I have home server with proxmox 5 installed and some services in docker containers. All was fine till yestarday.

I rebooted the server and all services in all containers cannot bind socket because of permission denied. I'm frustrated...

Here some technical details

Linux server 4.10.15-1-pve #1 SMP PVE 4.10.15-15 (Fri, 23 Jun 2017 08:57:55 +0200) x86_64 GNU/Linux

Docker version 18.03.0-ce, build 0520e24
docker-compose version 1.20.1, build 5d8c71b

caddy docker-compose.yml

version: '2'
    container_name: caddy
    image: zzrot/alpine-caddy:latest
    restart: unless-stopped
    network_mode: "host"
      - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
    hostname: caddy
      - /etc/localtime:/etc/localtime:ro
      - /mirror/config/caddy-config/certs:/root/.caddy
      - /mirror/config/caddy-config/caddy:/etc/Caddyfile

docker-compose up output

root@server:~/compose/caddy# docker-compose up
Creating caddy ... done
Attaching to caddy
caddy    | Activating privacy features... done.
caddy    | 2018/03/23 19:55:21 listen tcp :443: socket: permission denied
caddy exited with code 1

mariadb docker-compose.yml

version: '3.1'
    container_name: mariadb
    image: mariadb
    restart: always
      - 3306:3306/udp
      - 3306:3306/tcp
      - PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
      - MYSQL_ROOT_PASSWORD=password
    hostname: mariadb
      - /mirror/config/mariadb-config/databases:/var/lib/mysql
      - /mirror/config/custom.cnf:/etc/mysql/conf.d/config-file.cnf
      - /mirror/config/logs:/config/logs

docker-compose up output

mariadb_1  | 2018-03-23 13:20:36 139659836417920 [Warning] Failed to create a socket for IPv6 '::': errno: 13.
mariadb_1  | 2018-03-23 13:20:36 139659836417920 [Warning] Failed to create a socket for IPv4 '': errno: 13.
mariadb_1  | 2018-03-23 13:20:36 139659836417920 [ERROR] Can't create IP socket: Permission denied
mariadb_1  | 2018-03-23 13:20:36 139659836417920 [ERROR] Aborting
mariadb_1  |
mariadb_mariadb_1 exited with code 1

What could be the reason for this?

Upd: some new details

kernel: audit: type=1400 audit(1521896913.536:10071): apparmor="DENIED" operation="create" profile="docker-default" pid=16502 comm="mysqld" family="inet" sock_type="dgram" protocol=0 requested_mask="create" denied_

audit[16271]: AVC apparmor="DENIED" operation="create" profile="docker-default" pid=16271 comm="caddy" family="inet" sock_type="dgram" protocol=0 requested_mask="create" denied_mask="create"
  • security_opt: - apparmor:unconfined solves the problem – Alexey Miller Mar 24 '18 at 13:31
  • 1
    Please post your answer as an answer. :) – Matheus Santana Mar 24 '18 at 15:19

I have added security_opt to docker-compose and problem has gone.

      - apparmor:unconfined

But I do not consider this option a completely correct solution of the problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.