[Bug]: Version 0.10 fails to run Docker

[Mad-scientist-star]

Is there an existing issue for the same bug?

• I have checked the existing issues.

Describe the bug and reproduction steps

Using the latest install instructions, everything seems to be fine until you're suddenly faced with this: "groupadd: group 'docker' already exists", and then it just shuts down. I also tested the "main" image, and even downloaded the source code and ran docker-run and the same thing happens. Someone else on discord also experienced this, but I thought maybe it would be noticed faster if posting here.

OpenHands Installation

Docker command in README

OpenHands Version

0.10, main

Operating System

Linux

Logs, Errors, Screenshots, and Additional Context

╰─λ docker logs openhands-app-20241020111631
Starting OpenHands...
Setting up enduser with id 1000
Docker socket group id: 950
Creating group with id 950
groupadd: group 'docker' already exists

I was able to fix this by getting Claude to edit "/containers/app/entrypoint.sh", but that was a sloppy workaround that seemed to cause the docker service to get disrupted pretty quickly.

[Mad-scientist-star]

@SmartManoj Yes, that worked.

[mamoodi]

@Mad-scientist-star thanks for opening up this issue. Can you please try 0.9.8 and see if it works by running:

docker run -it --pull=always \
    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=ghcr.io/all-hands-ai/runtime:0.9.8-nikolaik \
    -e SANDBOX_USER_ID=$(id -u) \
    -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
    -v $WORKSPACE_BASE:/opt/workspace_base \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 3000:3000 \
    --add-host host.docker.internal:host-gateway \
    --name openhands-app-$(date +%Y%m%d%H%M%S) \
    ghcr.io/all-hands-ai/openhands:0.9.8

I'll try to get some eyes on this.

[Mad-scientist-star]

@mamoodi I downloaded and ran 0.9.8 server out of the box no problems.

[mamoodi]

I modified the code to:

DOCKER_SOCKET_GID=$(stat -c '%g' /var/run/docker.sock)
DOCKER_SOCKET_GROUP=$(stat -c '%G' /var/run/docker.sock)

echo "Docker socket group $DOCKER_SOCKET_GROUP with group ID $DOCKER_SOCKET_GID"

if getent group $DOCKER_SOCKET_GROUP; then
    echo "Group $DOCKER_SOCKET_GROUP already exists"
  else
    echo "Creating group $DOCKER_SOCKET_GROUP with id $DOCKER_SOCKET_GID"
    groupadd -g $DOCKER_SOCKET_GID docker
  fi

and asked mad-scientist to run the new image. They got:

Starting OpenHands...
Setting up enduser with id 1000
Creating enduser with ID 1000
Docker socket group UNKNOWN with group ID 950
Creating group UNKNOWN with id 950
groupadd: group 'docker' already exists

I'm confused, how is the docker socker group while having a GID? Is it a permission issue with getting the group?

[Elias966]

in the latest verion of macos its running well, i installed for the first time docker and then ran the command and it launched the web-server with no errors, testing it now using anthropic, i am using intel mac and update verion 0.10, it did say group is already exists but he continued as enduser and ran it

[mamoodi]

Yep. This seems to be linux only. I'm trying to help debug it with mad-scientist. Thanks for confirming 🙏

[ParkerrDev]

I am experiencing this issue as well on NixOS on 0.10.0 Running as root fails on group already added. And running without root, I run into permission errors when chatting. I have rootless docker enabled in my config, and have added the docker group to my user. I tried downgrading to 0.9.8 and that seems to work at first, but then I try chatting with Ollama/llama3:8b, and it is broken.

[mamoodi]

@ParkerrDev are you able to try this:

docker run -it \
    -e SANDBOX_RUNTIME_CONTAINER_IMAGE=ghcr.io/all-hands-ai/runtime:0.10-nikolaik \
    -e SANDBOX_USER_ID=$(id -u) \
    -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
    -v $WORKSPACE_BASE:/opt/workspace_base \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 3000:3000 \
    --add-host host.docker.internal:host-gateway \
    --name openhands-app-$(date +%Y%m%d%H%M%S) \
    ghcr.io/all-hands-ai/openhands:c1011fbfa503a256e1917f9fba4fe2cdc63a5df5

It will fail, but it has some extra logging. I'm trying to see if the creating of the group is even necessary. If you do run it, can you post the logs starting with Starting OpenHands please?

[corrosive4354]

If you need to modify entrypoint.sh, consider adding a conditional check in the script to avoid creating the docker group repeatedly. For example:
if ! getent group docker > /dev/null; then
groupadd docker
fi
If that still doesn't work, you can try using Servbay instead of docker, which is better than docker on mac and has fewer bugs