No permission to read config files on first container start

[DanielKinsman]

This is a: Run Issue

Details

It seems that when the pihole container first starts up, it drops to group id / user id 999:1000 by default. This gid shows up on my system as systemd-coredump which was very strange at first.

Any config files owned by root which were placed there before starting the container (e.g. custom.list) will fail as pihole has no permission to read/write them.

In my case I am automating the pihole config with ansible and docker compose which is why I ran into it. It's easy enough to change the permissions and make it work but it's a bit a of a gotcha that could be improved by having the pihole container chown those files on first startup before it changes gid/uid. As mentioned in #1144 setting the PIHOLE_UID and PIHOLE_GID options to 0 (root) doesn't really work either, and ideally it would just work without needing such a specialised set up.

Related Issues

• I have searched this repository/Pi-hole forums for existing issues and pull requests that look similar
  Same UID and GID in passwd and groups for WEB and PIHOLE #1144
  wrong permissions on sudo* files #1665
  Set PUID and PGID as Variables #328

[rdwebdesign]

Please, provide some information about your container:

• What image are you using?
• Are you using volumes? Which ones?
• How did you start the container? Please post your compose file or docker run command used to start the container.

[DanielKinsman]

Reproducing is as simple as:

rm -rf /opt/piholeetc
mkdir /opt/piholeetc
echo "192.168.1.99 example.com" > /opt/piholeetc/custom.list
chmod 600 /opt/piholeetc/custom.list
docker run -v /opt/piholeetc:/etc/pihole pihole/pihole:latest

Then open the web ui and inspect local dns entries, notice example.com is missing, and also that you can't add new entries through the UI either. It's also a problem for the setupVars.conf but I haven't included that here.

[dschaper]

chmod 600 /opt/piholeetc/custom.list

Why are you restricting this file so much? If you only want the file to be read by the daemon inside the container then you'll need to make the file owned by the same UID as the daemon in the container. GID won't matter because you've set the group to 0 permission.

[dschaper]

Note: You've linked to old issues that do not have the current environment scheme. There are two daemons running in the container, Pi-hole and the webserver, thus there are two sets of UID/GID pairs to consider:

https://github.com/pi-hole/docker-pi-hole?tab=readme-ov-file#experimental-variables

[dschaper]

@DanielKinsman Were you able to resolve the issue? It can be helpful for other users to see resolutions that they can use on their similar problems.

[DanielKinsman]

Not really, I'm just working around it by chowning things on the host.