[BUG] Docker Compose <=1.59.0 needs App_Secret in environment declared

[LukePWilkins]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The linuxserver.io docker compose needs to include the app_secret environment, as per https://www.kimai.org/documentation/docker-compose.html

Going from version 1.58.0 of the linuxserver.io without the app_secret declared throws a 500 something went wrong error and the dashboard isn't displayed etc.

prod.log shows
[2026-07-04 18:55:39] [request] INFO: Matched route "homepage". {"route":"homepage","route_parameters":{"_route":"homepage","_controller":"App\Controller\HomepageController::homepage","_locale":"en"},"request_uri":"https://woot.time.co.uk/en/homepage","method":"GET"} []
[2026-07-04 18:55:39] [request] CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\InvalidArgumentException: "A non-empty secret is required." at SignatureHasher.php line 42 {"exception":"[object] (Symfony\Component\Security\Core\Exception\InvalidArgumentException(code: 0): A non-empty secret is required. at /app/www/vendor/symfony/security-core/Signature/SignatureHasher.php:42)"} []

Expected Behavior

Dashboard should display as normal and login to occur.

Steps To Reproduce

If you clone the docker compose file as is currently, kimai will throw a 500.

Environment

- OS:
- How docker service was installed:

CPU architecture

x86-64

Docker creation

services:
  kimai:
    image: lscr.io/linuxserver/kimai:latest
    container_name: kimai
    profiles: ["time", "all"]
    networks:
      - default
      - t2_proxy
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=$TZ
      - DATABASE_URL=mysql://theuser:thepass@thedb:3306/kimai?charset=utf8mb4&serverVersion=12.1.2-MariaDB-ubu2404
      - TRUSTED_PROXIES=1.1.1.1
      - TRUSTED_HOSTS=trusted.host
      - APP_SECRET=NOW NEEDED!!!!!!
    volumes:
      #- $DOCKERDIR/appdata/kimai/config:/config
      - $DOCKERDIR/appdata/kimai/config:/config
    ports:
      - 8083:80
      - 8443:443
    restart: unless-stopped

Container logs

[2026-07-04 18:50:00] [request] INFO: Matched route "homepage". {"route":"homepage","route_parameters":{"_route":"homepage","_controller":"App\\Controller\\HomepageController::homepage","_locale":"en"},"request_uri":"https://co.nz/en/homepage","method":"GET"} []
[2026-07-04 18:50:00] [request] CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\InvalidArgumentException: "A non-empty secret is required." at SignatureHasher.php line 42 {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\InvalidArgumentException(code: 0): A non-empty secret is required. at /app/www/vendor/symfony/security-core/Signature/SignatureHasher.php:42)"} []
[2026-07-04 18:55:36] [request] INFO: Matched route "homepage". {"route":"homepage","route_parameters":{"_route":"homepage","_controller":"App\\Controller\\HomepageController::homepage","_locale":"en"},"request_uri":"https://o.nz/en/homepage","method":"GET"} []
[2026-07-04 18:55:36] [request] CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\InvalidArgumentException: "A non-empty secret is required." at SignatureHasher.php line 42 {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\InvalidArgumentException(code: 0): A non-empty secret is required. at /app/www/vendor/symfony/security-core/Signature/SignatureHasher.php:42)"} []
[2026-07-04 18:55:39] [request] INFO: Matched route "home". {"route":"home","route_parameters":{"_route":"home","_controller":"Symfony\\Bundle\\FrameworkBundle\\Controller\\RedirectController::redirectAction","route":"homepage","permanent":true},"request_uri":"https://.nz/","method":"GET"} []
[2026-07-04 18:55:39] [request] CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\InvalidArgumentException: "A non-empty secret is required." at SignatureHasher.php line 42 {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\InvalidArgumentException(code: 0): A non-empty secret is required. at /app/www/vendor/symfony/security-core/Signature/SignatureHasher.php:42)"} []
[2026-07-04 18:55:39] [request] INFO: Matched route "homepage". {"route":"homepage","route_parameters":{"_route":"homepage","_controller":"App\\Controller\\HomepageController::homepage","_locale":"en"},"request_uri":"https://nz/en/homepage","method":"GET"} []
[2026-07-04 18:55:39] [request] CRITICAL: Uncaught PHP Exception Symfony\Component\Security\Core\Exception\InvalidArgumentException: "A non-empty secret is required." at SignatureHasher.php line 42 {"exception":"[object] (Symfony\\Component\\Security\\Core\\Exception\\InvalidArgumentException(code: 0): A non-empty secret is required. at /app/www/vendor/symfony/security-core/Signature/SignatureHasher.php:42)"} []

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.