Arr Suite permissions are what's hard for me. A whole bunch of arr's, nzbget, and more in dockers on a linux server with cifs mounted shares to my synology NAS. reddit / selfhosted ---------------------------------------------------------------------- Aniform · 2023-11-02 00:13 All my files are on the Synology NAS and I created folders for nzbget as well as arr suite apps, but unfortunately none of them have permission to use it. The media share is mounted in fstab on an Ubuntu server with a smbcredentials file. I can easily use touch to create files from server without permission issues. I had hoped by creating all docker containers with my username they too would have access, but I'm just not sure how to do so. I tried creating a new user on the NAS with folder access and then having them use that, which happens to be the same username for server login. This is the part that stymies me and my attempts to google similar scenarios lands me at people with docker on their NAS, whereas mine is on the separate server meant to do the heavy lifting. I'll gladly supply more information, I just don't know at this time what else might be of use. ---------------------------------------------------------------------- joecool42069 · 2023-11-02 00:22 Match the UID/GID used for your mount, on your containers? Or how did you mount? I'd recommend showing your fstab and your docker-compose, to get additional help. ---------------------------------------------------------------------- Aniform · 2023-11-02 00:29 # /etc/fstab: static file system information. # # Use 'blkid' to print the universally unique identifier for a # device; this may be used with UUID= as a more robust way to name devices # that works even if disks are added and removed. See fstab(5). # # # / was on /dev/ubuntu-vg/ubuntu-lv during curtin installation /dev/disk/by-id/dm-uuid-LVM- gd6sgYPs43N6H3R51sM2f01nmxXJ3CAugMsNHIGP44etsyjl81D7RdSUly06Deb0 / ext4 defaults 0 1 # /boot was on /dev/sda2 during curtin installation /dev/disk/by-uuid/dfea067b-07e3-4fce-a05a-ce4414dfe3f3 /boot ext4 defaults 0 1 # /boot/efi was on /dev/sda1 during curtin installation /dev/disk/by-uuid/4B35-4A2E /boot/efi vfat defaults 0 1 /swap.img none swap sw 0 0 #Athena Dionysus //172.16.0.253/Dionysus /media/Dionysus cifs credentials=/home/ana fax/.smbcredentials,vers=3.0,uid=1000,gid=1000,_netdev 0 0 #Athena Apollo //172.16.0.253/Apollo /media/Apollo cifs credentials=/home/anafax/ .smbcredentials,vers=3.0,uid=1000,gid=1000,_netdev 0 0 ------------------------ version: "2.1" services: nzbget: image: lscr.io/linuxserver/nzbget:latest container_name: nzbget environment: - PUID=1000 - PGID=1000 - TZ=America/New-York - NZBGET_USER=nzbget #optional <--- I tried changing this to linux machines user and that didn't work. - NZBGET_PASS=tegbzn6789 #optional volumes: - /home/anafax/project/nzbget:/config - /media/Dionysus/data/usenet:/downloads #optional ports: - 6790:6789 restart: unless-stopped ---------------------------------------------------------------------- joecool42069 · 2023-11-02 00:38 gid/uid 1000:1000, does a user with those values exist on your nas? If not, change those values to the user account gid/uid on the nas you want to use. You can get that by sshing into the NAS the user account you want to use and just issue an 'id' command. Match that account's uid/gid in fstab and on your container. ---------------------------------------------------------------------- joecool42069 · 2023-11-02 00:56 also.. you can test your permissions from within the container. docker exec -it nzbget /bin/sh cd /downloads touch test ls -al id ---------------------------------------------------------------------- Aniform · 2023-11-02 01:05 Ok, so like so? --- version: "2.1" services: nzbget: image: lscr.io/linuxserver/nzbget:latest container_name: nzbget environment: - PUID=1026 - PGID=100 - TZ=America/New-York - NZBGET_USER=nzbget #optional - NZBGET_PASS=tegbzn6789 #optional volumes: - /home/anafax/project/nzbget:/config - /media/Dionysus/data/usenet:/downloads #optional ports: - 6790:6789 restart: unless-stopped Or should the nzbget user be the user on the nas with that access? I also changed the lines for UID and GID in the fstab. So far, no change after a mount -a and a recreation of the container. ---------------------------------------------------------------------- Aniform · 2023-11-02 01:19 ah, it's working! Strange I still get an error in nzbget, I'll have to see if it is erroneous. ---------------------------------------------------------------------- Aniform · 2023-11-02 01:26 error Wed Nov 01 2023 21:24:16 Error saving diskstate: Could not create file /downloads/queue/history.new: Permission denied error Wed Nov 01 2023 21:24:16 Error saving log: Could not create file /downloads/queue/n3.log that's all I get from nzbget, which is odd, because I can literally touch test into any folders on the share from docker exec. ---------------------------------------------------------------------- knook · 2023-11-02 02:16 Username means nothing outside the current host you are on. On your host the username is associated to an ID number, the UID. The group to GID. You need to make sure UID/GID matches across systems. Also, why are you using Samba/CIFS, on Linux systems? Those are for Windows, you should use NFS. ---------------------------------------------------------------------- Aniform · 2023-11-02 02:40 I was under the impression synology didn't like NFS, but it's been there a while, so I may have had trouble setting up NFS years ago and then just stuck with it. So, my synology lists all folders as 1000:1000 despite when I did id and it returned 1026:100 for the user. So, sure, 1026:100 works within the container, but outside the container it's hitting a wall and I don't understand how to change it. I'm scared to change the synology shares to 1026:100, feel like that would break things. ---------------------------------------------------------------------- TigBitties69 · 2023-11-02 06:15 I have the same setup as you, and yes my Synology NFS refuses to work for longer than 24 hours (if it works at all....). But it is possible with smb, if you don't get what you need do me and I can show you what is working for me when I'm at my desktop. ---------------------------------------------------------------------- mdcbldr · 2023-11-02 08:42 My server user id is 1000:1000. When you install docker it puts a docker group on your system. My docker group gid is 995. Add your server user to the docker group. usermod -a -G groupname username I run all containers with PUID=1000 GUID=995. Check your folder permissions and chown all to 1000:995. The first time a container runs it may write some root:root directories or files. Chown them to 1000:995 also. chown -R serveruser:docker target_ directory The docker group is my default group. I have all media directories and files set to 1000:995. Ditto configs. This should get rid of most of your permission issues. Well, if you use a pi as your media server. Samba presents it's own issues. You have to have the 1000:995 in the servers user list and in the samba users lists. The file permissions and the share permissions have to be set to 1000:995 also. I hate Samba. I wish someone would come up with something that makes sense and works. Adjust the PUID and GUID to your system parameters. ---------------------------------------------------------------------- ithakaa · 2023-11-02 10:42 I’ve never had a single issue with synology NFS and I’m running all the RRs as LXCs in Proxmox ---------------------------------------------------------------------- Aniform · 2023-11-02 13:50 Ok, I did the first part, adding the server user to docker, on my server docker is 119. I'm however a little unclear, if I'm changing permissions on the server, on docker to 1000:119, great. But, if I change it on my Synology, aren't I breaking things? Then the Synology wouldn't have ownership. I apologize, great write up, I'm just dumb when it comes to permissions. ---------------------------------------------------------------------- Aniform · 2023-11-02 14:08 Thank you! Sometimes seeing others setups can be easier for me, because once I see it done, I get it. ---------------------------------------------------------------------- mdcbldr · 2023-11-02 20:00 I have to punt at this point. I have never touched Synology. I have read enough to know Synology has its ins and outs. Add the Synology user to the docker group? Make the Synology user your docker user? I am just guessing. The Synology reddit may have the answer. My NAS is a raid 10 drive run as a samba share and ftp on a separate stack (not the ARR stack). Crude but it works. Permissions have been a pain. I tried ACLs, then 777 everything (stupid, I know), before going the serveruser:docker solution. It works. You can add masks with the linuxserver images to get a little more security. I should mention that my servers are not open to the Internet. I still lock down all ports except the ones called out in my compose files. They are strictly internal/private. I can get away with a little less security. ---------------------------------------------------------------------- Aniform · 2023-11-02 20:15 Thanks, this gives me some decent avenues to go down. ---------------------------------------------------------------------- Aniform · 2023-11-03 00:02 So for NZBget I added to the docker-compose file UMASK=002 and now it works perfectly. However, Radarr refuses to do the same. In fact, Radarr isn't even saving changes, it's like it doesn't have permission to use its own files. I'll be trying to root that out. ---------------------------------------------------------------------- mdcbldr · 2023-11-04 23:27 Kinda nice when it all comes together. Then you decide you want to add to it, and it all goes to hell. At least that is my dev method.