/bcrypt install$ node-gyp-build
.../es5-ext@0.10.64/node_modules/es5-ext postinstall$ node -e "try{require('./_postinstall')}catch(e){}" || exit 0
.../bcrypt@6.0.0/node_modules/bcrypt install: Done
.../es5-ext@0.10.64/node_modules/es5-ext postinstall: Done
.../node_modules/cpu-features install: gyp info it worked if it ends with ok
.../node_modules/cpu-features install: gyp info using node-gyp@12.3.0
.../node_modules/cpu-features install: gyp info using node@24.18.0 | linux | x64
.../node_modules/cpu-features install: gyp info find Python using Python version 3.13.5 found at "/bin/python3"
.../node_modules/cpu-features install: gyp http GET https://nodejs.org/download/release/v24.18.0/node-v24.18.0-headers.tar.gz
.../node_modules/cpu-features install: gyp http 200 https://nodejs.org/download/release/v24.18.0/node-v24.18.0-headers.tar.gz
.../node_modules/cpu-features install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
.../node_modules/cpu-features install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
.../node_modules/cpu-features install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
.../node_modules/cpu-features install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
.../node_modules/cpu-features install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
,,,
harp@0.34.5/node_modules/sharp install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown
.../sharp@0.34.5/node_modules/sharp install: gyp WARN install got an error, rolling back install
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! configure error
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! stack Error: There was a fatal problem while downloading/extracting the tarball
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! stack at go (/opt/immich/app/node_modules/.pnpm/node-gyp@13.0.0/node_modules/node-gyp/lib/install.js:254:17)
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! stack at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! stack at async install (/opt/immich/app/node_modules/.pnpm/node-gyp@13.0.0/node_modules/node-gyp/lib/install.js:63:18)
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! stack at async getNodeDir (/opt/immich/app/node_modules/.pnpm/node-gyp@13.0.0/node_modules/node-gyp/lib/configure.js:79:7)
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! stack at async run (/opt/immich/app/node_modules/.pnpm/node-gyp@13.0.0/node_modules/node-gyp/bin/node-gyp.js:81:18)
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! System Linux 6.17.13-2-pve
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! command "/usr/bin/node" "/opt/immich/app/node_modules/.pnpm/node-gyp@13.0.0/node_modules/node-gyp/bin/node-gyp.js" "rebuild" "--directory=src"
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! cwd /opt/immich/app/node_modules/.pnpm/sharp@0.34.5/node_modules/sharp/src
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! node -v v24.18.0
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! node-gyp -v v13.0.0
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! $npm_package_name sharp
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! $npm_package_version 0.34.5
.../sharp@0.34.5/node_modules/sharp install: gyp ERR! not ok
.../sharp@0.34.5/node_modules/sharp install: Failed
[WARN] Deployment with a shared lockfile has failed. If this is a bug, please report it at https://github.com/pnpm/pnpm/issues.
As a workaround, add the following to pnpm-workspace.yaml:

forceLegacyDeploy: true
[ELIFECYCLE] Command failed with exit code 1.
✖️ in line 192: exit code 1 (General error / Operation not permitted): while executing command pnpm --filter immich --prod --no-optional deploy "$APP_DIR"

--- Last 20 lines of log ---
[2026-07-16 14:44:38] [INFO] Installing/upgrading Testing repo packages
[2026-07-16 14:44:39] [OK] Installed/upgraded Testing repo packages
[2026-07-16 14:44:39] [WARN] Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)
[2026-07-16 14:44:39] [OK] Image-processing libraries up to date
[2026-07-16 14:44:39] [INFO] Checking for update: Immich
[2026-07-16 14:44:39] [OK] Update available: Immich 1.7.3 → 3.0.3
[2026-07-16 14:44:39] [INFO] Stopping Services
[2026-07-16 14:44:39] [OK] Stopped Services
[2026-07-16 14:44:39] [INFO] Checking for update: VectorChord
[2026-07-16 14:44:39] [OK] No update available: VectorChord (1.1.1) - update held back: updated together with Immich after testing
[2026-07-16 14:44:40] [INFO] Fetching GitHub release: Immich (3.0.3)
[2026-07-16 14:44:46] [OK] Deployed: Immich (3.0.3)
[2026-07-16 14:44:46] [INFO] Update Node.js 24
[2026-07-16 14:44:48] [OK] Update Node.js 24
[2026-07-16 14:44:48] [INFO] Installing corepack
[2026-07-16 14:44:48] [OK] Installed corepack
[2026-07-16 14:44:48] [INFO] Enabling corepack
[2026-07-16 14:44:48] [OK] Enabled corepack
[2026-07-16 14:44:49] [INFO] Updating Immich web and microservices
[2026-07-16 14:45:14] [ERROR] in line 192: exit code 1 (General error / Operation not permitted): while executing command pnpm --filter immich --prod --no-optional deploy "$APP_DIR"

Additional context

I'm running Immich in an unprivileged LXC in Proxmox VE and have never had any difficulties before, but nothing I do now allows me to successfully build (or rebuild). I suspect there's a dependency that's being pulled along that doesn't play nicely -- probably sharp, given the error.

[MickLesk]

Tbh, skipped 4 months of Updates? 🤔

I See, that Sharp failed with rights, so it Look Like you have an mnt and patches folder to other users?

Run this before Update and run the Update in full verbose:

if [ -d /usr/include/node ]; then
    export npm_config_nodedir=/usr
    export npm_package_config_node_gyp_nodedir=/usr
fi

# clear the node and gyp cache
rm -rf ~/.cache/node-gyp
rm -rf /root/.npm/_cacache

Now Run the update in verbose

[TheRealTomDavidson]

It's not ACTUALLY months without an update; I just had to set the version in .immich back to get the update to do anything, since it actually updates the version to 3.0.3 even though the build is unsuccessful.

Sadly, running the above seems to produce the exact same error. It's definitely this:
.../node_modules/cpu-features install: gyp ERR! error while extracting tarball TAR_ENTRY_ERROR EINVAL: invalid argument, fchown

I have no idea how to get past that, and don't know enough about buildchains to know why even trying to install an older version of things still causes that dependency to throw a fit.

[MickLesk]

What is the storage Type? Is this an zfs or similiar? Or an LVM? What are your Guid and UId mappings? That look not Like an immich or Script issue, more then a permissions or wrong uid issue.

It is still trying to download and extract the headers itself

run the following inside the Immich LXC before running the update:

NODE_VERSION="$(node -p 'process.versions.node')"
NODE_GYP_CACHE="/root/.cache/node-gyp/${NODE_VERSION}"

rm -rf "$NODE_GYP_CACHE"
mkdir -p "$NODE_GYP_CACHE"

curl -fL \
  "https://nodejs.org/download/release/v${NODE_VERSION}/node-v${NODE_VERSION}-headers.tar.gz" \
  -o /tmp/node-headers.tar.gz

tar \
  --extract \
  --gzip \
  --file=/tmp/node-headers.tar.gz \
  --directory="$NODE_GYP_CACHE" \
  --strip-components=1 \
  --no-same-owner \
  --no-same-permissions

printf '11\n' >"$NODE_GYP_CACHE/installVersion"
rm -f /tmp/node-headers.tar.gz

test -f "$NODE_GYP_CACHE/include/node/node.h"

Then reset the version in ~/.immich as you did previously and run the normal update again

The difference is that the header archive is extracted by GNU tar with --no-same-owner. This avoids restoring UID/GID information, i think the Guid or uid are wrong here.

During the update, node-gyp should now report that the required version is already installed. It should no longer show; gyp http GET https://nodejs.org/download/release/...

This is not specifically caused by cpu-features or sharp. Both packages invoke node-gyp, and node-gyp fails while extracting the Node.js header archive. The EINVAL from fchown() indicates that the archive contains an owner or group ID that cannot be mapped inside the unprivileged container.

[TheRealTomDavidson]

I have the Immich gallery installed on a fileshare hosted on the same Proxmox cluster (although on a different drive), with the immich user and group mapped to that fileshare. Storage throughout is a combination of spinny disk and SSD ZFS pools. All group and user IDs are mapped, and I can confirm access to the fileshare; there is some intentional restriction of root, of course, but that's the whole POINT of an unprivileged container.

That said, the script you just recommended seems to have worked, as I was able to execute it without errors and then was able to run "update" without the sharp error. It claims to be built successfully, as you can see from this last bit of the log:

_web build: ✓ built in 12.33s
web build: Run npm run preview to preview your production build locally.
web build: > Using @sveltejs/adapter-static
web build: [PLUGIN_TIMINGS] Your build spent significant time in plugins. Here is a breakdown:
web build: - vite-plugin-sveltekit-guard (80%)
web build: - vite-plugin-sveltekit-virtual-modules (4%)
web build: - imagetools (4%)
web build: - vite-plugin-svelte:compile (4%)
web build: See https://rolldown.rs/options/checks#plugintimings for more details.
web build:
web build: Wrote site to "build"
web build: ✔ done
web build: Done
Packages are copied from the content-addressable store to the virtual store.
Content-addressable store is at: /root/.local/share/pnpm/store/v11
Virtual store is at: ../app/cli/node_modules/.pnpm
? Verifying lockfile at ../app/cli/pnpm-lock.yaml against supply-chain policies (2665 entries)...
✓ Lockfile at ../app/cli/pnpm-lock.yaml passes supply-chain policies (2665 entries in 2.8s)
../app/cli | Progress: resolved 1, reused 0, downloaded 0, added 0
../app/cli | +21 ++
../app/cli | Progress: resolved 21, reused 21, downloaded 0, added 21, done
mise all tools are installed
Scope: 3 of 12 workspace projects
Already up to date
Done in 282ms using pnpm v11.6.0
Scope: 3 of 12 workspace projects
packages/sdk build$ tsc
packages/sdk build: Done
packages/plugin-sdk build$ node esbuild.js && tsc --emitDeclarationOnly && tsc-alias
packages/plugin-sdk build: Done
packages/plugin-core build$ pnpm build:tsc && pnpm build:wasm
packages/plugin-core build: $ plugin-sdk prepareBuild && tsc --noEmit && node esbuild.js
packages/plugin-core build: $ extism-js dist/index.js -i dist/index.d.ts -o dist/plugin.wasm
packages/plugin-core build: Done
✔️ Updated Immich server, web, cli and plugins
⏳ Pre-installing Python python3.11 for machine-learningPython 3.11 is already installed
✔️ Pre-installed Python python3.11
⏳ Updating machine-learningUsing CPython 3.11.15
Creating virtual environment at: /opt/immich/app/machine-learning/ml-venv
Resolved 141 packages in 5ms
Built immich-ml @ file:///opt/immich/source/machine-learning
Built easydict==1.11
Built antlr4-python3-runtime==4.9.3
Built insightface==0.7.3
Prepared 84 packages in 8.46s
Installed 84 packages in 854ms
Bytecode compiled 6750 files in 3.05s

• aiocache==0.12.3
• albumentations==1.3.1
• annotated-doc==0.0.4
• annotated-types==0.7.0
• antlr4-python3-runtime==4.9.3
• anyio==4.2.0
• certifi==2025.11.12
• charset-normalizer==3.3.2
• click==8.4.1
• colorlog==6.9.0
• contourpy==1.3.3
• cycler==0.12.1
• cython==3.0.8
• easydict==1.11
• fastapi==0.136.3
• filelock==3.20.1
• flatbuffers==23.5.26
• fonttools==4.61.1
• fsspec==2023.12.2
• gunicorn==25.3.0
• h11==0.16.0
• hf-xet==1.5.1
• httpcore==1.0.9
• httptools==0.8.0
• httpx==0.28.1
• huggingface-hub==1.19.0
• idna==3.11
• imageio==2.33.1
• immich-ml==3.0.3 (from file:///opt/immich/source/machine-learning)
• insightface==0.7.3
• joblib==1.3.2
• kiwisolver==1.4.5
• lazy-loader==0.4
• markdown-it-py==3.0.0
• matplotlib==3.10.5
• mdurl==0.1.2
• ml-dtypes==0.5.3
• networkx==3.2.1
• numpy==2.4.6
• omegaconf==2.3.0
• onnx==1.19.1
• onnxruntime==1.26.0
• opencv-python==4.11.0.86
• opencv-python-headless==4.13.0.92
• orjson==3.11.9
• packaging==23.2
• pillow==12.2.0
• prettytable==3.9.0
• protobuf==6.33.2
• pyclipper==1.3.0.post6
• pydantic==2.13.4
• pydantic-core==2.46.4
• pydantic-settings==2.14.1
• pygments==2.17.2
• pyparsing==3.1.1
• python-dateutil==2.8.2
• python-dotenv==1.0.0
• python-multipart==0.0.32
• pyyaml==6.0.2
• qudida==0.0.4
• rapidocr==3.8.1
• requests==2.32.4
• rich==15.0.0
• scikit-image==0.25.2
• scikit-learn==1.7.1
• scipy==1.16.1
• shapely==2.1.1
• shellingham==1.5.4
• six==1.16.0
• sniffio==1.3.0
• starlette==0.50.0
• threadpoolctl==3.2.0
• tifffile==2023.12.9
• tokenizers==0.23.1
• tqdm==4.66.3
• typer==0.25.1
• typing-extensions==4.15.0
• typing-inspection==0.4.2
• urllib3==2.6.2
• uvicorn==0.49.0
• uvloop==0.22.1
• watchfiles==0.21.0
• wcwidth==0.2.13
• websockets==12.0
  ✔️ Updated machine-learning
  ⏳ Patching media.repository.jshotfix applied
  ✔️ Patched media.repository.js
  ✔️ Updated successfully!

I had to tweak the .service files a little bit to get systemctl to start the two Immich services -- the location changed after the above install -- but everything now runs. If it's not too much troubl, could you please explain why that fixed the problem I was having? (I'm very grateful, by the way.)

[TheRealTomDavidson]

(And to elaborate: I understand that this is almost certainly due to a GID/UID mapping error. But what would it be? Does that fchown not try to run as root, and map therefore to 10000?)

[MickLesk]

It worked because node gyp was failing while extracting the nodejs headers and trying to preserve the archive’s UID/GID via fchown()

In an unprivileged LXC, container root is mapped to a non-root host UID. Some ownership changes are therefore not valid and return EINVAL

tar --no-same-owner skips restoring the archived UID/GID, so the headers are extracted with valid container ownership. after that, node-gyp finds them in its cache and no longer downloads or extracts them itself

So the issue was not Sharp or Immich directly, but node-gyp header extraction inside the unprivileged container with wrong mapping