1

I am putting together an application in docker (compose) that has 2 services:

  • Cardano Node
  • Web Application

Both services/containers shares the node-ipc via volume mount, when I try query tip via the web application, I am getting permission denied. This is my docker-compose.yml

version: "3.5"

services:

  cardano-node:
    container_name: cardano-node
    image: inputoutput/cardano-node:${CARDANO_NODE_VERSION}
    networks: [ my-app-network ]
    environment:
      - NETWORK=${NETWORK}
      - CARDANO_NODE_SOCKET_PATH=/ipc/node.socket
    volumes:
      - node-db:/data/db
      - node-ipc:/ipc
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

  web-service:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    container_name: web-service
    tty: true
    networks: [ my-app-network ]
    volumes:
      - ../application:/home/web/application
      - node-ipc:/ipc
    environment:
      - CARDANO_NODE_SOCKET_PATH=/ipc/node.socket
    ports: [ "8080:80" ]

volumes:
  node-db:
  node-ipc:

networks:
  my-app-network:

After building the above, I shelled into the web-service container and ran the following:

./bin/cardano-cli query tip --testnet-magic 2

Getting this error:

cardano-cli: Network.Socket.connect: <socket: 11>: permission denied (Permission denied)

I checked the /ipc/node.socket exists via the shared volume mount and I can see it:

web_service@0f78c2f4136e:~/application$ ls -lah /ipc
total 8.0K
drwxr-xr-x 2 root root 4.0K Oct 19 00:13 .
drwxr-xr-x 1 root root 4.0K Oct 19 00:13 ..
srwxr-xr-x 1 root root    0 Oct 19 00:13 node.socket

Any idea why I can't seem to share the node.socket via volume mount?

1
  • According to the docs, this should be possible: hub.docker.com/r/inputoutput/cardano-node Mount a volume for establishing cross-container communication via node.socket docker run -e NETWORK=mainnet -v node-ipc:/ipc inputoutput/cardano-node docker run -e NETWORK=mainnet -v node-ipc:/ipc inputoutput/some-node-client
    – Latheesan
    Oct 19, 2022 at 1:38

1 Answer 1

5

The cardano-node inside the docker run as root, and created node.socket as root:

srwxr-xr-x 1 root root    0 Oct 19 00:13 node.socket

HOW TO:

METHOD 1: You can try to change the owner directly, but next time restart the docker compose, it will back to root again.

sudo chown $USER node.socket

METHOD 2: Try to run cardano-node as your user id. add -u $(id -u ${USER}):$(id -g ${USER}) in docker run command or user: <user id>:<user group> in docker compose

METHOD 3: Remap User ID. Here is the config guide https://docs.docker.com/engine/security/userns-remap

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.