1fb8fdee20
SearXNG never started on rootless Docker — base install or instance, it restart-looped from the first boot and the web UI was never reachable. Cause is a specific capability combination, not a general permissions problem. The image's entrypoint runs as root and, on first start, chowns the mounted config dir to searxng:searxng (uid 977) using CHOWN, then immediately copies settings.yml into the directory it has just given away. The compose dropped ALL capabilities and added back only CHOWN, SETGID and SETUID — so the chown succeeded and the write did not, because root cannot write to a 0755 directory owned by another uid without DAC_OVERRIDE: cp: can't create '/etc/searxng/settings.yml': Permission denied !!! "/etc/searxng/settings.yml" is not a valid file, exiting... Isolated the cause by running the image against fresh directories: it fails with the shipped cap set and succeeds with DAC_OVERRIDE added, everything else identical. Granting CHOWN without DAC_OVERRIDE is the exact breaking pair; all other capabilities stay dropped. Verified end to end: base install and a --local instance both come up and serve 200 on their own random ports, each with its own settings.yml and a distinct secret_key. This also completes the instance verification that was blocked earlier — searxng could not be runtime-tested while the app could not boot. Both test installs were removed afterwards. Separate pre-existing bug, not fixed here: the install hook applies the theme with sed s/simple_style: auto/.../ but the generated settings.yml contains no style keys at all, so the substitution matches nothing and CFG_SEARXNG_THEME has never had any effect. Fixing it means inserting a ui: block rather than replacing a line, which is a different mechanism and wants its own change. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
63 lines
2.8 KiB
YAML
Executable File
63 lines
2.8 KiB
YAML
Executable File
networks:
|
|
DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
|
|
external: true
|
|
|
|
services:
|
|
searxng-service: #LIBREPORTAL|SERVICE_TAG_1|searxng-service
|
|
container_name: searxng-service
|
|
image: searxng/searxng:latest #LIBREPORTAL|SEARXNG_VERSION_TAG|latest
|
|
restart: unless-stopped
|
|
hostname: searxng
|
|
# GLUETUN_OFF_BEGIN
|
|
ports:
|
|
- "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
|
|
# GLUETUN_OFF_END
|
|
labels:
|
|
libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
|
|
libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
|
|
traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
|
|
# TRAEFIK_PORT_1_BEGIN
|
|
traefik.http.routers.searxng-service.entrypoints: web,websecure
|
|
traefik.http.routers.searxng-service.rule: Host(`DOMAINSUBNAME_DATA_1`) #LIBREPORTAL|DOMAINSUBNAME_TAG_1|DOMAINSUBNAME_DATA_1
|
|
traefik.http.routers.searxng-service.tls: true
|
|
traefik.http.routers.searxng-service.tls.certresolver: production
|
|
traefik.http.services.searxng-service.loadbalancer.server.port: PORT_INTERNAL_DATA_1 #LIBREPORTAL|PORT_INTERNAL_TAG_1|PORT_INTERNAL_DATA_1
|
|
traefik.http.routers.searxng-service.middlewares: MIDDLEWARE_DATA_1 #LIBREPORTAL|MIDDLEWARE_TAG_1|MIDDLEWARE_DATA_1
|
|
# TRAEFIK_PORT_1_END
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- CHOWN
|
|
- SETGID
|
|
- SETUID
|
|
# DAC_OVERRIDE is required, not optional hardening slack. The image's
|
|
# entrypoint runs as root and, on first start, chowns the mounted config
|
|
# dir to searxng:searxng (uid 977) using CHOWN — then immediately copies
|
|
# settings.yml into the directory it just gave away. Without DAC_OVERRIDE
|
|
# root cannot write to a 0755 directory owned by another uid, so the copy
|
|
# failed and the container exited with:
|
|
# cp: can't create '/etc/searxng/settings.yml': Permission denied
|
|
# !!! "/etc/searxng/settings.yml" is not a valid file, exiting...
|
|
# It restart-looped forever and SearXNG never came up at all. Granting
|
|
# CHOWN without DAC_OVERRIDE is the specific combination that breaks;
|
|
# every other capability stays dropped.
|
|
- DAC_OVERRIDE
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "1m"
|
|
max-file: "1"
|
|
healthcheck:
|
|
disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
|
|
volumes:
|
|
- SOCKET_DATA #LIBREPORTAL|SOCKET_TAG|SOCKET_DATA
|
|
- "./searxng-data/:/etc/searxng:rw"
|
|
# GLUETUN_OFF_BEGIN
|
|
networks:
|
|
DOCKER_NETWORK_DATA: #LIBREPORTAL|DOCKER_NETWORK_TAG|DOCKER_NETWORK_DATA
|
|
ipv4_address: IP_DATA_1 #LIBREPORTAL|IP_TAG_1|IP_DATA_1
|
|
# GLUETUN_OFF_END
|
|
# GLUETUN_ON_BEGIN
|
|
# network_mode: "container:gluetun-service"
|
|
# GLUETUN_ON_END
|