[Server 43] Pihole Container has write issues

Ask Fedora
,
1

I am trying to run a pihole container on Fedora server 43. The pihole logs shows write issues to the etc-pihole folder. I have no idea how to solve this.

marcus@protectli:~$ podman logs pihole
  [i] Setting up user & group for the pihole user
  [i] ID for user pihole is already 1000, no need to change
  [i] ID for group pihole is already 1000, no need to change

  [i] Starting FTL configuration
  [i] No DNS upstream set in environment or config file, defaulting to Google DNS
  [i] Assigning password defined by Environment Variable
  [i] Starting crond for scheduled scripts. Randomizing times for gravity and update checker

  [i] Ensuring logrotate script exists in /etc/pihole
install: cannot create regular file '/etc/pihole/logrotate': Permission denied

  [i] Gravity migration checks
  [i] No adlist file found, creating one with a default blocklist
/usr/bin/bash_functions.sh: line 109: /etc/pihole/adlists.list: Permission denied
  [i] /etc/pihole/gravity.db does not exist (Likely due to a fresh volume). This is a required file for Pi-hole to operate.
  [i] Gravity will now be run to create the database
  [✗] DNS resolution is currently unavailable
marcus@protectli:~$ podman logs pihole
  [i] Setting up user & group for the pihole user
  [i] ID for user pihole is already 1000, no need to change
  [i] ID for group pihole is already 1000, no need to change

  [i] Starting FTL configuration
  [i] No DNS upstream set in environment or config file, defaulting to Google DNS
  [i] Assigning password defined by Environment Variable
  [i] Starting crond for scheduled scripts. Randomizing times for gravity and update checker

  [i] Ensuring logrotate script exists in /etc/pihole
install: cannot create regular file '/etc/pihole/logrotate': Permission denied

  [i] Gravity migration checks
  [i] No adlist file found, creating one with a default blocklist
/usr/bin/bash_functions.sh: line 109: /etc/pihole/adlists.list: Permission denied
  [i] /etc/pihole/gravity.db does not exist (Likely due to a fresh volume). This is a required file for Pi-hole to operate.
  [i] Gravity will now be run to create the database
  [✗] DNS resolution is currently unavailable


marcus@protectli:~$ ll
total 12
-rw-r--r--. 1 marcus marcus 2154 Nov 23 11:07 compose.yml
-rw-r--r--. 1 marcus marcus 2108 Nov 23 10:44 compose.yml~
drwxr-xr-x. 2 marcus marcus    6 Nov 23 11:15 etc-pihole
-rw-r--r--. 1 marcus marcus  181 Nov 22 15:22 podman-pihole.sh


marcus@protectli:~$ cat compose.yml
# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      # DNS Ports
      - "53:53/tcp"
      - "53:53/udp"
      # Default HTTP Port
      - "80:80/tcp"
      # Default HTTPs Port. FTL will generate a self-signed certificate
      - "443:443/tcp"
      # Uncomment the line below if you are using Pi-hole as your DHCP server
      #- "67:67/udp"
      # Uncomment the line below if you are using Pi-hole as your NTP server
      #- "123:123/udp"
    environment:
      # Set the appropriate timezone for your location (https://en.wikipedia.org/wiki/List_of_tz_database_time_zones), e.g:
      TZ: 'Europe/London'
      # Set a password to access the web interface. Not setting one will result in a random password being assigned
      FTLCONF_webserver_api_password: 'correct horse battery staple'
      # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all'
      FTLCONF_dns_listeningMode: 'all'
      PIHOLE_UID: 1000
      PIHOLE_GID: 1000
    # Volumes store your data between container upgrades
    volumes:
      # For persisting Pi-hole's databases and common configuration file
      - './etc-pihole:/etc/pihole'
      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
      #- './etc-dnsmasq.d:/etc/dnsmasq.d'
    cap_add:
      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
      # Required if you are using Pi-hole as your DHCP server, else not needed
      - NET_ADMIN
      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
      - SYS_TIME
      # Optional, if Pi-hole should get some more processing time
      - SYS_NICE
    restart: unless-stopped


marcus@protectli:~$
2

Any SELinux denials?

For example, sudo ausearch -ts today will show you denials from today.

3

SELinux is indeed the “problem” here.

marcus@protectli:~$ sudo setenforce 0
marcus@protectli:~$ podman compose -f compose.yml up -d --force-recreate
>>>> Executing external compose provider "/usr/bin/podman-compose". Please see podman-compose(1) for how to disable this message. <<<<

2bb3e757052c9d0c79a166dd89a9ba18e42f1ae67f58c5f5113c474e50cc9352
119968e82b458adb679117c9f5c0da13d3670bd82850a2cc73281ee3e4dce1b5
pihole
marcus@protectli:~$ tree etc-pihole/
etc-pihole/
├── adlists.list
├── config_backups
│   └── pihole.toml.1
├── dnsmasq.conf
├── logrotate
└── pihole.toml

2 directories, 5 files

marcus@protectli:~$ podman logs pihole
  [i] Setting up user & group for the pihole user
  [i] ID for user pihole is already 1000, no need to change
  [i] ID for group pihole is already 1000, no need to change

  [i] Starting FTL configuration
  [i] No DNS upstream set in environment or config file, defaulting to Google DNS
  [i] Assigning password defined by Environment Variable
  [i] Starting crond for scheduled scripts. Randomizing times for gravity and update checker

  [i] Ensuring logrotate script exists in /etc/pihole

  [i] Gravity migration checks
  [i] No adlist file found, creating one with a default blocklist
  [i] /etc/pihole/gravity.db does not exist (Likely due to a fresh volume). This is a required file for Pi-hole to operate.
  [i] Gravity will now be run to create the database
  [✗] DNS resolution is currently unavailable

marcus@protectli:~$

My naive approach is now to add SELinux rule:

sudo chcon -Rt container_file_t ./etc-pihole
sudo semanage fcontext -a -t container_file_t "./etc-pihole(/.*)?"
sudo restorecon -Rv ./etc-pihole
1 Like
4

You could also try changing your mount definition so that Podman relabels it on container creation:

      - './etc-pihole:/etc/pihole:Z'

The :Z flag labels the directory as private to your container. I’m assuming that syntax is also valid in a compose file but I haven’t used it there myself.

1 Like
6

The :Z flag labels the directory as private to your container. I’m assuming that syntax is also valid in a compose file but I haven’t used it there myself.

I recently had (I think) the same issue in my setup and had to edit the mount flags as @pg-tips pointed out.

If you want to take a look, here is my configuration using podman quadlets.

7

I can confirm :Z is usually required for running rootless podman compose on systems with SELinux, like Fedora and Enterprise Linux.