n8n "EACCES: permission denied, open '/home/node/.n8n/config'" in Docker: cause and a fix that sticks

A fresh n8n container with a bind-mounted data folder never became healthy. /healthz stayed unreachable, and the logs showed:

n8n-1  | Error: Failed to load command "start"
n8n-1  | Error: EACCES: permission denied, open '/home/node/.n8n/config'

Cause

The compose file mounted ./data:/home/node/.n8n. The folder didn't exist yet, so Docker created it, as root:

$ ls -ld data
drwxr-xr-x 2 root root 4096 Sep 25 20:47 data

The n8n image runs as the node user, uid 1000, which can't write to a root-owned directory. So n8n can't create its config file (which holds the encryption key) and exits.

Quick fix

sudo chown -R 1000:1000 ./data
docker compose up -d

That works until someone deploys to a new server or deletes the folder, and then it breaks again.

Fix that sticks: a one-shot init container

Let Compose fix the ownership itself, before n8n starts, on every up:

services:
  n8n-init:
    image: busybox:1.37
    command: chown -R 1000:1000 /data
    volumes:
      - ./data:/data
  n8n:
    image: n8nio/n8n:2.41.3
    depends_on:
      n8n-init:
        condition: service_completed_successfully
    ports:
      - "127.0.0.1:5678:5678"
    volumes:
      - ./data:/home/node/.n8n
    # ...env as usual

Result on the same server:

n8n healthz: 200 after ~16s
$ ls -ln data
-rw------- 1 1000 1000   88 Sep 25 20:56 config

Alternatives

• A named volume (n8n_data:/home/node/.n8n), as in n8n's own examples. Docker initializes it with the image's ownership, so the problem doesn't happen. The trade-off is that the data lives under /var/lib/docker/volumes instead of next to your compose file, which makes plain file-level backups less obvious.
• user: "0": don't. Running n8n as root just to paper over a permissions issue gives every workflow root inside the container.

Two more things while you're here

• Keep N8N_ENCRYPTION_KEY set explicitly and backed up. If config is lost and the key wasn't set, every stored credential becomes unreadable.
• Note the 127.0.0.1: in the port mapping. A plain 5678:5678 is reachable from the internet even with ufw enabled. Put n8n behind a reverse proxy with HTTPS instead.