From 1fb8fdee207938f787594cd0e571661bb723d6b9 Mon Sep 17 00:00:00 2001 From: librelad Date: Wed, 19 Aug 2026 19:25:31 +0100 Subject: [PATCH] Grant searxng DAC_OVERRIDE so it can write its own config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SearXNG never started on rootless Docker — base install or instance, it restart-looped from the first boot and the web UI was never reachable. Cause is a specific capability combination, not a general permissions problem. The image's entrypoint runs as root and, on first start, chowns the mounted config dir to searxng:searxng (uid 977) using CHOWN, then immediately copies settings.yml into the directory it has just given away. The compose dropped ALL capabilities and added back only CHOWN, SETGID and SETUID — so the chown succeeded and the write did not, because root cannot write to a 0755 directory owned by another uid without DAC_OVERRIDE: cp: can't create '/etc/searxng/settings.yml': Permission denied !!! "/etc/searxng/settings.yml" is not a valid file, exiting... Isolated the cause by running the image against fresh directories: it fails with the shipped cap set and succeeds with DAC_OVERRIDE added, everything else identical. Granting CHOWN without DAC_OVERRIDE is the exact breaking pair; all other capabilities stay dropped. Verified end to end: base install and a --local instance both come up and serve 200 on their own random ports, each with its own settings.yml and a distinct secret_key. This also completes the instance verification that was blocked earlier — searxng could not be runtime-tested while the app could not boot. Both test installs were removed afterwards. Separate pre-existing bug, not fixed here: the install hook applies the theme with sed s/simple_style: auto/.../ but the generated settings.yml contains no style keys at all, so the substitution matches nothing and CFG_SEARXNG_THEME has never had any effect. Fixing it means inserting a ui: block rather than replacing a line, which is a different mechanism and wants its own change. Co-Authored-By: Claude Opus 5 --- containers/searxng/docker-compose.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/containers/searxng/docker-compose.yml b/containers/searxng/docker-compose.yml index 002b859..6cecb2b 100755 --- a/containers/searxng/docker-compose.yml +++ b/containers/searxng/docker-compose.yml @@ -30,6 +30,18 @@ services: - CHOWN - SETGID - SETUID + # DAC_OVERRIDE is required, not optional hardening slack. The image's + # entrypoint runs as root and, on first start, chowns the mounted config + # dir to searxng:searxng (uid 977) using CHOWN — then immediately copies + # settings.yml into the directory it just gave away. Without DAC_OVERRIDE + # root cannot write to a 0755 directory owned by another uid, so the copy + # failed and the container exited with: + # cp: can't create '/etc/searxng/settings.yml': Permission denied + # !!! "/etc/searxng/settings.yml" is not a valid file, exiting... + # It restart-looped forever and SearXNG never came up at all. Granting + # CHOWN without DAC_OVERRIDE is the specific combination that breaks; + # every other capability stays dropped. + - DAC_OVERRIDE logging: driver: "json-file" options: