Trying to run in a sidecar container fails with "Permission denied" #7016
Assignees
Labels
bug
Something isn't working
Comments
Welcome to dotnet-monitor!Thanks for creating your first issue; let us know what you think of dotnet-monitor by filling out our survey. |
|
@mu88 There are two requirements to establish connectivity with dotnet-monitor and the app:
In 8.0, we no longer run as root by default. I'm not that familiar with docker compose, but to fix your example, I was able to add Ideally you would have the same non-privileged user running both containers, but you'll need to also grant permissions for that user to the volume. |
|
Thx @wiktork ! Where would I have found this information in the docs? |
|
@wiktork: with the following services:
exampleapp:
image: mcr.microsoft.com/dotnet/samples:aspnetapp
user: root
ports:
- "8080:8080"
volumes:
- diagvol:/diag
environment:
- DOTNET_DiagnosticPorts=/diag/dotnet-monitor.sock
dotnet-monitor:
image: mcr.microsoft.com/dotnet/monitor:8
ports:
- "52323:52323"
- "52325:52325"
user: root
volumes:
- diagvol:/diag
command: ["collect", "--no-auth"]
environment:
- DOTNETMONITOR_DiagnosticPort__ConnectionMode=Listen
- DOTNETMONITOR_Storage__DefaultSharedPath=/diag
- DOTNETMONITOR_Urls=http://localhost:52323
- DOTNETMONITOR_Metrics__Endpoints=http://+:52325
volumes:
diagvol:According to the API docs of |
Compatibility docs describe the scenario here: https://github.com/dotnet/dotnet-monitor/blob/main/documentation/compatibility/8.0/README.md#docker-non-root-by-default We can probably add more pointers from the rest of the docs to this existing doc to help people find the information and resolution more easily. |
If you adjust the URL to bind to any host instead of localhost, then it works: - DOTNETMONITOR_Urls=http://localhost:52323
+ DOTNETMONITOR_Urls=http://+:52323The .NET Monitor image as-is binds its URLs to any host by default. |
|
That works like a charm, thank you very much! |
|
@jander-msft sorry for bothering you again with this issue :/ After upgrading my stack to .NET 9, the previous approach no longer works. In the logs of the Have there been any changes related to .NET 9 that I should be aware of? 🤔 Here you find all the logs from the `dotnet monitor` containerHere you find my `docker-compose.yml`.services:
thisisyourlife:
image: mu88/thisisyourlife:4.0.0-chiseled
container_name: thisisyourlife
depends_on:
- dotnet-monitor
user: app
environment:
- OTEL_EXPORTER_OTLP_ENDPOINT=http://opentelemetry-collector:4317
- DOTNET_DiagnosticPorts=/diag/dotnet-monitor.sock
volumes:
- ./data/:/home/app/data
- ./dotnet-monitor/data/:/diag
# 3 other ASP.NET Core 9 apps following the same pattern like the previous one
# other services necessary for the observability stack (e.g. Grafana, OpenTelemetry exporter)
dotnet-monitor:
image: mcr.microsoft.com/dotnet/monitor:9
container_name: monitoring-dotnet-monitor
ports:
- "127.0.0.1:52323:52323"
- "127.0.0.1:52325:52325"
user: app
volumes:
- ./dotnet-monitor/data/:/diag
command: ["collect", "--no-auth"]
environment:
- DOTNETMONITOR_DiagnosticPort__ConnectionMode=Listen
- DOTNETMONITOR_Storage__DefaultSharedPath=/diag
- DOTNETMONITOR_Urls=http://+:52323
- DOTNETMONITOR_Metrics__Endpoints=http://+:52325 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
I want to get started with
dotnet monitorand since I'm using Docker Compose instead of K8s, I created the followingdocker-compose.ymlbased on thedotnet monitorK8s docs:When starting the stack via
docker compose up, it fails withdotnet-monitor-1 | Unhandled exception: System.Net.Sockets.SocketException (13): Permission denied.Logs
Configuration
dotnet info:Output of `dotnet info`
Regression?
I don't know, but I found this post in a Docker forum, so I assume that it used to work for the user.
Other information
/
The text was updated successfully, but these errors were encountered: