Permissions 0600 for acme.json are too open: Traefik ACME storage

Expected Behavior and Impact

p>When acme.json is restored with permissions broader than 600 (e.g., 644 or 0755), Traefik will refuse to read the file. This is a security feature designed to protect private keys and ACME account tokens from unauthorized access on the host.

Traefik does not attempt to automatically correct these permissions. If the file is too accessible, Traefik will log an error message to standard output and ignore the file entirely. This typically results in the proxy failing to initialize the ACME provider, leading it to request new certificates on every restart, which can quickly trigger CA rate limiting from providers like Let's Encrypt.

Resolution Steps

To resolve this in a non-root containerized environment, you must manually ensure the file permissions and ownership are correct before Traefik starts:

• Identify the path to your acme.json file on the host or volume.
• Execute the following command to restrict access:

  chmod 600 /path/to/acme.json

• Ensure the file is owned by the UID running the Traefik process (often UID 1000 in non-root images):

  chown 1000:1000 /path/to/acme.json

Containerization Considerations

If you are using Docker Compose, simple volume mounts often inherit permissions from the host directory's umask. If permissions reset after a container restart, consider using an entrypoint script to set permissions before the main binary executes:

# Example entrypoint logic
command: ["sh", "-c", "chmod 600 /etc/traefik/acme.json && /traefik"]

To provide a more specific solution, are you using a standard Docker volume mount, a Kubernetes PersistentVolume, or a specific cloud-provider storage?