ayufan/pve-backup-server-dockerfiles

Cannot login to newly created container "permission check failed."

Closed this issue · 7 comments

Issue:
I'm getting "Login failed" with "permission check failed." in dev tools when logging in with admin and pbspbs.

HTTP Request:

POST /api2/extjs/access/ticket HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
Accept-Language: de,de-DE;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Connection: keep-alive
Content-Length: 36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Host: 10.1.250.206:8007
Origin: https://10.1.250.206:8007
Referer: https://10.1.250.206:8007/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Edg/103.0.1264.37
X-Requested-With: XMLHttpRequest
sec-ch-ua: " Not;A Brand";v="99", "Microsoft Edge";v="103", "Chromium";v="103"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"

Form Data:
username: admin@pbs
password: pbspbs

Response:

{"errors":{},"message":"permission check failed.","success":false}

Steps to reproduce:

  • Create new docker container with latest image from today
  • Login with admin and pbspbs.

Open dev tools of browser to see the error messages

Logs:

PROXY: The proxmox-backup is not yet configured!
Copying defaults into `/etc/proxmox-backup/`
'/etc/proxmox-backup-default/./acl.cfg' -> '/etc/proxmox-backup/./acl.cfg'
'/etc/proxmox-backup-default/./shadow.json' -> '/etc/proxmox-backup/./shadow.json'
'/etc/proxmox-backup-default/./user.cfg' -> '/etc/proxmox-backup/./user.cfg'
API: Starting...
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: The proxmox-backup is not yet configured!
PROXY: Starting...

Interesting. Can you show docker-compose.yml, docker ps -a and mount?

docker ps -a :

CONTAINER ID   IMAGE                                 COMMAND                  CREATED          STATUS          PORTS                                        NAMES
0e10358b5739   ayufan/proxmox-backup-server:latest   "runsvdir /runit"        29 minutes ago   Up 25 minutes                                                ProxmoxBackup
f98e6f0c3197   iowoi/shinobi:latest                  "sh /home/Shinobi/Do…"   17 hours ago     Up 17 hours                                                  shinobi
7f80bc3251dd   portainer/portainer-ce:latest         "/portainer"             17 hours ago     Up 17 hours     8000/tcp, 9000/tcp, 0.0.0.0:9443->9443/tcp   portainer

I did deploy directly via command line, therefore i don't have any docker-compose.yml

Maybe inspect helps a little docker inspect ProxmoxBackup:

[
    {
        "Id": "0e10358b5739d0be491a91c28f441a390b1c9478da4078cb8182d97f95fcac3f",
        "Created": "2022-06-30T11:29:15.896224814Z",
        "Path": "runsvdir",
        "Args": [
            "/runit"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 28798,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2022-06-30T11:33:29.654429513Z",
            "FinishedAt": "0001-01-01T00:00:00Z"
        },
        "Image": "sha256:1248531d9c613cc594525f26ce21110c4ab706b2ac442d4e3df03f376b431558",
        "ResolvConfPath": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/containers/0e10358b5739d0be491a91c28f441a390b1c9478da4078cb8182d97f95fcac3f/resolv.conf",
        "HostnamePath": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/containers/0e10358b5739d0be491a91c28f441a390b1c9478da4078cb8182d97f95fcac3f/hostname",
        "HostsPath": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/containers/0e10358b5739d0be491a91c28f441a390b1c9478da4078cb8182d97f95fcac3f/hosts",
        "LogPath": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/containers/0e10358b5739d0be491a91c28f441a390b1c9478da4078cb8182d97f95fcac3f/0e10358b5739d0be491a91c28f441a390b1c9478da4078cb8182d97f95fcac3f-json.log",
        "Name": "/ProxmoxBackup",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": [
                "/share/ProxmoxBackup:/mnt/backups"
            ],
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {
                    "max-file": "10",
                    "max-size": "10m"
                }
            },
            "NetworkMode": "qnet-dhcp-eth0-6d6da6",
            "PortBindings": {},
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": [
                "AUDIT_WRITE",
                "CHOWN",
                "DAC_OVERRIDE",
                "FOWNER",
                "FSETID",
                "KILL",
                "MKNOD",
                "NET_BIND_SERVICE",
                "NET_RAW",
                "SETFCAP",
                "SETGID",
                "SETPCAP",
                "SETUID",
                "SYS_CHROOT"
            ],
            "CapDrop": [
                "AUDIT_CONTROL",
                "BLOCK_SUSPEND",
                "DAC_READ_SEARCH",
                "IPC_LOCK",
                "IPC_OWNER",
                "LEASE",
                "LINUX_IMMUTABLE",
                "MAC_ADMIN",
                "MAC_OVERRIDE",
                "NET_ADMIN",
                "NET_BROADCAST",
                "SYSLOG",
                "SYS_ADMIN",
                "SYS_BOOT",
                "SYS_MODULE",
                "SYS_NICE",
                "SYS_PACCT",
                "SYS_PTRACE",
                "SYS_RAWIO",
                "SYS_RESOURCE",
                "SYS_TIME",
                "SYS_TTY_CONFIG",
                "WAKE_ALARM"
            ],
            "CgroupnsMode": "host",
            "Dns": [],
            "DnsOptions": null,
            "DnsSearch": null,
            "ExtraHosts": [],
            "GroupAdd": null,
            "IpcMode": "private",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": null,
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DeviceRequests": null,
            "KernelMemory": 0,
            "KernelMemoryTCP": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": null,
            "Ulimits": [
                {
                    "Name": "nofile",
                    "Hard": 65535,
                    "Soft": 65535
                }
            ],
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ],
            "Init": false
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/942709f7294d0cdea260ede8bfa3f59a2bf7e44bc5ade6021c04855a5cc77fa1-init/diff:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/f693ea11a7e4393ba677688e842e788a157bab58cb72f612221394804e1cc939/diff:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/4c1375a38e662b76dd742167005b95226a28040c747c26db5e39e357d70ff8df/diff:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/6d3ea6e5f5079487a0862f5f7c1d49f64f2ab904a2dd9fdea8f231385da57122/diff:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/ae9fba85acff5bbf92c1bd4aa718c58978e5e05c6cb3020a0f8501eacd432e12/diff:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/7410ba6d4bc2bb68ee777c6310a74478b6b3b42c295b7cd113c5e3ff3341c199/diff",
                "MergedDir": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/942709f7294d0cdea260ede8bfa3f59a2bf7e44bc5ade6021c04855a5cc77fa1/merged",
                "UpperDir": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/942709f7294d0cdea260ede8bfa3f59a2bf7e44bc5ade6021c04855a5cc77fa1/diff",
                "WorkDir": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/942709f7294d0cdea260ede8bfa3f59a2bf7e44bc5ade6021c04855a5cc77fa1/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [
            {
                "Type": "bind",
                "Source": "/share/ProxmoxBackup",
                "Destination": "/mnt/backups",
                "Mode": "",
                "RW": true,
                "Propagation": "rprivate"
            },
            {
                "Type": "volume",
                "Name": "c42d838187198278d9b0929c373b88594e6dde5de32f4f70e34657515975a9ba",
                "Source": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/volumes/c42d838187198278d9b0929c373b88594e6dde5de32f4f70e34657515975a9ba/_data",
                "Destination": "/etc/proxmox-backup",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "volume",
                "Name": "edb626b14de3000f17408ce6f368f6f976ccba8e558aac001014a937b2b91f89",
                "Source": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/volumes/edb626b14de3000f17408ce6f368f6f976ccba8e558aac001014a937b2b91f89/_data",
                "Destination": "/var/lib/proxmox-backup",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "volume",
                "Name": "7c87e0a4e626fea986f34cbea1647bca3e89c3883f1c1b60cd64d00c666c84bf",
                "Source": "/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/volumes/7c87e0a4e626fea986f34cbea1647bca3e89c3883f1c1b60cd64d00c666c84bf/_data",
                "Destination": "/var/log/proxmox-backup",
                "Driver": "local",
                "Mode": "",
                "RW": true,
                "Propagation": ""
            }
        ],
        "Config": {
            "Hostname": "pbs",
            "Domainname": "",
            "User": "",
            "AttachStdin": false,
            "AttachStdout": false,
            "AttachStderr": false,
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
            ],
            "Cmd": [
                "runsvdir",
                "/runit"
            ],
            "Image": "ayufan/proxmox-backup-server:latest",
            "Volumes": {
                "/etc/proxmox-backup": {},
                "/mnt/backups": {},
                "/var/lib/proxmox-backup": {},
                "/var/log/proxmox-backup": {}
            },
            "WorkingDir": "",
            "Entrypoint": null,
            "OnBuild": null,
            "Labels": {}
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "948912212a26fbb68480782629a25e953c6a22adf186fa226e9055887929366b",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {},
            "SandboxKey": "/var/run/docker/netns/948912212a26",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "",
            "Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "MacAddress": "",
            "Networks": {
                "qnet-dhcp-eth0-6d6da6": {
                    "IPAMConfig": {},
                    "Links": null,
                    "Aliases": [
                        "0e10358b5739",
                        "pbs"
                    ],
                    "NetworkID": "2cac604d0e149be989e85e2bfde394ab0fcbe94b1df5e2156b9143068862b217",
                    "EndpointID": "cec7dba3e464c1def1d32592a0d3db674eb577f8ac32aa3930a4b3cbfc2d0359",
                    "Gateway": "########",
                    "IPAddress": "########",
                    "IPPrefixLen": 24,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "############",
                    "DriverOpts": null
                }
            }
        }
    }
]

Once i try to set the acls using the shell, i get the error "Error: path "/run/proxmox-backup/shmem" is not on tmpfs"

Mount output:

overlay on / type overlay (rw,relatime,lowerdir=/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/l/UEIEDUKKTNWID5E44A7OVI7LXY:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/l/ANXQB4ALTE3QPK73CS6PAVA24N:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/l/SWQ2CEDBVPUX7FGXIUSXDB3RZA:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/l/RHNP5ZC4UH5323UQBXR4QS5L6Z:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/l/Q2Q7FAEBZMHF36BXK2ZVKXIPTP:/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/l/FGYBGRQE2XQK5SAV4W4GTVF2JF,upperdir=/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/942709f7294d0cdea260ede8bfa3f59a2bf7e44bc5ade6021c04855a5cc77fa1/diff,workdir=/share/CACHEDEV1_DATA/Container/container-station-data/lib/docker/overlay2/942709f7294d0cdea260ede8bfa3f59a2bf7e44bc5ade6021c04855a5cc77fa1/work)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,relatime,mode=755)
none on /sys/fs/cgroup/memory type cgroup (ro,nosuid,nodev,noexec,relatime,memory)
cpu on /sys/fs/cgroup/cpu type cgroup (ro,nosuid,nodev,noexec,relatime,cpu)
cgroup on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpuacct)
cgroup on /sys/fs/cgroup/blkio type cgroup (ro,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/devices type cgroup (ro,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (ro,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/systemd type cgroup (ro,nosuid,nodev,noexec,relatime,name=systemd)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=65536k)
/dev/mapper/cachedev2 on /mnt/backups type ext4 (rw,relatime,no_mbcache,(null),stripe=128,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
/dev/mapper/cachedev1 on /etc/proxmox-backup type ext4 (rw,relatime,no_mbcache,(null),stripe=384,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
/dev/mapper/cachedev1 on /etc/resolv.conf type ext4 (rw,relatime,no_mbcache,(null),stripe=384,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
/dev/mapper/cachedev1 on /etc/hostname type ext4 (rw,relatime,no_mbcache,(null),stripe=384,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
/dev/mapper/cachedev1 on /etc/hosts type ext4 (rw,relatime,no_mbcache,(null),stripe=384,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
/dev/mapper/cachedev1 on /var/lib/proxmox-backup type ext4 (rw,relatime,no_mbcache,(null),stripe=384,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
/dev/mapper/cachedev1 on /var/log/proxmox-backup type ext4 (rw,relatime,no_mbcache,(null),stripe=384,data=ordered,jqfmt=vfsv1,usrjquota=aquota.user)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/asound type tmpfs (ro,relatime)
tmpfs on /proc/keys type tmpfs (rw,nosuid,size=65536k,mode=755)
tmpfs on /proc/timer_list type tmpfs (rw,nosuid,size=65536k,mode=755)
tmpfs on /proc/scsi type tmpfs (ro,relatime)
tmpfs on /sys/firmware type tmpfs (ro,relatime)

@mKenfenheuer Looking at what you pasted your container is run differently than this https://github.com/ayufan/pve-backup-server-dockerfiles/blob/master/docker-compose.yml:

  • no mounts for /etc/proxmox-backup and /var/log/proxmox-backup, /var/lib/proxmox-backup
  • no tmpfs on /run

There's a need for each of those mounts being properly configured: settings, logs, graphs, ephemeral storage for sockets and shared memory.

Yep, works now! Thanks for pointing it out. Must have missed that somewhere ;)