bind docker.sock for use in docker containers

[Moorsy-AU]

Hello,
i have a few containers that require the use of - /var/run/docker.sock:/var/run/docker.sock, namely uptime kuma. im trying to monitor the container its self via uptime kuma.

in my config ive added --bind='/var/run/docker.sock:/var/run/docker.sock'. this crashes the jail and fails to restart.

sorry im a newbie to this and have scoured the internet on how to pass this through.

[Lockszmith-GH]

Please read #135 How to ask for help, and bring back as much info as you can.

What version of TrueNAS SCALE are you running?

How did you install the jail?

When you say "I'm trying to monitor... via uptime kuma", is uptime kuma inside the jail or outside it?

Do you even have /var/run/docker.sock on the host?

These are all questions that come to mind immediately, but it's probably not enough to understand, collect as much as you can, this would make it more likely for someone here to be able to assist.

[Moorsy-AU]

Sorry,

Dragonfish 24.04.2.3
Running Docker through sandbox. Dockage as container manager. As per Stux youtube video. Uptime Kuma is a container inside the sandbox. For it to see the other containers and monitor them it needs the follow volume mnt/ - /var/run/docker.sock:/var/run/docker.sock
I assume i need to bind this in the docker config for the containers to see it, i also assumed its part of docker and was already running. i havent read anywhere you need to install or active this

[Lockszmith-GH]

OK, so this looks like you're just confusing some stuff, and that's causing you the issue.

/var/run/docker.sock is a socket (in Linux 'everything is a file'), so while it looks like a file, it's actually an inter-process connection.
This is basically a connection to the docker service daemon and the way the docker command line (as an example) controls the docker daemon.
Dockge does this as well, and so does uptime-kuma.

You do not have a /var/run/docker.sock on the TrueNAS SCALE host (at least not on Dragonfish) and even if you had, not sure it would be wise to link it to the jail anyway.

The --bind=... syntax, comes from the jail config file.
What is the purpose of this? What are the steps you're going through?

So let's back-track, and please explain what you are trying to achieve.
Have you tried without that --bind? and If so, what isn't working for you?

[Lockszmith-GH]

Some visual aid to solidify terminology

flowchart TD
    subgraph host-c["host (TrueNAS SCALE)"]
        direction LR
        fs[/"file-system<br/>(on host)"/]

        subgraph jail[jail]
            direction LR
            d["docker cli"]
            dc([docker-daemon])
            ds@{ shape: h-cyl, label: "fs:<code>/var/run/docker.sock</code>" }

            dk@{ shape: div-rect, label: "Dockge" }
            uk@{ shape: div-rect, label: "Uptime Kuma" }

            d & dk & uk .-o ds --> dc
        end

        jail -->|<code>--bind</code>| fs
    end

Loading

[Moorsy-AU]

version: "3.3"
services:
uptime-kuma:
restart: always
ports:
- 3001:3001
volumes:
- /mnt/app-data/uptime-kuma:/app/data
- /var/run/docker.sock:/var/run/docker.sock
container_name: uptime-kuma
image: louislam/uptime-kuma:1
volumes:
uptime-kuma: {}
networks: {}

This is what the compose.yaml looks like, the docker socket fails as i think i need to bind it.

[Moorsy-AU]

Thanks Lockszmith. I think after doing more research on what you mentioned above i might have a permissions issue with docker.sock.

root@docker:~# ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Oct 31 00:24 /var/run/docker.sock

think i might need to give my containers user rights as they wouldnt have root access ? would i be correct in this train of thinking ?

[Lockszmith-GH]

The docker daemon, by default, runs as root (unless you've intentionally configured it for rootless).
Inside docker containers, the default user is root as well (UID = 0), unless specifically built without root.

So permissions are not likely to be the issue, but I might be missing a piece of the puzzle.

This is uptime-kuma's Dockerfile, specifically the last build phase, in which there is no USER directive, which means it's running as root.

And you compose.yml code above, does not show you're setting a special user, so again, probably running as root.

Let's do this, please dump as a reply to this thread, as much data as you can about your setup:

• The config of your jail
• The compose files or docker run commands of your containers within the jail (at least the ones for dockge, uptime-kuma and one other service you're probably monitoring/running with both dockge and uptime-kuma)
• The commands you use to instantiate the containers
• An explanation of what is the overall design you're aiming for (if you need to 'draw', I can recommend you use https://mermaid.live and paste inside a mermaid code block - see below)

what is a mermaid code block? - click to view an example

```mermaid
%% This is the code for the drawing describing the relationship between the different component on TrueNAS SCALE

flowchart TD
    subgraph host-c["host (TrueNAS SCALE)"]
        direction LR
        fs[/"file-system
(on host)"/]

        subgraph jail[jail]
            direction LR
            d["docker cli"]
            dc([docker-daemon])
            ds@{ shape: h-cyl, label: "fs:/var/run/docker.sock" }

            dk@{ shape: div-rect, label: "Dockge" }
            uk@{ shape: div-rect, label: "Uptime Kuma" }

            d & dk & uk .-o ds --> dc
        end

        jail -->|--bind| fs
    end
```

click to view the rendering of above example

%% This is the code for the drawing describing the relationship between the different component on TrueNAS SCALE

flowchart TD
    subgraph host-c["host (TrueNAS SCALE)"]
        direction LR
        fs[/"file-system<br/>(on host)"/]

        subgraph jail[jail]
            direction LR
            d["docker cli"]
            dc([docker-daemon])
            ds@{ shape: h-cyl, label: "fs:<code>/var/run/docker.sock</code>" }

            dk@{ shape: div-rect, label: "Dockge" }
            uk@{ shape: div-rect, label: "Uptime Kuma" }

            d & dk & uk .-o ds --> dc
        end

        jail -->|<code>--bind</code>| fs
    end

Loading

[Moorsy-AU]

Sorry for late reply, work commitments kept me away from this project.
So i managed to get this to work, was having the same issue with watchtower etc, anything that really needed the docker socket to funtion. This machine was originally setup on scale cobia and has been upgraded until now, recently done a fresh install of dragonfish 24.4 and all issues have disappeared, im assuming it was some sort of permissions error as previously to get smb working i have to give permissions to a user and move away from root user.
I also this time created a bridge network between docker and the host, not sure if that affected the outcome thou.

[Lockszmith-GH]

Glad to learn you have it working. Without grinding against the broken system, we'll never know, only guess.
Don't believe it's the networking, but then - what do I know...
Permissions is a good guess, but how/what - that's hard to determine.

Anyway, enjoy your Dragonfish, I'm almost fully migrated off TrueCharts myself, so very interested to see it in the works.