The source Paperless-ngx install failed late in the ZimaOS App Store process, first with an unauthorized error while pulling a Tika image from GitHub Container Registry and later with a DNS failure for a registry mirror. That combination makes the thread more complicated than “Paperless is broken”: the failing component was an optional Tika service/image path, and the registry endpoint itself changed between attempts.
The public thread never reached a confirmed ZimaOS App Store fix. One user switched the Tika image to Apache's image and reached 100% installation, but the stack still did not run. Current Paperless-ngx documentation now provides a clearer path: use the maintained Docker Compose templates and enable the Tika/Gotenberg variant only when those document formats are needed.
The First Failure Was a GHCR Authorization Error
The original error occurred around 80%:
Head "https://ghcr.io/v2/paperless-ngx/tika/manifests/2.9.1-minimal": unauthorizedDeleting local Docker images and reinstalling did not change the outcome, which argues against a simple stale local image.
The Next Attempt Failed on DNS Resolution
Two days later, the error had changed to a failed DNS lookup for a registry-mirror hostname. A community responder therefore suggested checking name resolution, basic HTTPS connectivity, DNS filtering, VPN/proxy behavior, and a manual image pull.
Those were community diagnostics, not an IceWhale-confirmed root cause.
Tika Is Optional in Current Paperless-ngx
Current Paperless-ngx documentation says Tika plus Gotenberg are optional services used for Office documents such as DOC/XLSX/ODT and for email parsing. If those formats are not required, Tika does not need to be enabled at all.
If they are required, use the maintained Compose variant that includes Tika and Gotenberg rather than an old app-store image reference.
Current Upstream Docker Compose Is the Best Baseline
The current Paperless-ngx setup guide recommends Docker for most users and provides maintained Compose files. New installations are recommended to use PostgreSQL, and Tika-enabled templates are provided separately.
Use the current Paperless-ngx Docker Compose installation model if the ZimaOS App Store package is stale or references an unavailable auxiliary image.
Changing Only the Tika Image May Not Be Enough
One participant replaced the Tika image with apache/tika:latest. The installation reached 100%, but the application still failed after startup.
That negative result matters because Paperless needs the service endpoint, feature flag, and Gotenberg integration to match the Compose configuration. A container image substitution is not necessarily a complete stack migration.
Put Paperless Persistent Data on the Main Storage Space
Paperless can grow through consumed documents, thumbnails, OCR data, search indexes, and its database. Current ZimaOS recommends moving app data off the system drive before installing storage-heavy applications.
The current ZimaOS app-storage path model is particularly relevant for Paperless because its data footprint can grow far beyond the Docker image size.
Permissions Matter for the Consumption Folder
Current Paperless-ngx documentation exposes USERMAP_UID and USERMAP_GID so the container can write to host bind-mounted folders. If the stack installs but cannot ingest documents, verify these values and the host folder permissions instead of returning to registry troubleshooting.
Do Not Treat a Registry Mirror Hostname as the Paperless Application
The second source error referenced a mirror-style hostname rather than the main ghcr.io endpoint. That distinction matters: an application package can be perfectly valid while the configured image mirror, DNS server, or regional registry path is unavailable.
If a manual pull from the upstream registry succeeds but the App Store still tries a broken mirror, the problem belongs to the package or registry-routing layer rather than Paperless itself.
Separate Image-Pull Failure from Container-Startup Failure
The first source attempt never finished pulling all required images. The later Apache Tika experiment reached 100% installation but then failed after start. These are two different failure stages and need different evidence.
- Pull stage: registry authentication, DNS, mirror availability, image tag.
- Startup stage: environment variables, database connectivity, Tika/Gotenberg endpoints, volumes, permissions, and health checks.
Back Up a Working Paperless Instance Before Replacing the App Store Stack
If Paperless is already in use, do not switch Compose templates merely to fix an auxiliary service without protecting the documents and database first. Current upstream Paperless includes an exporter specifically for backup and migration.
For a new installation, starting from the maintained upstream Compose file is simpler; for an existing installation, preserve the current database and media paths before any stack rewrite.
Paperless-ngx Install FAQ
Was the 2025 failure conclusively a DNS problem?
No. The thread showed both authorization and DNS errors, and no official final diagnosis was posted.
Is Tika required for every Paperless-ngx installation?
No. It is optional and mainly needed for Office documents and email parsing.
Did switching to apache/tika fully solve the source case?
No. One user reached 100% installation but the application still did not run.
