如何解决exceptions.OSError：[Errno 1]不允许操作（泊坞窗容器）？

Question

I am trying to scan BLE devices with bluepy . My scan.py code is --

from bluepy.btle import Scanner, DefaultDelegate

class ScanDelegate(DefaultDelegate):
    def __init__(self):
        DefaultDelegate.__init__(self)

    def handleDiscovery(self, dev, isNewDev, isNewData):
        if isNewDev:
            print "Discovered device", dev.addr
        elif isNewData:
            print "Received new data from", dev.addr

# prepare scanner
scanner = Scanner().withDelegate(ScanDelegate())

# scan for 5 seconds
devices = scanner.scan(5.0)

for dev in devices:
    print "Device %s (%s), RSSI=%d dB" % (dev.addr, dev.addrType, dev.rssi)
    for (adtype, desc, value) in dev.getScanData():
        print "  %s = %s" % (desc, value)

According to the documentation (mentioned at the very last as Note) --

(1) LE scanning must be run as root

That means we need to run the script with sudo . I run it as --

sudo python scan.py

Basically bluepy-helper requires the sudo to scan. It is required set the capabilities for blupe-helper to run the code without sudo . According to the solution , I did --

sudo setcap 'cap_net_raw,cap_net_admin+eip' /usr/local/lib/python2.7/site-packages/bluepy/bluepy-helper

From the Terminal, the scan code is now run without sudo like --

python scan.py

Finally, I made a Dockerfile --

FROM arm32v7/python:2.7.15-jessie
WORKDIR /usr/app/gfi_ble
COPY . /usr/app/gfi_ble
RUN chmod 755 ./setcap_for_bluepy_helper.sh
RUN pip install -r requirements.txt
CMD ["./setcap_for_bluepy_helper.sh", "--", "python", "src/scan.py"]

The content of the setcap_for_bluepy_helper.sh is --

#!/bin/bash
cmd="$@"
>&2 setcap 'cap_net_raw,cap_net_admin+eip' /usr/local/lib/python2.7/site-packages/bluepy/bluepy-helper
exec $cmd

The image is created successfully but when I run the container I am getting the error like --

Creating con_gfi_ble ... done
Attaching to con_gfi_ble
con_gfi_ble | 2019-01-12 23:06:24+0000 [-] Unhandled Error
con_gfi_ble |   Traceback (most recent call last):
con_gfi_ble |     File "/usr/app/gfi_ble/src/scan.py", line 17, in new_devices
con_gfi_ble |       devices = scanner.scan(5.0)
con_gfi_ble |     File "/usr/local/lib/python2.7/site-packages/bluepy/btle.py", line 852, in scan
con_gfi_ble |       self.start(passive=passive)
con_gfi_ble |     File "/usr/local/lib/python2.7/site-packages/bluepy/btle.py", line 789, in start
con_gfi_ble |       self._startHelper(iface=self.iface)
con_gfi_ble |     File "/usr/local/lib/python2.7/site-packages/bluepy/btle.py", line 284, in _startHelper
con_gfi_ble |       preexec_fn = preexec_function)
con_gfi_ble |     File "/usr/local/lib/python2.7/subprocess.py", line 394, in __init__
con_gfi_ble |       errread, errwrite)
con_gfi_ble |     File "/usr/local/lib/python2.7/subprocess.py", line 1047, in _execute_child
con_gfi_ble |       raise child_exception
con_gfi_ble |   exceptions.OSError: [Errno 1] Operation not permitted
con_gfi_ble | 

Question: What does exceptions.OSError: [Errno 1] Operation not permitted?

My code is fine when I run it from Terminal. What's wrong with the container? Any idea!

Answer 1

Docker containers run with reduced capabilities. This prevents root inside a container from escaping the container by running kernel commands without namespaces, and accessing parts of the host outside of the container, like raw network interfaces or physical devices. You need to add capabilities to the container externally if you need them, but understand this reduces the security provided by docker's default settings.

From docker run , this looks like:

docker run --cap-add=NET_ADMIN --cap-add=NET_RAW ...

https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

In a compose file, this looks like:

version: '2'

services:
  app:
    image: your_image
    cap_add:
      - NET_ADMIN
      - NET_RAW

Ref: https://docs.docker.com/compose/compose-file/

This will not work with swarm mode. Work is ongoing for adding the ability to run commands with added capabilities within swarm mode. There are ugly workarounds if you need this.

Note that you should not be running sudo inside of a container. Doing so means everything has access to promote itself to root and defeats the purpose of running anything as a user. Instead you should start the container as root and drop to a regular user as soon as possible, which is a one way operation.