mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-08 21:59:09 -05:00
[GH-ISSUE #1207] SqliteError: unable to open database file when using podman #6605
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#6605
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @hseliger on GitHub (Aug 3, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1207
Hi!
I am tryying to install pangoin under linux (Alma Linux 9) using podman and podman-compose. The installer starts, creates the folder structure and all configuration files, but then hangs. I have checked the created files against the documentation and compared to "manual installation using docker compose". All seems fine (some minor additions the installer seems to make, such as enabling ipv6).
When I run
podman compose up(skipping the "-d" so I see the output) I get the follwing sqlite error:SInce my assumption is that all commands are running inside the container environment, it should not be an issue of missing packages on the system. Permissions should not be an issue. Podman is run as root and I tried setting config/db folder permissions to world-writable (777) which did not change things.
Anything I can do to get it started? I could not find a matching existing issue, but it could of course still be that I am the problem…
Cheers,
Hendrik
@oschwartz10612 commented on GitHub (Aug 3, 2025):
Hum it should have generated a
db.sqlitefile in yourconfig/db/directory. Is there a file there?If not it is supposed to create one which is strange.
@hseliger commented on GitHub (Aug 3, 2025):
No, the directory db was created but no file im it. That's why I tried with world-writable, to no avail.
Here is what was created:
@AdamWorley commented on GitHub (Aug 4, 2025):
I am also seeing this when running the quick start guide using docker (compose). The file is created for me but the file it would seem is read only
Attempting to delete the "tmp" folder I added for testing results in the following if this is of any help
@hseliger commented on GitHub (Aug 5, 2025):
An update from my end: I remove podman and installed docker-ce. Now pangolin installs and runs correctly. I've so fr never had problems using podman, at least as long as I run it as root (user podman and priviledged ports is an issue), so no idea what the problem is. I've amended the topic accordingly)
@KorewaLidesu commented on GitHub (Aug 5, 2025):
I have same problem with this
I think it is due to installer use root to create folder, which cause issue when normal user try start Pangolin on userspace mode
This can be fix by simply run podman compose on root (via
sudo) instead of normal user.Or manual fix permission.
@hseliger commented on GitHub (Aug 5, 2025):
This cannot be all, because I did run podman compose as root. I'm installing on a virtual server that should only serve pangolin, so there aren't any other users on that machine. I run the installer for pangolin as root and that already fails to set up the sqlite db.
@oschwartz10612 commented on GitHub (Aug 6, 2025):
I suspect you are probably onto something here. Docker and podman have differences in the permissions inside and around the containers. The database is actually created inside of the container and because the volume is mounted it would have the permissions of the process inside of that first container. But if the volume is not writable by the podman container because it was created by root then you would have an issue there.
This probably warrants some investigation! @wayneyaoo thoughts?
@wayneyaoo commented on GitHub (Aug 30, 2025):
Hi @oschwartz10612 and @hseliger I took some time to look into this today. So I had a repro of the issue on AlmaLinux 9. The symptom was exactly like what was reported. I attempted this and found that in the container the access to the
/app/configdirectory itself was denied:A bit of Googling led me to believe this was a SELinux issue, that container context somehow cannot access host directories unless directory context is configured correctly or SELinux is disabled. This didn't repro on Debian probably because ALMALinux has SELinux enabled by default (in my case) and Debian doesn't.
Solutions are two: either SELinux is disabled or the folder is configured with correct context. I can't recommend disabling SELinux (cough...) but that might be an option for home labs:)
Note
setenforce 0only disables SELinux until next reboot.Please check if Pangolin works correctly after this.
Reference:
@fcrozat commented on GitHub (Aug 30, 2025):
In fact, there is no need to disable SELinux but the default settings for volume selinux protection ensure the volume is only accessable from the original container.
In the Pangolin case, you need to lower a bit the selinux protection of pangolin and gerbil volume.
When using podman quadlet (you can use the same on podman CLI), you go from:
Volume=/var/lib/pangolin:/var/config:Z
to
Volume=/var/lib/pangolin:/var/config:z
Z => z will allow volume to be shared between different containers.
@wayneyaoo commented on GitHub (Aug 30, 2025):
@fcrozat thanks for the info! I tested again with your suggestion by adding a
:zto all the host volumes in thedocker-compose.yml. The directory access was resolved, but I believe some network permission arose.. So the pangolin could start, creating the db just fine with:z, buttraefikandgerbilfailed with these respectively:traefik:
gerbil:
Gven this "ns/net" not found and gerbil not being able to create an interface, I presume SELinux blocked some network config calls? I can probably use some research, but at this point, disabling SELinux as a workaround isn't unreasonable.
@fcrozat commented on GitHub (Aug 30, 2025):
Here is the configuration I use with podman quadlet, which is working fine with SELinux enforcing mode on openSUSE MicroOS (I'll try to create a github repo with those quadlets:
pangolin.container:
gerbil.container:
pangolin.network:
traefik.container:
/etc/modules-load.d/pangolin.conf
(the last file is needed because containers are not allowed to load kernel modules, it is safer to preload them in advance).
@wayneyaoo commented on GitHub (Aug 30, 2025):
:) well, the last file might be the key - I saw Wireguard stuff there. I can give it a try tomorrow.
@pomac303 commented on GitHub (Nov 14, 2025):
I ran in to this as well... so:
1, change the docker file to add :z in the volume mounts, example:
- ./config:/app/config:z
- pangolin-data:/var/certificates:z
- pangolin-data:/var/dynamic:z
setenforce 0 # (can't do it with selinux enforcing)
chcon -R -t container_file_t -u system_u *
setenforce 1
You should now be able to start pangolin