#298 netbox container PermissionError: [Errno 13] Permission denied: '/etc/netbox/config/'

[jkldgoefgkljefogeg]

#298

Ubuntu 20.04.2 LTS, no SELinux

netbox_1         |     _loaded_configurations = read_configurations(
netbox_1         |   File "/opt/netbox/netbox/netbox/configuration.py", line 37, in read_configurations
netbox_1         |     with scandir(config_dir) as it:
netbox_1         | PermissionError: [Errno 13] Permission denied: '/etc/netbox/config/'

this happens on a fresh install

Does this look correct? I tried deleting all volumes but this is still failing on newly created volumes

$ docker exec -it netbox-docker_netbox_1 id
uid=101 gid=0(root)

$ docker exec -it netbox-docker_netbox_1 cat /etc/passwd
root:x:0:0:root:/root:/bin/ash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/mail:/sbin/nologin
news:x:9:13:news:/usr/lib/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucppublic:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
man:x:13:15:man:/usr/man:/sbin/nologin
postmaster:x:14:12:postmaster:/var/mail:/sbin/nologin
cron:x:16:16:cron:/var/spool/cron:/sbin/nologin
ftp:x:21:21::/var/lib/ftp:/sbin/nologin
sshd:x:22:22:sshd:/dev/null:/sbin/nologin
at:x:25:25:at:/var/spool/cron/atjobs:/sbin/nologin
squid:x:31:31:Squid:/var/cache/squid:/sbin/nologin
xfs:x:33:33:X Font Server:/etc/X11/fs:/sbin/nologin
games:x:35:35:games:/usr/games:/sbin/nologin
cyrus:x:85:12::/usr/cyrus:/sbin/nologin
vpopmail:x:89:89::/var/vpopmail:/sbin/nologin
ntp:x:123:123:NTP:/var/empty:/sbin/nologin
smmsp:x:209:209:smmsp:/var/spool/mqueue:/sbin/nologin
guest:x:405:100:guest:/dev/null:/sbin/nologin
nobody:x:65534:65534:nobody:/:/sbin/nologin
unit:x:100:101:NGINX Unit:/var/lib/unit:/sbin/nologin

$ docker exec -it netbox-docker_netbox_1 ls -l /etc/ | grep netbox
drwxr-xr-x    1 root     root          4096 Feb 22 07:29 netbox

$ docker exec -it netbox-docker_netbox_1 ls -l /etc/netbox
total 12
drwx------    3 1000     1000          4096 Feb 22 06:53 config
drwx------    2 1000     1000          4096 May 17  2020 reports
drwx------    2 1000     1000          4096 May 17  2020 scripts

$ docker exec -it netbox-docker_netbox_1 ls -l /etc/netbox/config
ls: can't open '/etc/netbox/config': Permission denied
total 0

I wonder if this is related to apparmor/selinux, related report https://www.linuxquestions.org/questions/linux-containers-122/netbox-docker-container-errors-with-selinux-4175649916/

$ sudo aa-status 
11 processes are in enforce mode.
   /usr/sbin/mysqld (691536) 
   /usr/sbin/ntpd (695525) 
   /usr/local/bin/postgres (858734) docker-default
   /usr/local/bin/redis-server (858785) docker-default
   /usr/local/bin/redis-server (858795) docker-default
   /usr/local/bin/postgres (859024) docker-default
   /usr/local/bin/postgres (859025) docker-default
   /usr/local/bin/postgres (859026) docker-default
   /usr/local/bin/postgres (859027) docker-default
   /usr/local/bin/postgres (859028) docker-default
   /usr/local/bin/postgres (859029) docker-default

/etc/netbox/config is tagged with z label
https://github.com/netbox-community/netbox-docker/blob/release/docker-compose.yml#L15

https://docs.docker.com/storage/bind-mounts/#configure-the-selinux-label

If I comment out user: '101' (running as root), Initialisation can finish but startup would still fail because configuration.py is updated with 600 owned by UID 1000.

$ docker-compose logs netbox
Attaching to netbox-docker_netbox_1
netbox_1         | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox_1         | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox_1         | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox_1         | Operations to perform:
netbox_1         |   Apply all migrations: admin, auth, circuits, contenttypes, dcim, extras, ipam, secrets, sessions, taggit, tenancy, users, virtualization
netbox_1         | Running migrations:
netbox_1         |   Applying auth.0012_alter_user_first_name_max_length... OK
netbox_1         |   Applying virtualization.0015_vminterface... OK
netbox_1         |   Applying ipam.0037_ipaddress_assignment... OK
netbox_1         |   Applying virtualization.0016_replicate_interfaces...
netbox_1         |     Replicating 0 VM interfaces...
netbox_1         |     Replicating assigned objects...
netbox_1         |  OK
netbox_1         |   Applying dcim.0106_role_default_color... OK
netbox_1         |   Applying dcim.0107_component_labels... OK
netbox_1         |   Applying dcim.0108_add_tags... OK
netbox_1         |   Applying dcim.0109_interface_remove_vm... OK
netbox_1         |   Applying dcim.0110_virtualchassis_name... OK
netbox_1         |   Applying dcim.0111_component_template_description... OK
netbox_1         |   Applying dcim.0112_standardize_components... OK
netbox_1         |   Applying dcim.0113_nullbooleanfield_to_booleanfield... OK
netbox_1         |   Applying dcim.0114_update_jsonfield... OK
netbox_1         |   Applying dcim.0115_rackreservation_order... OK
netbox_1         |   Applying dcim.0116_rearport_max_positions... OK
netbox_1         |   Applying dcim.0117_custom_field_data... OK
netbox_1         |   Applying dcim.0118_inventoryitem_mptt... OK
netbox_1         |   Applying dcim.0119_inventoryitem_mptt_rebuild... OK
netbox_1         |   Applying dcim.0120_cache_cable_peer...
netbox_1         |     Updating console port cable peers...
netbox_1         |     Updating console server port cable peers...
netbox_1         |     Updating power port cable peers...
netbox_1         |     Updating power outlet cable peers...
netbox_1         |     Updating interface cable peers...
netbox_1         |     Updating front port cable peers...
netbox_1         |     Updating rear port cable peers...
netbox_1         |     Updating power feed cable peers...
netbox_1         |  OK
netbox_1         |   Applying dcim.0121_cablepath... OK
netbox_1         |   Applying circuits.0019_nullbooleanfield_to_booleanfield... OK
netbox_1         |   Applying circuits.0020_custom_field_data... OK
netbox_1         |   Applying circuits.0021_cache_cable_peer...
netbox_1         |     Updating circuit termination cable peers...
netbox_1         |  OK
netbox_1         |   Applying circuits.0022_cablepath... OK
netbox_1         |   Applying circuits.0023_circuittermination_port_speed_optional... OK
netbox_1         |   Applying circuits.0024_standardize_name_length... OK
netbox_1         |   Applying dcim.0122_standardize_name_length... OK
netbox_1         |   Applying virtualization.0017_update_jsonfield... OK
netbox_1         |   Applying virtualization.0018_custom_field_data... OK
netbox_1         |   Applying tenancy.0010_custom_field_data... OK
netbox_1         |   Applying users.0007_proxy_group_user... OK
netbox_1         |   Applying users.0008_objectpermission... OK
netbox_1         |   Applying users.0009_replicate_permissions... OK
netbox_1         |   Applying secrets.0009_secretrole_drop_users_groups... OK
netbox_1         |   Applying secrets.0010_custom_field_data... OK
netbox_1         |   Applying ipam.0038_custom_field_data... OK
netbox_1         |   Applying extras.0043_report... OK
netbox_1         |   Applying extras.0044_jobresult... OK
netbox_1         |   Applying extras.0045_configcontext_changelog... OK
netbox_1         |   Applying extras.0046_update_jsonfield... OK
netbox_1         |   Applying extras.0047_tag_ordering... OK
netbox_1         |   Applying extras.0048_exporttemplate_remove_template_language... OK
netbox_1         |   Applying extras.0049_remove_graph... OK
netbox_1         |   Applying extras.0050_customfield_changes... OK
netbox_1         |   Applying extras.0051_migrate_customfields... OK
netbox_1         |   Applying extras.0052_customfield_cleanup... OK
netbox_1         |   Applying extras.0053_rename_webhook_obj_type... OK
netbox_1         |   Applying tenancy.0011_standardize_name_length... OK
netbox_1         |   Applying ipam.0039_service_ports_array... OK
netbox_1         |   Applying ipam.0040_service_drop_port... OK
netbox_1         |   Applying ipam.0041_routetarget... OK
netbox_1         |   Applying ipam.0042_standardize_name_length... OK
netbox_1         |   Applying ipam.0043_add_tenancy_to_aggregates... OK
netbox_1         |   Applying secrets.0011_secret_generic_assignments... OK
netbox_1         |   Applying secrets.0012_standardize_name_length... OK
netbox_1         |   Applying users.0010_update_jsonfield... OK
netbox_1         |   Applying virtualization.0019_standardize_name_length... OK
netbox_1         | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox_1         | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox_1         | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox_1         | 💡 Superuser Username: admin, E-Mail: netbox@netbox.com
netbox_1         | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox_1         | 🧬 loaded config '/etc/netbox/config/configuration.py'
netbox_1         | 🧬 loaded config '/etc/netbox/config/extra.py'
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/000_users.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/010_groups.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/020_custom_fields.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/020_tags.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/030_regions.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/040_sites.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/050_manufacturers.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/060_device_types.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/070_rack_roles.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/075_rack_groups.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/080_racks.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/090_device_roles.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/100_platforms.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/110_tenant_groups.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/120_tenants.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/130_cluster_types.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/135_cluster_groups.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/135_clusters.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/140_clusters.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/140_devices.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/145_devices.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/150_rirs.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/160_aggregates.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/165_cluster_groups.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/175_route_targets.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/180_vrfs.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/190_prefix_vlan_roles.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/200_vlan_groups.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/210_vlans.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/220_prefixes.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/230_virtual_machines.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/240_virtualization_interfaces.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/250_dcim_interfaces.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/260_ip_addresses.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/270_primary_ips.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/280_custom_links.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/280_providers.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/290_circuit_types.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/290_webhooks.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/300_circuits.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/310_secret_roles.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/320_services.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/330_power_panels.py
netbox_1         | ▶️  Running the startup script /opt/netbox/startup_scripts/340_power_feeds.py
netbox_1         | ✅ Initialisation is done.
netbox_1         | ⏳ Waiting for control socket to be created... (1/10)
netbox_1         | 2021/02/22 08:39:31 [info] 1#1 unit started
netbox_1         | 2021/02/22 08:39:31 [info] 15#15 discovery started
netbox_1         | 2021/02/22 08:39:31 [notice] 15#15 module: python 3.8.7 "/usr/lib/unit/modules/python3.unit.so"
netbox_1         | 2021/02/22 08:39:31 [info] 1#1 controller started
netbox_1         | 2021/02/22 08:39:31 [notice] 1#1 process 15 exited with code 0
netbox_1         | 2021/02/22 08:39:31 [info] 17#17 router started
netbox_1         | 2021/02/22 08:39:31 [info] 17#17 OpenSSL 1.1.1j  16 Feb 2021, 101010af
netbox_1         | ⚙️ Applying configuration from /etc/unit/nginx-unit.json
netbox_1         | 2021/02/22 08:39:32 [info] 21#21 "netbox" application started
netbox_1         | 2021/02/22 08:39:32 [alert] 21#21 Python failed to import module "netbox.wsgi"
netbox_1         | Traceback (most recent call last):
netbox_1         |   File "/opt/netbox/netbox/netbox/wsgi.py", line 7, in <module>
netbox_1         |     application = get_wsgi_application()
netbox_1         |   File "/opt/netbox/venv/lib/python3.8/site-packages/django/core/wsgi.py", line 12, in get_wsgi_application
netbox_1         |     django.setup(set_prefix=False)
netbox_1         |   File "/opt/netbox/venv/lib/python3.8/site-packages/django/__init__.py", line 19, in setup
netbox_1         |     configure_logging(settings.LOGGING_CONFIG, settings.LOGGING)
netbox_1         |   File "/opt/netbox/venv/lib/python3.8/site-packages/django/conf/__init__.py", line 83, in __getattr__
netbox_1         |     self._setup(name)
netbox_1         |   File "/opt/netbox/venv/lib/python3.8/site-packages/django/conf/__init__.py", line 70, in _setup
netbox_1         |     self._wrapped = Settings(settings_module)
netbox_1         |   File "/opt/netbox/venv/lib/python3.8/site-packages/django/conf/__init__.py", line 177, in __init__
netbox_1         |     mod = importlib.import_module(self.SETTINGS_MODULE)
netbox_1         |   File "/usr/lib/python3.8/importlib/__init__.py", line 127, in import_module
netbox_1         |     return _bootstrap._gcd_import(name[level:], package, level)
netbox_1         |   File "/opt/netbox/netbox/netbox/settings.py", line 40, in <module>
netbox_1         |     from netbox import configuration
netbox_1         |   File "/opt/netbox/netbox/netbox/configuration.py", line 68, in <module>
netbox_1         |     _loaded_configurations = read_configurations(
netbox_1         |   File "/opt/netbox/netbox/netbox/configuration.py", line 37, in read_configurations
netbox_1         |     with scandir(config_dir) as it:
netbox_1         | PermissionError: [Errno 13] Permission denied: '/etc/netbox/config/'
netbox_1         | ⚠️ Main configuration '/etc/netbox/config/configuration.py' not found.

[ein-stein-chen]

I also experienced this. In my case, it was a problem with my umask setting (077).

The Netbox container mounts some directories from the checked-out git repository (startup_scripts, initializers, configuration, reports, scripts), those appear in the container with the permissions from the host (uid 1000, gid 1000, permissions: 0{6|7}00).

So you either need to adjust the permissions of those directories/files to be world accessible/readable or run Netbox with the same UID as the user who owns the files on the host

[jkldgoefgkljefogeg]

Thank you so much!

on the local git repo, I did -R +or on mounted columns https://github.com/netbox-community/netbox-docker/blob/release/docker-compose.yml#L12, and +ox on all directories in these volumes