Docker image based on alpine package=rabbitmq-server, fails during plugin actions, when invoked without root

[manojkrgupta]

Describe the bug

• Docker image based out of alpine package=rabbitmq-server fails during call to rabbitmq-plugins
• It works fine if the image is running with root.
• It errors when invoked with non root user=rabbitmq
• Error: Only root or rabbitmq can run rabbitmq-plugins

Reproduction steps

]$ docker run -it --rm --entrypoint=sh alpine                  
/ # grep rabbitmq /etc/passwd    # user does not exist
/ # whoami
root
/ # apk update
/ # apk add rabbitmq-server       # add rabbitmq server
/ # grep rabbitmq /etc/passwd
rabbitmq:x:100:101:RabbitMQ Server:/var/lib/rabbitmq:/sbin/nologin
/ # su -s /bin/sh rabbitmq -c "whoami"
rabbitmq
/ # su -s /bin/sh rabbitmq -c "rabbitmq-plugins set rabbitmq_top rabbitmq_shovel" # command rabbitmq-plugins  fails

Usage

rabbitmq-plugins [--node <node>] [--timeout <timeout>] [--longnames] [--quiet] <command> [<command options>]

Available commands:

Help:

   autocomplete  Provides command name autocomplete variants
   help          Displays usage information for a command
   version       Displays CLI tools version

Monitoring, observability and health checks:

   directories   Displays plugin directory and enabled plugin file paths
   is_enabled    Health check that exits with a non-zero code if provided plugins are not enabled on target node

Plugin Management:

   disable       Disables one or more plugins
   enable        Enables one or more plugins
   list          Lists plugins and their state
   set           Enables one or more plugins, disables the rest

Use 'rabbitmq-plugins help <command>' to learn more about a specific command

Only root or rabbitmq can run rabbitmq-plugins

/ # 

Expected behavior

• Should work with user=rabbitmq

Additional context

No response

[manojkrgupta]

Created a PR #15685

[michaelklishin]

This was discussed multiple times.

This behavior is by design and primarily affects the Debian and RPM packages.

[michaelklishin]

@dumbbell @lukebakken we have been there several times before and rejected such changes every time but last time it was around 2020 or so.

I am not an Alpine user, and this is not a common discussion in the community OCI (which has an Alpine variant) repository.

Any opinions on whether this original idea for Debian and RPM packages is still relevant in 2026?

[dumbbell]

Changing the list of enabled plugins is an administrative task that should require root privileges IMHO. The non-privileged user running RabbitMQ shouldn’t have the rights to change it.

Therefore the current behaviour seems legit to me.

[michaelklishin]

Pre-configuring plugins does not require the use of CLI tools, in particular in the case of containers.

It should be possible to mount an enabled_plugins file with a trailing dot (.) since it must be a valid Erlang term file.

[lukebakken]

@manojkrgupta see this PR which will address the message that lead to all of this confusion:

#15701

Requiring root to run rabbitmq-plugins is the correct behavior as pointed out here.