Gluetun on Fedora CoreOS - ERROR reading servers from file: open /gluetun/servers.json: permission denied #2137

Sc0ttmeup · 2024-03-04T02:54:28Z

Sc0ttmeup
Mar 4, 2024

On Fedora CoreOS Gluetun from docker compose is giving an error
ERROR reading servers from file: open /gluetun/servers.json: permission denied

Most of the FCoreOS file system is read-only. Writing is enabled on /var

The compose.yaml file is modified from the supplied template. Binded mount is:

    volumes:
      - /var/docker/gluetun:/gluetun

Full log:

[core@CoreOS gluetun]$ docker-compose up
[+] Running 1/0
 ✔ Container gluetun  Created                                                                                                                     0.0s
Attaching to gluetun
gluetun  | ========================================
gluetun  | ========================================
gluetun  | =============== gluetun ================
gluetun  | ========================================
gluetun  | =========== Made with ❤️ by ============
gluetun  | ======= https://github.com/qdm12 =======
gluetun  | ========================================
gluetun  | ========================================
gluetun  |
gluetun  | Running version latest built on 2024-02-21T17:01:05.694Z (commit a20695f)
gluetun  |
gluetun  | 🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
gluetun  | 🐛 Bug? https://github.com/qdm12/gluetun/issues/new
gluetun  | ✨ New feature? https://github.com/qdm12/gluetun/issues/new
gluetun  | ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
gluetun  | 💻 Email? [email protected]
gluetun  | 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
gluetun  | 2024-03-04T12:56:35+11:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
gluetun  | 2024-03-04T12:56:35+11:00 INFO [routing] local ethernet link found: eth0
gluetun  | 2024-03-04T12:56:35+11:00 INFO [routing] local ipnet found: 172.18.0.0/16
gluetun  | 2024-03-04T12:56:35+11:00 INFO [firewall] enabling...
gluetun  | 2024-03-04T12:56:35+11:00 INFO [firewall] enabled successfully
gluetun  | 2024-03-04T12:56:36+11:00 ERROR reading servers from file: open /gluetun/servers.json: permission denied
gluetun  | 2024-03-04T12:56:36+11:00 INFO Shutdown successful
gluetun exited with code 1

compose.yaml

version: "3"
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    # line above must be uncommented to allow external containers to connect.
    # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/connect-a-container-to-gluetun.md#external-container-to-gluetun
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - 8000:8000/tcp # control-server
      - 8888:8888/tcp # HTTP proxy
      - 8388:8388/tcp # Shadowsocks
      - 8388:8388/udp # Shadowsocks
    volumes:
      # must be writable on the host system
      - /var/docker/gluetun:/gluetun
    environment:
      # See https://github.com/qdm12/gluetun-wiki/tree/main/setup#setup
      - VPN_SERVICE_PROVIDER=private internet access
      - VPN_TYPE=openvpn
      # OpenVPN:
      - OPENVPN_USER=foo
      - OPENVPN_PASSWORD=bar
      # Wireguard:
      # - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU=
      # - WIREGUARD_ADDRESSES=10.64.222.21/32
      # Timezone for accurate log times
      # https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
      - TZ=Australia/Melbourne
      # Server list updater
      # See https://github.com/qdm12/gluetun-wiki/blob/main/setup/servers.md#update-the-vpn-servers-list
      - UPDATER_PERIOD=6h
      - UPDATER_MIN_RATIO=0.75
      # Region
      - SERVER_REGIONS=AU Melbourne,AU Sydney
      # Port Forwarding - does not work with USA SERVER_REGIONS
      - VPN_PORT_FORWARDING=on

This is the journal output:

Mar 04 05:37:02 CoreOS NetworkManager[652]: <info>  [1709530622.0360] manager: (veth48ee6c2): new Veth device (/org/freedesktop/NetworkManager/Devices/51)
Mar 04 05:37:02 CoreOS NetworkManager[652]: <info>  [1709530622.0438] manager: (veth5b977ec): new Veth device (/org/freedesktop/NetworkManager/Devices/52)
Mar 04 05:37:02 CoreOS audit: ANOM_PROMISCUOUS dev=veth5b977ec prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295
Mar 04 05:37:02 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered blocking state
Mar 04 05:37:02 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered disabled state
Mar 04 05:37:02 CoreOS kernel: device veth5b977ec entered promiscuous mode
Mar 04 05:37:02 CoreOS kernel: audit: type=1700 audit(1709530622.044:2752): dev=veth5b977ec prom=256 old_prom=0 auid=4294967295 uid=0 gid=0 ses=4294967295
Mar 04 05:37:02 CoreOS systemd-udevd[578540]: ethtool: autonegotiation is unset or enabled, the speed and duplex are not writable.
Mar 04 05:37:02 CoreOS systemd-udevd[578540]: Using default interface naming scheme 'v245'.
Mar 04 05:37:02 CoreOS systemd-udevd[578541]: ethtool: autonegotiation is unset or enabled, the speed and duplex are not writable.
Mar 04 05:37:02 CoreOS systemd-udevd[578541]: Using default interface naming scheme 'v245'.
Mar 04 05:37:02 CoreOS audit[578545]: NETFILTER_CFG table=nat family=2 entries=13 op=replace pid=578545 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.087:2753): table=nat family=2 entries=13 op=replace pid=578545 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578547]: NETFILTER_CFG table=filter family=2 entries=29 op=replace pid=578547 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.098:2754): table=filter family=2 entries=29 op=replace pid=578547 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578549]: NETFILTER_CFG table=nat family=2 entries=14 op=replace pid=578549 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.109:2755): table=nat family=2 entries=14 op=replace pid=578549 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578556]: NETFILTER_CFG table=nat family=2 entries=15 op=replace pid=578556 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.137:2756): table=nat family=2 entries=15 op=replace pid=578556 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578558]: NETFILTER_CFG table=filter family=2 entries=30 op=replace pid=578558 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.155:2757): table=filter family=2 entries=30 op=replace pid=578558 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578561]: NETFILTER_CFG table=nat family=2 entries=16 op=replace pid=578561 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.174:2758): table=nat family=2 entries=16 op=replace pid=578561 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578569]: NETFILTER_CFG table=nat family=2 entries=17 op=replace pid=578569 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.186:2759): table=nat family=2 entries=17 op=replace pid=578569 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578571]: NETFILTER_CFG table=filter family=2 entries=31 op=replace pid=578571 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.191:2760): table=filter family=2 entries=31 op=replace pid=578571 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578573]: NETFILTER_CFG table=nat family=2 entries=18 op=replace pid=578573 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: audit: type=1325 audit(1709530622.198:2761): table=nat family=2 entries=18 op=replace pid=578573 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578581]: NETFILTER_CFG table=nat family=2 entries=19 op=replace pid=578581 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578583]: NETFILTER_CFG table=filter family=2 entries=32 op=replace pid=578583 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578585]: NETFILTER_CFG table=nat family=2 entries=20 op=replace pid=578585 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS dockerd[70657]: time="2024-03-04T05:37:02.307183544Z" level=info msg="shim containerd-shim started" address=/containerd-shim/24092cb9f970f2b88bb280eddd4c57b199ff20057d7e37ac72de99bc0655be5e.sock debug=false pid=578592
Mar 04 05:37:02 CoreOS systemd[1]: Started libcontainer container 1dbb2809fbc487a6695b227724fb4788fe3d1ff0efeee099f279f16676cdb760.
Mar 04 05:37:02 CoreOS audit: BPF prog-id=180 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=181 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=190 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=191 op=LOAD
Mar 04 05:37:02 CoreOS systemd[3118]: run-docker-runtime\x2drunc-moby-1dbb2809fbc487a6695b227724fb4788fe3d1ff0efeee099f279f16676cdb760-runc.mSoNKF.mount: Succeeded.
Mar 04 05:37:02 CoreOS audit: BPF prog-id=182 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=183 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=192 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=193 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=184 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=185 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=194 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=195 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=186 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=187 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=196 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=197 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=188 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=189 op=UNLOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=198 op=LOAD
Mar 04 05:37:02 CoreOS audit: BPF prog-id=199 op=LOAD
Mar 04 05:37:02 CoreOS kernel: SELinux: mount invalid.  Same superblock, different security settings for (dev mqueue, type mqueue)
Mar 04 05:37:02 CoreOS audit[578629]: NETFILTER_CFG table=nat family=2 entries=0 op=register pid=578629 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578630]: NETFILTER_CFG table=filter family=2 entries=0 op=register pid=578630 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578633]: NETFILTER_CFG table=nat family=2 entries=5 op=replace pid=578633 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578634]: NETFILTER_CFG table=nat family=2 entries=7 op=replace pid=578634 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578636]: NETFILTER_CFG table=nat family=2 entries=8 op=replace pid=578636 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578637]: NETFILTER_CFG table=nat family=2 entries=10 op=replace pid=578637 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578638]: NETFILTER_CFG table=nat family=2 entries=11 op=replace pid=578638 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578639]: NETFILTER_CFG table=nat family=2 entries=12 op=replace pid=578639 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578640]: NETFILTER_CFG table=nat family=2 entries=13 op=replace pid=578640 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS audit[578641]: NETFILTER_CFG table=nat family=2 entries=14 op=replace pid=578641 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:02 CoreOS kernel: eth0: renamed from veth48ee6c2
Mar 04 05:37:02 CoreOS kernel: IPv6: ADDRCONF(NETDEV_CHANGE): veth5b977ec: link becomes ready
Mar 04 05:37:02 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered blocking state
Mar 04 05:37:02 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered forwarding state
Mar 04 05:37:02 CoreOS NetworkManager[652]: <info>  [1709530622.9187] device (veth5b977ec): carrier: link connected
Mar 04 05:37:02 CoreOS NetworkManager[652]: <info>  [1709530622.9253] device (br-9d524761aa6d): carrier: link connected
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ========================================
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ========================================
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: =============== gluetun ================
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ========================================
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: =========== Made with ❤️ by ============
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ======= https://github.com/qdm12 =======
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ========================================
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ========================================
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]:
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: Running version latest built on 2024-02-21T17:01:05.694Z (commit a20695f)
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]:
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 🔧 Need help? https://github.com/qdm12/gluetun/discussions/new
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 🐛 Bug? https://github.com/qdm12/gluetun/issues/new
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ✨ New feature? https://github.com/qdm12/gluetun/issues/new
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: ☕ Discussion? https://github.com/qdm12/gluetun/discussions/new
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 💻 Email? [email protected]
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 💰 Help me? https://www.paypal.me/qmcgaw https://github.com/sponsors/qdm12
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO [routing] default route found: interface eth0, gateway 172.18.0.1, assigned IP 172.18.0.2 and family v4
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO [routing] local ethernet link found: eth0
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO [routing] local ipnet found: 172.18.0.0/16
Mar 04 05:37:03 CoreOS audit[578656]: NETFILTER_CFG table=filter family=2 entries=4 op=replace pid=578656 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578657]: NETFILTER_CFG table=filter family=2 entries=5 op=replace pid=578657 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578660]: NETFILTER_CFG table=filter family=2 entries=4 op=replace pid=578660 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578663]: AVC avc:  denied  { module_request } for  pid=578663 comm="ip6tables-nft" kmod="nfnetlink-subsys-10" scontext=system_u:system_r:container_t:s0:c289,c378 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO [firewall] enabling...
Mar 04 05:37:03 CoreOS audit[578664]: NETFILTER_CFG table=filter family=2 entries=4 op=replace pid=578664 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578665]: NETFILTER_CFG table=filter family=2 entries=4 op=replace pid=578665 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578666]: NETFILTER_CFG table=filter family=2 entries=4 op=replace pid=578666 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578667]: NETFILTER_CFG table=filter family=2 entries=4 op=replace pid=578667 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578668]: NETFILTER_CFG table=filter family=2 entries=5 op=replace pid=578668 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578669]: NETFILTER_CFG table=filter family=2 entries=6 op=replace pid=578669 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578670]: NETFILTER_CFG table=filter family=2 entries=7 op=replace pid=578670 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578671]: NETFILTER_CFG table=filter family=2 entries=8 op=replace pid=578671 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578672]: NETFILTER_CFG table=filter family=2 entries=9 op=replace pid=578672 subj=system_u:system_r:container_t:s0:c289,c378 comm="iptables"
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO [firewall] enabled successfully
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO [storage] creating /gluetun/servers.json with 17820 hardcoded servers
Mar 04 05:37:03 CoreOS audit[578608]: AVC avc:  denied  { write } for  pid=578608 comm="gluetun-entrypo" name="gluetun" dev="sda4" ino=8389218 scontext=system_u:system_r:container_t:s0:c289,c378 tcontext=system_u:object_r:var_t:s0 tclass=dir permissive=0
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 ERROR writing servers to file: open /gluetun/servers.json: permission denied
Mar 04 05:37:03 CoreOS 1dbb2809fbc4[70652]: 2024-03-04T16:37:03+11:00 INFO Shutdown successful
Mar 04 05:37:03 CoreOS systemd[1]: docker-1dbb2809fbc487a6695b227724fb4788fe3d1ff0efeee099f279f16676cdb760.scope: Succeeded.
Mar 04 05:37:03 CoreOS dockerd[70657]: time="2024-03-04T05:37:03.865978541Z" level=info msg="shim reaped" id=1dbb2809fbc487a6695b227724fb4788fe3d1ff0efeee099f279f16676cdb760
Mar 04 05:37:03 CoreOS dockerd[70652]: time="2024-03-04T05:37:03.878166002Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete type="*events.TaskDelete"
Mar 04 05:37:03 CoreOS audit[578687]: NETFILTER_CFG table=nat family=2 entries=21 op=replace pid=578687 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578689]: NETFILTER_CFG table=filter family=2 entries=33 op=replace pid=578689 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578691]: NETFILTER_CFG table=nat family=2 entries=20 op=replace pid=578691 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578693]: NETFILTER_CFG table=nat family=2 entries=19 op=replace pid=578693 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578695]: NETFILTER_CFG table=filter family=2 entries=32 op=replace pid=578695 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578697]: NETFILTER_CFG table=nat family=2 entries=18 op=replace pid=578697 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578699]: NETFILTER_CFG table=nat family=2 entries=17 op=replace pid=578699 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578701]: NETFILTER_CFG table=filter family=2 entries=31 op=replace pid=578701 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578703]: NETFILTER_CFG table=nat family=2 entries=16 op=replace pid=578703 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578705]: NETFILTER_CFG table=nat family=2 entries=15 op=replace pid=578705 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578707]: NETFILTER_CFG table=filter family=2 entries=30 op=replace pid=578707 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS audit[578709]: NETFILTER_CFG table=nat family=2 entries=14 op=replace pid=578709 subj=system_u:system_r:iptables_t:s0 comm="iptables"
Mar 04 05:37:03 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered disabled state
Mar 04 05:37:03 CoreOS kernel: veth48ee6c2: renamed from eth0
Mar 04 05:37:03 CoreOS NetworkManager[652]: <info>  [1709530623.9741] manager: (veth48ee6c2): new Veth device (/org/freedesktop/NetworkManager/Devices/53)
Mar 04 05:37:03 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered disabled state
Mar 04 05:37:03 CoreOS audit: ANOM_PROMISCUOUS dev=veth5b977ec prom=0 old_prom=256 auid=4294967295 uid=0 gid=0 ses=4294967295
Mar 04 05:37:03 CoreOS kernel: device veth5b977ec left promiscuous mode
Mar 04 05:37:03 CoreOS kernel: br-9d524761aa6d: port 1(veth5b977ec) entered disabled state
Mar 04 05:37:03 CoreOS systemd-udevd[578540]: veth48ee6c2: Failed to get link config: No such device
Mar 04 05:37:04 CoreOS systemd[1]: run-docker-netns-eb1ff9715a0e.mount: Succeeded.
Mar 04 05:37:04 CoreOS audit[522672]: NETFILTER_CFG table=filter family=2 entries=10 op=unregister pid=522672 subj=system_u:system_r:kernel_t:s0 comm="kworker/u2:1"
Mar 04 05:37:04 CoreOS audit[522672]: NETFILTER_CFG table=nat family=2 entries=15 op=unregister pid=522672 subj=system_u:system_r:kernel_t:s0 comm="kworker/u2:1"
Mar 04 05:37:04 CoreOS systemd[3118]: run-docker-netns-eb1ff9715a0e.mount: Succeeded.
Mar 04 05:37:04 CoreOS systemd[1]: var-lib-docker-overlay2-ebff138edf82cd19d53201edb69cbe6c2c9ec7e84310509b008b1905e658c428-merged.mount: Succeeded.
Mar 04 05:37:04 CoreOS systemd[3118]: var-lib-docker-overlay2-ebff138edf82cd19d53201edb69cbe6c2c9ec7e84310509b008b1905e658c428-merged.mount: Succeeded.
Mar 04 05:37:04 CoreOS NetworkManager[652]: <info>  [1709530624.0427] device (veth5b977ec): released from master device br-9d524761aa6d

Permissions of directories:

/var/docker

[core@CoreOS var]$ pwd
/var
[core@CoreOS var]$ ls -la | grep docker
drwxrwxrwx.  4 root root   36 Mar  4 01:30 docker
[core@CoreOS var]$

/var/docker/gluetun

[core@CoreOS docker]$ pwd
/var/docker
[core@CoreOS docker]$ ls -la | grep gluetun
drwxrwxrwx.  2 core core   26 Mar  4 01:35 gluetun
[core@CoreOS docker]$

I have manually created a file in the directory to confirm it is writable:

[core@CoreOS gluetun]$ pwd
/var/docker/gluetun
[core@CoreOS gluetun]$ touch servers.json
[core@CoreOS gluetun]$ chmod 777 servers.json
[core@CoreOS gluetun]$ ls -la | grep servers.json
-rwxrwxrwx. 1 core core  0 Mar  4 02:06 servers.json

Running sudo docker-compose up still results in the error listed above.

Sc0ttmeup · 2024-03-05T11:25:37Z

Sc0ttmeup
Mar 5, 2024
Author

For anyone else with this issue, in this case it turned out to be a problem related to SELinux.

There are 2 ways I've seen of resolving this:

The proper way: update the SELiunx policy. audit2allow is one tool that can help with this. When I have time I'll try to learn a bit more and implement it.
The quick, easy, and not super secure way: add the line privileged: true to the docker compose file

0 replies

vdrover · 2024-06-18T12:24:29Z

vdrover
Jun 18, 2024

I had a similar error: ERROR reading servers from file: decoding servers: invalid character '\x00' in string literal.

I tried many fixes. In the end, I stopped docker, deleted the gluetun folder, pulled the gluetun image again, and restarted docker. Seems to work fine now. Seems like something was corruped, or there was a permissions issue.

0 replies

vdrover · 2024-06-18T12:31:56Z

vdrover
Jun 18, 2024

I just confirmed that my OLD gluetun folder had the servers.json file switched from my owner to root. So permissions are likely the issue.

1 reply

qdm12 Jul 31, 2024
Maintainer

Hi there, thanks for reporting you had the issue as well.
So I suppose the issue is the Docker healthcheck runs not as root, unlike the main program of Gluetun, and so it fails reading the gluetun/servers.json file? 🤔
It's kind of odd it's giving the error invalid character '\x00' in string literal and not a permission error though.
Is there a way you can reliably reproduce this bug??

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Gluetun on Fedora CoreOS - ERROR reading servers from file: open /gluetun/servers.json: permission denied #2137

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 1 reply

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Gluetun on Fedora CoreOS - ERROR reading servers from file: open /gluetun/servers.json: permission denied #2137

Sc0ttmeup Mar 4, 2024

Replies: 3 comments · 1 reply

Sc0ttmeup Mar 5, 2024 Author

vdrover Jun 18, 2024

vdrover Jun 18, 2024

qdm12 Jul 31, 2024 Maintainer

Sc0ttmeup
Mar 4, 2024

Replies: 3 comments 1 reply

Sc0ttmeup
Mar 5, 2024
Author

vdrover
Jun 18, 2024

vdrover
Jun 18, 2024

qdm12 Jul 31, 2024
Maintainer