koush / scrypted

Scrypted is a high performance video integration and automation platform
https://scrypted.app
Other
3.9k stars 237 forks source link

Add security_opt to allow the container to talk to host avahi daemon #1487

Closed jonathanyip closed 1 month ago

jonathanyip commented 1 month ago

While running the Avahi daemon on the host and scrypted in a docker container, I noticed that the homekit plugin would fail with the following exception:

Screenshot 2024-05-27 at 11 20 18 PM

Debugging the homebridge lib, I found out that it was caused by this error:

'An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)'

I found this snippet in the homebridge docs (https://github.com/homebridge/homebridge/wiki/mDNS-Options#avahi-linux-and-docker)

Unless you've disabled AppArmor on your Linux distro, or it's disabled by default, you'll also need to set a security_opt setting of apparmor:unconfined, otherwise AppArmor will block the container's attempt to talk to Avahi via dbus

After adding those lines to my own docker-compose file and restarting, it seemed to work.

This PR adds those lines to the docker-compose.yml and installation script, when the user wants to use host avahi

koush commented 1 month ago

Thanks for the find. Honestly this should likely be the default. I had to remove avahi as the default option recently, because it was failing for a lot of people. I suspect this was the issue: it was mounted correctly but communicating with the socket was not allowed.