[BUG] Cannot use two instances of qbittorrent simulateously

[KamilLenica]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When I create second instance of qbittorrent with port mappet to something different than default 8080 I can only login, but any action e.g. Open settings fails with error

in browser console i can see that qbittorrent answers with 403 error

:8090/:1 The Cross-Origin-Opener-Policy header has been ignored, because the URL's origin was untrustworthy. It was defined either in the final response or a redirect. Please deliver the response using the HTTPS protocol. You can also use the 'localhost' origin instead. See https://www.w3.org/TR/powerful-features/#potentially-trustworthy-origin and https://html.spec.whatwg.org/#the-cross-origin-opener-policy-header.

client.js?locale=C&v=1aui7h2:760
GET http://192.168.31.100:8090/api/v2/sync/maindata?rid=1 403 (Forbidden)

Another instance that I've started couple days ago, with default ports set, works fine

Expected Behavior

I can login and change settings when running two qBittorrent instances

Steps To Reproduce

spin up qbittorrent container with webUI port set to 8080 and second instance with default ports

Environment

- OS: RaspberryPi OS 64bit
- How docker service was installed: package manager

CPU architecture

arm64

Docker creation

---
services:
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent-manual
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Warsaw
      - WEBUI_PORT=8090
      - TORRENTING_PORT=6882
    volumes:
      - ~instance1/config:/config
      - /home/leniek/myBook/TORRENT:/downloads/duo #optional
      - /home/leniek/myBook2/:/downloads/solo
    ports:
      - 8090:8090
      - 6882:6882
      - 6882:6882/udp
    restart: unless-stopped


services:
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:latest
    container_name: qbittorrent
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Warsaw
      - WEBUI_PORT=8080
      - TORRENTING_PORT=6881
    volumes:
      - ~instance2:/config
      - /home/leniek/myBook/TORRENT:/downloads/duo #optional
      - /home/leniek/myBook2/:/downloads/solo
    ports:
      - 8090:8080
      - 6882:6881
      - 6882:6881/udp
    restart: unless-stopped

Container logs

leniek@raspberrypi:~/Containers/qbittorrent-manual $ docker logs qbittorrent-manual
[migrations] started
[migrations] no migrations found
───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: 5.1.4-r2-ls439
Build-date: 2026-02-03T17:38:06+00:00
───────────────────────────────────────

[custom-init] No custom files found, skipping...
WebUI will be started shortly after internal preparations. Please wait...

******** Information ********
To control qBittorrent, access the WebUI at: http://localhost:8090
The WebUI administrator username is: admin
The WebUI administrator password was not set. A temporary password is provided for this session: 6hy4THCan
You should set your own password in program preferences.
Connection to localhost (::1) 8090 port [tcp/*] succeeded!
[ls.io-init] done.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[Roxedus]

Does the 8090 instance work if you log out of the 8080 one, and log into 8090?

[KamilLenica]

If i stop 8080 instance container, then 8090 instance works

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[dexter74]

You'r yaml has get doublon on service and the port on host :

---
services:
  qbittorrent: 
      - 6882:6882
      - 6882:6882/udp

services:
  qbittorrent:          <== Service name already exist ! Change its
      - 6882:6881       <== Port already use on Host
      - 6882:6881/udp   <== Port already use on Host
---

Rename service 2 at qbittorrent2
Change port left at ":"

Exemple

---
services:
  qbittorrent: 
      - 6882:6882
      - 6882:6882/udp

services2:
  qbittorrent: 
      - 6883:6881
      - 6884:6881/udp
---

it's not a bug, just bad configuration !

[j0nnymoe]

This isn't a bug with the container. This is due to protections that are put in place by qbittorrent itself.

[KamilLenica]

You'r yaml has get doublon on service and the port on host :

I've pasted wrong file, right, I do have separate names for containers, they would not start if they had the same name

This is due to protections that are put in place by qbittorrent itself.

That's just not true, i am running multiple instances of qbittorrentofficial/qbittorrent-nox:latest right now without a problem.

From my perspective it may remain closed as I've moved away from LSIO containers

[Roxedus]

To check my sanity, i've checked this scenario yet another time, and both instances still work. And as expected, when logging into instance 2, i get logged out of instance 1, but they still keep on working. The logging out happens because they both set the same cookie (ive only used localhost in this scenario, as OP did not mention any other setup).

This also explains why I asked if you simply got logged out, which you failed to answer, and due to my busy day, I did not follow up on, as i was waiting on the answer.

The protections that are mentioned are very much inside qbit itself, it is the CSRF protection they implement,
The interesting configfile options for these are

WebUI\CSRFProtection=true
WebUI\ClickjackingProtection=true

if they are not true on your instances, they deviate from the stock config file qbit set up on the first run.

[KamilLenica]

Oh there is misunderstanding. Logging out did not change anything. Stopping container fixed the other one.

I could login, to both running but could not perform any action on one that was started as a second one.

Probably some corner case, I wouldn't investigate until it will occur again