Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fedora: Improve Docker build environment compatibility #3737

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

strugee
Copy link
Sponsor Contributor

@strugee strugee commented Sep 18, 2023

The problem is that in SELinux enforcing distributions, access to docker.sock is restricted in containers even if DAC permissions supposedly allow access. This causes endless log lines when invoking docker-compose up similar to the following:

time="2023-09-18T04:10:56Z" level=error msg="Failed to retrieve information of the docker client and server host: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get \"http://%2Fvar%2Frun%2Fdocker.sock/v1.24/version\": dial unix /var/run/docker.sock: connect: permission denied" providerName=docker

The solution is to run the Traefik container in privileged mode. See https://stackoverflow.com/a/30368817/1198896.

Acceptance Criteria:

(I'm just checking boxes here for CI purposes even though almost all of these are N/A since this is a dev environment change.)

  • Features and enhancements must be fully implemented so that they can be released at any time without additional work
  • Automated unit and/or acceptance tests are mandatory to ensure the changes work as expected and to reduce repetitive manual work
  • Frontend components must be responsive to work and look properly on phones, tablets, and desktop computers; you must have tested them on all major browsers and different devices
  • Documentation and translation updates should be provided if needed
  • In case you submit database-related changes, they must be tested and compatible with SQLite 3 and MariaDB 10.5.12+

The problem is that in SELinux enforcing distributions, access to
`docker.sock` is restricted in containers even if DAC permissions
supposedly allow access. This causes endless log lines when invoking
`docker-compose up` similar to the following:

    time="2023-09-18T04:10:56Z" level=error msg="Failed to retrieve information of the docker client and server host: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get \"http://%2Fvar%2Frun%2Fdocker.sock/v1.24/version\": dial unix /var/run/docker.sock: connect: permission denied" providerName=docker

The solution is to run the Traefik container in privileged mode. See
 https://stackoverflow.com/a/30368817/1198896.
Before this patch running `ls` inside the `photoprism_1` container
returned EACCES.
@strugee strugee changed the title Fix dev environment Traefik crashes on Fedora Fix dev environment permission problems on Fedora Sep 18, 2023
@strugee
Copy link
Sponsor Contributor Author

strugee commented Sep 18, 2023

I've just pushed an additional patch since I encountered more SELinux problems. We now run the main container in privileged mode too, to work around similar problems.

@lastzero
Copy link
Member

Are you actually running Docker on Fedora or Podman, which is more common on Red Hat-based distributions? I know Podman often requires more permissions, especially if you use ports < 1024.

@strugee
Copy link
Sponsor Contributor Author

strugee commented Sep 18, 2023

I started running rootless Podman. However I ran into lots of issues with that (port 80 being privileged was one, but the biggest was that there is no docker.sock for Traefik) so I decided to see if I could get a dev environment setup working with Docker and then circle back to making Podman work.

The bug fixed here happened with Docker running fully outside a Toolbox/Podman container.

@lastzero lastzero changed the title Fix dev environment permission problems on Fedora Fedora: Improve Docker build environment compatibility Sep 21, 2023
@lastzero lastzero added the docker Docker Images, Build Scripts, Config & Deployment Examples label Sep 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docker Docker Images, Build Scripts, Config & Deployment Examples
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants