ping: permission denied (are you root?)

[extremeshok]

Unable to run ping on this image.

ping: permission denied (are you root?)

Example docker-compose, to ensure a server is online before starting will always fail

command: /bin/sh -c "until ping redis -c1 > /dev/null; do sleep 1; done;"

[nberlee]

First of all good for you to either run this container with limited capabilities or as a non-root user.

By default it should work:

# docker run -it pagespeed/nginx-pagespeed:edge  ping -c1 9.9.9.9
PING 9.9.9.9 (9.9.9.9): 56 data bytes
64 bytes from 9.9.9.9: seq=0 ttl=56 time=9.547 ms

--- 9.9.9.9 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 9.547/9.547/9.547 ms

If you run it as a non-root user, this is expected behavior on alpine:

# docker run --user=nginx -it pagespeed/nginx-pagespeed:edge  ping -c1 9.9.9.9
PING 9.9.9.9 (9.9.9.9): 56 data bytes
ping: permission denied (are you root?)

# docker run --user=nginx -it nginx:alpine  ping -c1 9.9.9.9
PING 9.9.9.9 (9.9.9.9): 56 data bytes
ping: permission denied (are you root?)

# docker run --user=nobody -it alpine:edge  ping -c1 9.9.9.9
PING 9.9.9.9 (9.9.9.9): 56 data bytes
ping: permission denied (are you root?)

Ping used to work in the original nginx image when it was based on Debian Jessie. It had an insecure SETUID bit set to elevate it to root. But now in Debian stretch is it removed completely:

# docker run  -it nginx  ping -c1 9.9.9.9 
docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "exec: \"ping\": executable file not found in $PATH": unknown.

However, this doesn't mean it could not work. Ping needs the NET_RAW capability. Either post your nginx-pagespeed section of docker-compose.yaml or do the following:

• Remove the line containing user:
• add security by capabilities (optional):

cap_add:
  - NET_RAW
  - NET_BIND_SERVICE

cap_drop:
  - ALL

So it looks like you do not have the CAP_NET_RAW as capability, This is either because the docker-compose dropped it, or you are running pagespeed-nginx image as a non-root user. If its non of the above works, I would like a look at your docker-compose.yaml in order to replicate it.

[oschaaf]

@extremeshok I think @nberlee's in-depth answer to this is pretty much the canonical one. Can we close this?