Running 2.26.0 with external volume gives error using rest

[Daafip]

Hi all,

We've been using the oscarfonts/geoserver:xx.xx.x for a while now when deploy the LIWO project.
When upgrading to a newer version, we noticed the rest API stopped working.
In 2.23.6 this wasn't an issue, when testing with 2.26.0 this issue arose.
We debugged it a little, in the 2.26 the rest API (http://localhost:8080/geoserver/rest/) does work if I specify a volume inside the docker.
When I use an external volume, it no longer works.
If I use the docker.osgeo.org/geoserver:2.26.0 with an external volume, it does work.
I traced it to the initial start-up, on the first run it doesn't work, on the second it does.
Digging a little deeper its due to the security.propertiesfile, which is almost empty, but if I do add this to the file, it runs fine.
Is this due to the security layer you add? Would you know of a way to solve this?
I found a work around which works for us, but would be nice if it works out of the box.

services:
  # .... (other dockers)
  geoserver:
    image: "oscarfonts/geoserver:2.26.0"
    volumes:
      - ./geoserver/data:/var/local/geoserverer
    environment:
      - CATALINA_OPTS=-server -Dorg.geoserver.wfs.getfeature.cachelimit=5000 -Xms8192M -Xmx8192M -Djava.awt.headless=true -Xss4M -XX:SoftRefLRUPolicyMSPerMB=36000 -XX:+UseG1GC -XX:+UseStringDeduplication -XX:NewSize=48M -DGEOSERVER_DATA_DIR=/var/local/geoserver
    ports:
      - "8080:8080"

[Daafip]

The error I get when not being able to run it is :

HTTP Status 500 – Internal Server Error
Type Exception Report

Message Cannot invoke "java.util.Collection.iterator()" because "attributes" is null

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception

java.lang.NullPointerException: Cannot invoke "java.util.Collection.iterator()" because "attributes" is null
	org.geoserver.security.filter.GeoServerSecurityInterceptorFilter$AuthenticatedAuthorizationManager.vote(GeoServerSecurityInterceptorFilter.java:83)
	org.geoserver.security.filter.GeoServerSecurityInterceptorFilter$AuthenticatedAuthorizationManager.check(GeoServerSecurityInterceptorFilter.java:113)
	org.geoserver.security.filter.GeoServerSecurityInterceptorFilter$AuthenticatedAuthorizationManager.check(GeoServerSecurityInterceptorFilter.java:46)
	org.geoserver.security.filter.GeoServerSecurityInterceptorFilter$AffirmativeAuthorizationManager.check(GeoServerSecurityInterceptorFilter.java:198)
	org.geoserver.security.filter.GeoServerSecurityInterceptorFilter$AffirmativeAuthorizationManager.check(GeoServerSecurityInterceptorFilter.java:173)
	org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:95)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
	org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
	org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126)
	org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
	org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
	org.geoserver.security.filter.GeoServerAnonymousAuthenticationFilter.doFilter(GeoServerAnonymousAuthenticationFilter.java:53)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
	org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:200)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
	org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
	org.geoserver.security.filter.GeoServerBasicAuthenticationFilter.doFilter(GeoServerBasicAuthenticationFilter.java:81)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:71)
	org.geoserver.security.filter.GeoServerSecurityContextPersistenceFilter$1.doFilterInternal(GeoServerSecurityContextPersistenceFilter.java:74)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
	org.geoserver.security.filter.GeoServerCompositeFilter$NestedFilterChain.doFilter(GeoServerCompositeFilter.java:75)
	org.geoserver.security.filter.GeoServerCompositeFilter.doFilter(GeoServerCompositeFilter.java:92)
	org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
	org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:225)
	org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:190)
	org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter(GeoServerSecurityFilterChainProxy.java:141)
	org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:354)
	org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:267)
	org.geoserver.filters.XFrameOptionsFilter.doFilter(XFrameOptionsFilter.java:116)
	org.geoserver.filters.GZIPFilter.doFilter(GZIPFilter.java:48)
	org.geoserver.filters.SessionDebugFilter.doFilter(SessionDebugFilter.java:49)
	org.geoserver.filters.FlushSafeFilter.doFilter(FlushSafeFilter.java:42)
	org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
	org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:117)
Note The full stack trace of the root cause is available in the server logs.

Apache Tomcat/9.0.95