Docker several permission denied pull and run

[rvescovi]

Hi,

I'm having several issue with some images with permission denied. Below two examples

1) DOCKER RUN

# docker run ubuntu
Unable to find image 'ubuntu:latest' locally
latest: Pulling from library/ubuntu
de44b265507a: Already exists
Digest: sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab
Status: Downloaded newer image for ubuntu:latest
docker: Error response from daemon: mkdir /Volume1/@apps/DockerEngine/DockerData/overlay2/097fc103ec0dec205c77fc0e3d0201e46c8a3ce0f443e03ba164c7909dbe4cbb-init/merged/dev/pts: operation not permitted.
See 'docker run --help'.

2) DOCKER PULL

# docker pull mysql
Using default tag: latest
latest: Pulling from library/mysql
2c0a233485c3: Pull complete
fb027c65a85c: Extracting [==================================================>] 884B/884B
bd0747a4bff6: Download complete
6a67d6d40a5b: Download complete
37c572287499: Download complete
45d7b1770f6b: Download complete
5086dfc014b6: Download complete
e8d0f55b762f: Download complete
cffd6c85e255: Download complete
6a9a54c9e55e: Download complete
failed to register layer: failed to Lchown "/etc" for UID 0, GID 0: lchown /etc: operation not permitted

Actions done:
- I added my user to a DOCKER group without success
- I tried to apply a previous post of "setfacl -PRdm u::rwx,g::rw,o::r" to /Volume1/@apps/DockerEngine/DockerData/volumes" I don't know if I can apply to also the overlay2 which has this kind of permissions:

# ll /Volume1/@apps/DockerEngine/DockerData/overlay2/
total 0
drwx--x---+ 1 user user 11682 Jan 22 22:13 ./
drwx--x--- 1 user user 174 Jan 15 10:24 ../
drwx--x---+ 1 user user 52 Dec 24 19:14 032063ab7e35bfaa31e15fa04677b7b96e7de598b65881dfd06f0ac430e1ebdb/
drwx--x---+ 1 user user 52 Dec 24 19:25 04554a1995d63acd5c15c4c7ac9ac1668332cb20c2a527d0816b2bf513eefad1/
drwx--x---+ 1 user user 34 Jan 22 22:12 097fc103ec0dec205c77fc0e3d0201e46c8a3ce0f443e03ba164c7909dbe4cbb-init/
drwx--x---+ 1 user user 52 Dec 24 19:49 0b0e86164a689c0d9e44f17abde13bf78394336b70960d772306f66b3bb8939c/

Any ideas?
My DOCKER has currently only the homeassistant image working.

[TMlinda]

From the error message, it seems that a permission error has occurred. What is the version of your Docker Manager application and the current TOS system version? Have you enabled the SPC function in the TOS system?

[rvescovi]

Hi,

DockerManager -> 2.1.005
DockerEngine -> 27.2.1
TOS -> 6.0.610
SPC enabled



I'm also having issues with Portainer which cannot works accessing SOCK for permission denied too -> TOS team already answered referring to the SPC and currently under fixing. viewtopic.php?p=42348

But for docker in general I tried to change file permissions without success, so I share here to see if someone else had and solved somehow.

[TMlinda]

You can try uninstalling and reinstalling docker engine, or disabling and re-enabling SPC, which may solve the problem.

[rvescovi]

You can try uninstalling and reinstalling docker engine, or disabling and re-enabling SPC, which may solve the problem.

Hi,

Thanks, I reinstall docker engine, and now it works. Probably after the recent update something went wrong and it was better if I reinstalled. Anyway now it's possible to execute the previous command like "docker run ubuntu" without any errors.

So I move on installing other containers I reinstalled correctly the PORTAINER AGENT and HOMEASSISTANT, and next I want to install a new one HOMARR but I receive this error:

# docker-compose up -d
[+] Running 0/0
⠋ Container homarr Creating 0.1s
Error response from daemon: failed to copy xattrs: failed to set xattr "security.SMACK64" on /Volume1/@apps/DockerEngine/DockerData/volumes/ec7cf87ecf9d775eb66a7edea2be81895208a0920da09fb949446402f494b44c/_data: operation not permitted

I'm investigating.

[rvescovi]

Hi,

I found a workaround to install HOMARR without using volumes. So at conclusion reinstalling latest DockerEngine 27.2.1 (removing all data), solved the OVERLAY2 permission denied errors.

Thanks