Portainer repeatedly showing error

[bma73-bma]

Hi,

I'm trying this out with a Portainer container and it looks like everything is working, I can access Portainer and see the containers etc. But when I look in the Portainer container log file I see this repeated warning:

WRN github.com/portainer/portainer/api/platform/platform.go:70 > failed to retrieve docker info | error="Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?"

My docker-compose.yml:

services:
  # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
  socket-proxy:
    container_name: socket-proxy
    image: wollomatic/socket-proxy:1
    restart: unless-stopped
    user: "65534:988"
    mem_limit: 64M
    read_only: true
    cap_drop:
    - ALL
    security_opt:
    - no-new-privileges
    command:
    - '-loglevel=debug'
    - '-listenip=0.0.0.0'
    - '-allowfrom=portainer'
    #- '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)'
    - '-allowGET=.*'
    - '-allowHEAD=.*'
    - '-allowPOST=.*'
    - '-allowPUT=.*'
    - '-allowPATCH=.*'
    - '-allowDELETE=.*'
    - '-allowCONNECT=.*'
    - '-allowTRACE=.*'
    - '-allowOPTIONS=.*'
    - '-watchdoginterval=3600'
    - '-stoponwatchdog'
    - '-shutdowngracetime=5'
    volumes:
    - "/var/run/docker.sock:/var/run/docker.sock"
    networks:
      socket_proxy:

  portainer:
    container_name: portainer
    image: portainer/portainer-ce:latest # Use portainer-ce if you do no have a Business Edition license key
    security_opt:
    - no-new-privileges:true
    restart: unless-stopped
    networks:
    - default
    - socket_proxy
    command: -H tcp://socket-proxy:2375
    ports:
    - "9000:9000"
    volumes:
    - /home/ubuntu/docker/appdata/portainer/data:/data # Change to local directory if you want to save/transfer config locally
    environment:
    - TZ='Europe/Stockholm'
    depends_on:
      - socket-proxy

networks:
  default:
    driver: bridge
  socket_proxy:
    name: socket_proxy
    driver: bridge
    internal: true

I allow all using the =.* because I want to figure out how to write the correct regexp needed. I don't really understand those expressions yet :)

Is this warning something to care about or should I just ignore it?

[wollomatic]

Hi @bma73-bma,

After a short check, the config looks good. But it seems that Portainer tries to connect to unix:///var/run/docker.sock instead of the proxy. How do the log entries of the socket proxy container look?

[bma73-bma]

Hi,

I see this every hour:

time=2024-09-28T06:25:29.329Z level=DEBUG msg="checking socket availability" origin=checkSocketAvailability

Then this section repeats every 5 min:

time=2024-09-28T06:58:01.026Z level=DEBUG msg="allowed request" method=GET URL="/containers/json?all=1" client=192.168.91.3:43852
time=2024-09-28T06:58:01.033Z level=DEBUG msg="allowed request" method=GET URL=/volumes client=192.168.91.3:43852
time=2024-09-28T06:58:01.033Z level=DEBUG msg="allowed request" method=GET URL=/networks client=192.168.91.3:43844
time=2024-09-28T06:58:01.033Z level=DEBUG msg="allowed request" method=GET URL=/info client=192.168.91.3:54024
time=2024-09-28T06:58:01.037Z level=DEBUG msg="allowed request" method=GET URL=/version client=192.168.91.3:54020
time=2024-09-28T06:58:01.037Z level=DEBUG msg="allowed request" method=GET URL=/info client=192.168.91.3:43844
time=2024-09-28T06:58:02.294Z level=DEBUG msg="allowed request" method=GET URL=/info client=192.168.91.3:54024
time=2024-09-28T06:58:02.294Z level=DEBUG msg="allowed request" method=GET URL="/containers/json?all=true" client=192.168.91.3:54020

As soon as I open the logs via Portainer I see these two lines:

time=2024-09-28T06:58:05.426Z level=DEBUG msg="allowed request" method=GET URL=/containers/a6e0f649a884796be1fee79d900c82166075e20fe8d8bdf6c630a17ac9e2b183/json client=192.168.91.3:54024
time=2024-09-28T06:58:05.431Z level=DEBUG msg="allowed request" method=GET URL=/containers/a6e0f649a884796be1fee79d900c82166075e20fe8d8bdf6c630a17ac9e2b183/json client=192.168.91.3:54024

As long as I have the log open in Portainer (with the auto-refresh enabled) this line repeats every 3 sec:

time=2024-09-28T06:58:05.432Z level=DEBUG msg="allowed request" method=GET URL="/containers/a6e0f649a884796be1fee79d900c82166075e20fe8d8bdf6c630a17ac9e2b183/logs?since=0&stderr=1&stdout=1&tail=100&timestamps=0" client=192.168.91.3:54024

I looked at the Portainer log again and the warning stops at 21:38 and started again at 06:57 and was repeated until 07:08 with irregular intervals. That's when I logged in this morning and looked at the log files for socket_proxy. (The times are 2h behind in the logs for some reason).

/Björn

[wollomatic]

Looks good, the communication seems to work.
I'll make some tests with Portainer by myself later.

[wollomatic]

I installed Portainer with a similar configuration on my test server. Everything works as it should, but yes I can confirm the Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? message.
I would guess that Portainer tries to connect the docker socket directly in addition to the configured proxy. Maybe to retrieve further information about the given infrastructure.

[bma73-bma]

Thanks for checking.