[BUG] BunkerWeb UI fails to start with gunicorn: Permission denied to /root

[dbc-ca]

What happened?

After installing BunkerWeb on a fresh Rocky Linux 9.6 system(Linode), the bunkerweb-ui service continuously fails to start and enters a crash loop. The systemd logs show the UI trying to launch Gunicorn but exiting with
Error: [Errno 13] Permission denied: '/root'
The service starts briefly, binds to 127.0.0.1:7000, then terminates repeatedly. Even setting SELinux to Permissive does not resolve the issue. The process appears to run as the nginx user, but it still tries to access /root, causing a failure.

I was running BunkerWeb 1.6.4 successfully without issues. When I upgraded to a newer version (I also tested a few release candidates) the bunkerweb-ui service stopped working and entered a crash loop.

After a fresh install of Rocky Linux 9.6 and a clean installation of BunkerWeb, the same issue occurs: the UI fails to start

How to reproduce?

1 - Deploy a fresh Rocky Linux 9.6 instance on Linode.
2 - SSH into the server as root.
3 - curl -LO https://github.com/bunkerity/bunkerweb/releases/download/v1.6.5/install-bunkerweb.sh
4 - chmod +x ./install-bunkerweb.sh
5 - ./install-bunkerweb.sh

Configuration file(s) (yaml or .env)

Relevant log output

systemctl status bunkerweb-ui
● bunkerweb-ui.service - BunkerWeb UI service
     Loaded: loaded (/usr/lib/systemd/system/bunkerweb-ui.service; enabled; preset: disabled)
    Drop-In: /etc/systemd/system/bunkerweb-ui.service.d
             └─env.conf
     Active: activating (auto-restart) (Result: exit-code) since Sat 2025-10-04 10:42:01 UTC; 709ms ago
       Docs: https://docs.bunkerweb.io
    Process: 39435 ExecStart=/usr/share/bunkerweb/scripts/bunkerweb-ui.sh start (code=exited, status=1/FAILURE)
   Main PID: 39435 (code=exited, status=1/FAILURE)
        CPU: 103ms
[root@bunkerweb ~]# 


Oct 04 10:43:32 bunkerweb.example.com systemd[1]: bunkerweb-ui.service: Scheduled restart job, restart counter is at 237.
Oct 04 10:43:32 bunkerweb.example.com systemd[1]: Stopped BunkerWeb UI service.
Oct 04 10:43:32 bunkerweb.example.com bunkerweb-ui.sh[41091]: Stopping UI service...
Oct 04 10:43:32 bunkerweb.example.com systemd[1]: Started BunkerWeb UI service.
Oct 04 10:43:32 bunkerweb.example.com bunkerweb-ui.sh[41091]: UI service is not running or the pid file doesn't exist.
Oct 04 10:43:32 bunkerweb.example.com bunkerweb-ui.sh[41091]: Starting UI
Oct 04 10:43:32 bunkerweb.example.com sudo[41179]:     root : PWD=/ ; USER=nginx ; GROUP=nginx ; COMMAND=/bin/bash -c 'PYTHONPATH=/usr/share/bunkerweb/deps/python:/usr/share/bunkerweb/ui python3 -m gunicorn --chdir /usr/share/bunkerweb/ui --logger-class utils.logger.TmpUiLogger --config /usr/share/bunkerweb/ui/utils/tmp-gunicorn.conf.py -D'
Oct 04 10:43:32 bunkerweb.example.com sudo[41183]:     root : PWD=/ ; USER=nginx ; GROUP=nginx ; COMMAND=/bin/bash -c 'PYTHONPATH=/usr/share/bunkerweb/deps/python:/usr/share/bunkerweb/ui python3 -m gunicorn --chdir /usr/share/bunkerweb/ui --logger-class utils.logger.UiLogger --config /usr/share/bunkerweb/ui/utils/gunicorn.conf.py'
Oct 04 10:43:33 bunkerweb.example.com systemd[1]: bunkerweb-ui.service: Main process exited, code=exited, status=1/FAILURE
Oct 04 10:43:33 bunkerweb.example.com systemd[1]: bunkerweb-ui.service: Failed with result 'exit-code'.

BunkerWeb version

1.6.5

What integration are you using?

Linux

Linux distribution (if applicable)

Rocky Linux 9.6

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[dbc-ca]

I tried deploying in Alma Linux 9 it does the same thing, bunkerweb-ui fails to start
I tried on Fedora 42 and the bunkerweb-ui doesnt fail to start.

[dbc-ca]

Update / Root cause analysis:

I believe I’ve identified the reason why the UI fails to start on Rocky Linux 9 (and AlmaLinux 9).

On those distributions, the default python3 points to Python 3.9, but BunkerWeb 1.6.5 ships the biscuit_auth extension compiled specifically for CPython 3.11 (biscuit_auth.cpython-311-*.so). Because of that, when the UI service starts with:

python3 -m gunicorn --chdir /usr/share/bunkerweb/ui ...

it fails with:

ModuleNotFoundError: No module named 'biscuit_auth.biscuit_auth'

This explains why version 1.6.4 worked fine, but 1.6.5 and all 1.6.5-rc builds crash the UI immediately — they depend on Python 3.11 but still invoke python3, which is 3.9 on RHEL-based systems.

I confirmed this by modifying /usr/share/bunkerweb/scripts/bunkerweb-ui.sh to explicitly use python3.11 instead of python3. After doing that, the UI service started successfully and the /setup page became accessible.

So it looks like the problem is not with Rocky itself or with CIS hardening, but with the Python version mismatch. Fedora 42 works out of the box because there python3 is already 3.11.

Suggestion: update the systemd unit or launcher scripts to explicitly call python3.11, or include a compatibility layer / wheel that works with Python 3.9 as well.

[TheophileDiot]

Hi @dbc-ca, thank you for investigationg on this and for the report!

[TheophileDiot]

We'll see what we can do, as python3.9 is about to achieve it's end of life we've just updated but indeed this can cause problems.