ZimaOS 1.6.2 Beta 2 – Docker app data migration blocked by security policy

Insight & Feedback ZimaOS Open Beta
1

ZimaOS 1.6.2 Beta 2 – Docker app data migration blocked by security policy

After updating from ZimaOS 1.6.1 to 1.6.2 beta 2, the “Change application data location” / Docker storage migration feature stopped working.

Issue description

When trying to change the storage path for Docker containers or application data via the ZimaOS UI, the operation fails immediately with the message:

“This request was blocked by security policy”

This feature worked normally in ZimaOS 1.6.1.

Steps to reproduce

  1. Open ZimaOS settings

  2. Go to application data location / storage settings

  3. Select a new path for Docker/app data

  4. Confirm migration

  5. Operation is blocked with a security policy error

Environment

  • ZimaOS version: 1.6.2 beta 2

  • Previous version: 1.6.1 (working)

  • Storage: Btrfs volumes under /media

  • Docker apps managed via ZimaOS UI

Additional observations

  • /media mount points are now owned by root:root with 755 permissions

  • Non-root users cannot write to disk roots anymore

  • Storage management appears to be handled by zimaos-local-storage.service

  • Manual Docker operations still work, but UI-based migration is blocked

Impact

  • Breaks Docker application migration between disks

  • Prevents normal NAS workflow for moving app data to other drives

  • Forces manual Docker configuration outside of UI

Question

Is this a deliberate change in the storage/security policy of ZimaOS 1.6.x, or a regression introduced in 1.6.2 beta 2?

2

confirmed getting same results here.

3

Yes, this looks like a regression in ZimaOS 1.6.2 Beta 2 rather than a Docker problem.

The important detail is that manual Docker operations still work, but the ZimaOS UI migration path is blocked with:

This request was blocked by security policy

So the failure appears to be in the ZimaOS storage/API security layer, not Docker itself.

It may be related to the new ownership/permission behaviour on “/media”, where mount roots are now “root:root” with “755” permissions. If the UI migration backend is not running with the required permission, the request may be rejected before the actual Docker move starts.

I would not manually chmod “/media” or change disk-root permissions as a workaround until IceWhale confirms the intended policy.

For now this should probably be treated as a 1.6.2 Beta 2 regression affecting “Change application data location” / Docker app-data migration.

4

Thank you for the feedback. This is a known issue, and we will release an official version to fix it as soon as possible.

1 Like
5

On a clean installation of ZimaOS v.1.6.2, the “Change Application Data Location” feature/Docker application data migration all works. Apparently, the issues arise when upgrading versions. This means that Zima’s programmers either don’t test this as a transition during upgrades or are overlooking this functionality.