deconz-community / deconz-docker

MIT License
373 stars 34 forks source link

Permission Denied In Mounted `/opt/config` #263

Closed czhang03 closed 4 weeks ago

czhang03 commented 1 month ago

Here is my docker compose file:

version: "2"
services:
  deconz:
    image: docker.io/deconzcommunity/deconz
    container_name: deconz
    restart: always
    ports:
      - 8080:8080
      - 8443:8443
    volumes:
      - /home/homeconsole/containers/deconz/config:/opt/deCONZ
    devices:
      - /dev/ttyACM0
    environment:
      - DECONZ_WEB_PORT=8080
      - DECONZ_WS_PORT=8443
      - DEBUG_INFO=1
      - DEBUG_APS=0
      - DEBUG_ZCL=0
      - DEBUG_ZDP=0
      - DEBUG_OTA=0

When I run docker-compose up in the dir of the above yml file, I saw a lot of "permission denied" error regarding creating file within the config folder, like the following:

deconz    | mkdir: cannot create directory '/opt/deCONZ/otau': Permission denied
deconz    | chown: cannot dereference '/home/deconz/otau': No such file or directory
deconz    | chown: cannot read directory '/opt/deCONZ': Permission denied

The config folder is indeed always empty, and the setting will not persist after restart.

Here is the permission of /opt/deCONZ within the container:

root@b65ae0a40df3:~# ls -l /opt/      
total 0
drwxr-xr-x. 1 root root 0 Aug  7 13:26 deCONZ

root@b65ae0a40df3:~# ls -l /opt/deCONZ/
ls: cannot open directory '/opt/deCONZ/': Permission denied

Here is the permission of /home/homeconsole/containers/deconz/config on the host machine:

bash-5.2$ ls -l /home/homeconsole/containers/deconz/
total 4
drwxr-x---. 1 homeconsole homeconsole   0 Aug  7 16:45 config
-rw-r-----. 1 homeconsole homeconsole 456 Aug  7 21:26 docker-compose.yml

And the group and id of my current user:

bash-5.2$ id $USER
uid=1000(homeconsole) gid=1000(homeconsole) groups=1000(homeconsole),10(wheel)

I am running on fedora silverblue.

czhang03 commented 1 month ago

As with all weird permission error, this is caused by selinux. The fix is to add :Z flag to the volume binding:

    volumes:
      - /home/homeconsole/containers/deconz/config:/opt/deCONZ:Z

More info on debugging permission issues: