CheckMK docker-compose file - /var/spool/cron/ Permission denied

Troubleshooting
,
1

Hi everyone,

I think the access is a permissions error. “/var/spool/cron/” is owned by root, and the user I am running my docker-compose as, is not root. I have setup permissions so that I have to run docker as sudo.

I saw the following topic (and looked it topics it links to): https://forum.checkmk.com/t/docker-crontab-error-starting-container-with-enterprise-image/34855

– On here, it says to run “dpkg-reconfigure cron”. I ran this and it did not change the owner from root, so the issue still happens after running it.

Has anyone been able to run CheckMK in docker run into this issue, or see any issues with my compose file below?

Thanks!

Here are more details:

CMK version: 2.3.0p13.cre
OS version: Ubuntu 22.04.4 LTS

Error message:
Initializing Crontab…/var/spool/cron/: mkstemp: Permission denied

Here is my docker-compose file

version: "3.8"

services:
  checkmk:
    image: checkmk/check-mk-raw:latest
    container_name: checkmk
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/spool/cron:/var/spool/cron:rw
      - /home/sysadmin/Containers/checkmk/data:/omd/sites
      - /home/sysadmin/Containers/backups:/backups
    ports:
      - 9500:5000
      - 8000:8000
      - 162:162/udp
      - 514:514/udp
      - 514:514/tcp
    environment:
      - CMK_SITE_ID=cla
    deploy:
      resources:
        limits:
          memory: 3G
        reservations:
          memory: 2G
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000"]
      interval: 1m30s
      timeout: 10s
      retries: 3
      start_period: 30s
    networks:
      - portainer_network
      
networks:
  portainer_network:
    name: portainer_network
    driver: bridge

Output of “cmk --debug -vvn hostname”: (If it is a problem with checks or plugins)
Here is all of the output when I try to start the container with docker-compose up

Starting checkmk ... done
Attaching to checkmk
checkmk    | ### STARTING XINETD
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...OK
checkmk    | Starting mkeventd...OK
checkmk    | Starting rrdcached...OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache...OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...OK
checkmk    | Starting mkeventd...OK
checkmk    | Starting rrdcached...removing stale pid file...
checkmk    | OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache....OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk exited with code 2
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...OK
checkmk    | Starting mkeventd...OK
checkmk    | Starting rrdcached...removing stale pid file...
checkmk    | OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache...OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk exited with code 2
2

I’ve modified permissions on /var/spool/cron and /var/spool/cron/crontabs to allow access to the user running my docker containers.

I have tested with a dummy docker container and it now has access to cron.

I also modified my docker-compose file and removed several items for testing and granting more permissions. However, I am still getting the permission denied error.

Here is my updated docker-compose file:

version: "3.8"

services:
  checkmk:
    image: checkmk/check-mk-raw:latest
    container_name: checkmk
    #user: "1000"
    user: root
    security_opt:
      - no-new-privileges:false
      - apparmor=unconfined
    restart: unless-stopped
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/spool/cron:/var/spool/cron:ro
      - /home/sysadmin/Containers/checkmk/data:/omd/sites
      - /home/sysadmin/Containers/checkmk/backups:/backups
    ports:
      - 9500:5000
      - 8000:8000
      - 162:162/udp
      - 514:514/udp
      - 514:514/tcp
    environment:
      - CMK_SITE_ID=cla
    #deploy:
    #  resources:
    #    limits:
    #      memory: 3G
    #    reservations:
    #      memory: 2G
    #healthcheck:
    #  test: ["CMD", "curl", "-f", "http://localhost:5000"]
    #  interval: 1m30s
    #  timeout: 10s
    #  retries: 3
    #  start_period: 30s
    networks:
      - portainer_network
      
networks:
  portainer_network:
    name: portainer_network
    driver: bridge

Here is the output

sysadmin@gp-quadro:~/Containers/checkmk$ sudo docker-compose up
Creating checkmk ... done
Attaching to checkmk
checkmk    | ### STARTING XINETD
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...Already running.
checkmk    | Starting mkeventd...Already running.
checkmk    | Starting rrdcached...removing stale pid file...
checkmk    | OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache...OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...OK
checkmk    | Starting mkeventd...OK
checkmk    | Starting rrdcached...removing stale pid file...
checkmk    | OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache...OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk exited with code 2
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...OK
checkmk    | Starting mkeventd...OK
checkmk    | Starting rrdcached...removing stale pid file...
checkmk    | OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache...OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk exited with code 2
checkmk    |  * Starting internet superserver xinetd
checkmk    |    ...done.
checkmk    | ### STARTING SITE
checkmk    | Preparing tmp directory /omd/sites/cla/tmp...Starting agent-receiver...OK
checkmk    | Starting mkeventd...OK
checkmk    | Starting rrdcached...removing stale pid file...
checkmk    | OK
checkmk    | Starting npcd...OK
checkmk    | Starting nagios...OK
checkmk    | Starting apache...OK
checkmk    | Starting redis...OK
checkmk    | Initializing Crontab.../var/spool/cron/: mkstemp: Permission denied
checkmk    | Exception ignored in: <_io.TextIOWrapper name='<stdout>' mode='w' encoding='utf-8'>
checkmk    | BrokenPipeError: [Errno 32] Broken pipe
checkmk    | ERROR
checkmk exited with code 2
3

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.