Cannot write configuration to file: open /updater/data/config.json: permission denied

[numitron]

I've been trying to get this container working in a Portainer stack and I just cannot figure out why I can't get ddns-updater to be able to read or write the config file. I wanted to use a config file instead of an environment variable, but I also tried with the env var like in the following attempt:

Logs:

2023-11-29T02:00:58Z INFO reading JSON config from environment variable CONFIG

2023-11-29T02:00:58Z DEBUG config read: {"settings":[{"provider":"cloudflare","zone_identifier":"*************","domain":"domain.net","host":"@","ttl":1,"token":"****************","proxied":true,"ip_version":"ipv4"},{"provider":"cloudflare","zone_identifier":"****************","domain":"domain.ca","host":"@","ttl":1,"token":"*********************","proxied":true,"ip_version":"ipv4"}]}

2023-11-29T02:00:58Z ERROR cannot write configuration to file: open /updater/data/config.json: permission denied

2023-11-29T02:00:58Z INFO Shutdown successful

docker-compose:

version: "3.7"
services:
  ddns-updater:
    image: qmcgaw/ddns-updater
    container_name: ddns-updater
    ports:
      - 11080:11080/tcp
    volumes:
      - ./data:/updater/data
    environment:
      - CONFIG=<config>
      - UPDATE_COOLDOWN_PERIOD=5m
      - PUBLICIP_FETCHERS=all
      - PUBLICIP_HTTP_PROVIDERS=all
      - PUBLICIPV4_HTTP_PROVIDERS=all
      - PUBLICIPV6_HTTP_PROVIDERS=all
      - PUBLICIP_DNS_PROVIDERS=all
      - PUBLICIP_DNS_TIMEOUT=3s
      - HTTP_TIMEOUT=10s

      # Web UI
      - LISTENING_PORT=11080
      - ROOT_URL=/
      # Backup
      - BACKUP_PERIOD=0 # 0 to disable
      - BACKUP_DIRECTORY=/updater/data

      # Other
      - LOG_LEVEL=debug
      - LOG_CALLER=hidden
      #- SHOUTRRR_ADDRESSES=smtp://**********
    restart: unless-stopped
    labels:
      - "com.centurylinklabs.watchtower.monitor-only=true" # Watchtower. Monitor only.

Dir stats:

root@server:/etc/docker/ddns-updater# stat data
  File: data
Access: (0700/drwx------)  Uid: ( 1000/    ****)   Gid: (    0/    root)

Maybe I am missing something obvious. Does anybody have an idea of what could be the issue?

Thanks.

[rc4l]

Seeing same thing here

2023-11-30T12:21:37-06:00 INFO reading JSON config from file /updater/data/config.json
2023-11-30T12:21:37-06:00 INFO file not found, creating an empty settings file
2023-11-30T12:21:37-06:00 ERROR cannot write configuration to file: open /updater/data/config.json: permission denied
2023-11-30T12:21:37-06:00 INFO Shutdown successful

This is within portainer on a 7.2 synology NAS. With this docker-compose: https://github.com/geekau/media-stack/blob/main/min-vpn_mulitple-yaml/docker-compose-ddns-updater.yaml

[numitron]

Concerning these environment variables:

      - PUID=${PUID:?err}
      - PGID=${PGID:?err}

These won't do anything according to the author. Unless something changed since.

Could you confirm that you followed these steps in the setup section of the Readme?

mkdir data
touch data/config.json
# Owned by user ID of Docker container (1000)
chown -R 1000 data
# all access (for creating json database file data/updates.json)
chmod 700 data
# read access only
chmod 400 data/config.json

However, since you're on a Synology NAS, you're probably stuck with the built-in user and group IDs, which is a PITA.
The solution could be building the container with your IDs so that it can get the permissions in the volume.

[qdm12]

These won't do anything according to the author. Unless something changed since.

Correct, you can also run the container as root with --user=0 or --user=root if you don't mind about the lesser security.

The solution could be building the container with your IDs so that it can get the permissions in the volume.

Correct as well, you can use docker build -t qmcgaw/ddns-updater --build-arg UID=1000 https://github.com/qdm12/ddns-updater.git (provided you have git installed)

EDIT: also note you don't necessarily need a user with id and gid 1000, I don't and it still works.

[numitron]

I've managed to make it work by changing the directory in which the volume was mounted.
It was originally in /etc/docker/ddns-updater/data, with the data folder having the proper ownership and permissions.
However, obviously there is something that I'm missing about ACLs and Docker containers because moving it to its own folder in /home and applying the same ownership and permission fixed the permission issue (/home/docker/ddns-updater/data:/updater/data).

If anybody can chime in on why this is happening, that would be appreciated.

[qdm12]

What does ls -ll /etc/docker/ddns-updater give you in your terminal? 🤔 It could be interesting to document if there is some funny ACL going on Synology systems.

[andymaycoates]

I had a similar issue where the container log informed me that updates.json could not be created due to a permissions issue. I found that the container was trying to write the updates.json file with the UID:GID of 1000:1000, which did not exist on my Synology NAS.

To fix this issue, I noted the UID:GID of another user (ensuring that said user had write permissions on the share mapped to /updater/data in the container) and then built the container instead of pulling an image. This allowed me to supply args to change the UID and GID. Here is an example of my docker-compose file:

version: "3.7"
services:
  ddns-updater:
    build:
      context: https://github.com/qdm12/ddns-updater.git
      args:
        UID: 1026 # Substitute for a user on your NAS
        GID: 100 # Substitute for the user's group on your NAS
    #image: qmcgaw/ddns-updater
    container_name: ddns-updater
    network_mode: "bridge"
    ports:
      - 9988:9988/tcp
    volumes:
      - /volume1/docker/ddns-updater/data:/updater/data
    environment:
      - CONFIG=
      - PERIOD=5m
      - UPDATE_COOLDOWN_PERIOD=5m
      - PUBLICIP_FETCHERS=all
      - PUBLICIP_HTTP_PROVIDERS=all
      - PUBLICIPV4_HTTP_PROVIDERS=all
      - PUBLICIPV6_HTTP_PROVIDERS=all
      - PUBLICIP_DNS_PROVIDERS=all
      - PUBLICIP_DNS_TIMEOUT=3s
      - HTTP_TIMEOUT=10s      
           # Web UI
      - LISTENING_PORT=9988
      - ROOT_URL=/
      - HEALTH_SERVER_ADDRESS=127.0.0.1:9995
      # Backup
      - BACKUP_PERIOD=0 # 0 to disable
      - BACKUP_DIRECTORY=/updater/data
      # Other
      - LOG_LEVEL=info
      - LOG_CALLER=hidden
      - SHOUTRRR_ADDRESSES=
    restart: always

You'll need to make sure you have Git installed before doing the above. I just installed Git Server using the Package Center; no other config required.

[qdm12]

Duplicate of #413
Detailed explanation on how to resolve it is at #413 (comment)