Docker - macvlan combination not working

Help Community Help
1

The issue I am facing:
Tried to install a docker instance of pihole using an existing macvlan.
At both ways, via docker script and docker compose, pihole is not starting up correctly.
when using a regular docker command to create the pihole container the initialisation stops at

[services.d] done.

with the following output
s6-svc: fatal: unable to control /var/run/s6/services/lighttpd-access-log: supervisor not listening

the docker compose file is creating the container succesfully but I can not acces the pihole admin gui. Error 403 forbidden

Infos about the setup:

Running on a freshly installed RasPi 4

Here is my docker command
docker run --name=pihole --net=docker_vlan --ip=192.168.2.165 -e ServerIP=192.168.2.165 -e WEBPASSWORD=test -e TZ=timezone -e TEMPERATUREUNIT=c -v /etc-pihole/:/etc/pihole/ -v /etc-dnsmasq.d/:/etc/dnsmasq.d/ --cap-add=NET_ADMIN --restart=unless-stopped pihole/pihole

and the complete output of docker

[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] 01-resolver-resolv: applying...
[fix-attrs.d] 01-resolver-resolv: exited 0.
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] 05-changer-uid-gid.sh: executing...
[cont-init.d] 05-changer-uid-gid.sh: exited 0.
[cont-init.d] 20-start.sh: executing...
 ::: Starting docker specific checks & setup for docker pihole/pihole

  [i] Installing configs from /etc/.pihole...
  [i] Existing dnsmasq.conf found... it is not a Pi-hole file, leaving alone!
  [✓] Installed /etc/dnsmasq.d/01-pihole.conf
  [✓] Installed /etc/dnsmasq.d/06-rfc6761.conf
Existing DNS servers detected in setupVars.conf. Leaving them alone
::: Pre existing WEBPASSWORD found
  [✓] Set temperature unit to C
DNSMasq binding to default interface: eth0
Added ENV to php:
                        "TZ" => "timezone",
                        "PIHOLE_DOCKER_TAG" => "2022.02.1",
                        "PHP_ERROR_LOG" => "/var/log/lighttpd/error.log",
                        "ServerIP" => "192.168.2.165",
                        "CORS_HOSTS" => "",
                        "VIRTUAL_HOST" => "192.168.2.165",
Using IPv4 and IPv6
::: Preexisting ad list /etc/pihole/adlists.list detected ((exiting setup_blocklists early))
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
::: Testing lighttpd config: Syntax OK
::: All config checks passed, cleared for startup ...
::: Enabling Query Logging
  [i] Enabling logging...
  [✓] Logging has been enabled!
 ::: Docker start setup complete
  Checking if custom gravity.db is set in /etc/pihole/pihole-FTL.conf
  Pi-hole version is v5.9 (Latest: v5.9)
  AdminLTE version is v5.11 (Latest: v5.11)
  FTL version is v5.14 (Latest: v5.14)
  Container tag is: 2022.02.1
[cont-init.d] 20-start.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
Starting crond
Starting lighttpd
Starting pihole-FTL (no-daemon) as pihole
[services.d] done.
^CStopping cron
Stopping lighttpd
Stopping pihole-FTL
s6-svc: fatal: unable to control /var/run/s6/services/lighttpd-access-log: supervisor not listening
[cont-finish.d] executing container finish scripts...
[cont-finish.d] done.
s6-svc: fatal: unable to control /var/run/s6/services/lighttpd-error-log: supervisor not listening
[s6-finish] waiting for services.
[s6-finish] sending all processes the TERM signal.
[s6-finish] sending all processes the KILL signal and exiting.

and this is what my docker compose file looks like

version: '2'
 
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    hostname: pihole                      
    group_add:
      - www-data
    mac_address:  e2:09:0e:d4:40:66           
    cap_add:
      - NET_ADMIN
    networks:
      pihole_lan:
        ipv4_address: 192.168.2.165         
    dns:
      - 127.0.0.1
      - 1.1.1.1     
      - 8.8.8.8      
 
    ports:
      - 443/tcp
      - 53/tcp
      - 53/udp
      - 67/udp
      - 80/tcp
    environment:
      ServerIP: 192.168.2.165         
      WEBPASSWORD: "test"               
    restart: unless-stopped
    volumes:
      - ./etc/pihole:/etc/pihole
      - ./etc/dnsmasq.d:/etc/dnsmasq.d
      - ./html/pihole:/var/www/html/pihole

networks:
  pihole_lan:
    external:
      name: docker_vlan

BR Chris

2

Some more information from the docker container log files:

lighttpd/error.log

2022-03-02 13:05:25: (server.c.1464) server started (lighttpd/1.4.53)

pihole.log

Mar  2 13:05:25 dnsmasq[482]: started, version pi-hole-2.87test8 cachesize 10000
Mar  2 13:05:25 dnsmasq[482]: compile time options: IPv6 GNU-getopt no-DBus no-UBus no-i18n IDN DHCP DHCPv6 Lua TFTP no-conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dumpfile
Mar  2 13:05:25 dnsmasq[482]: using nameserver 8.8.8.8#53
Mar  2 13:05:25 dnsmasq[482]: using nameserver 8.8.4.4#53
Mar  2 13:05:25 dnsmasq[482]: using only locally-known addresses for onion
Mar  2 13:05:25 dnsmasq[482]: using only locally-known addresses for bind
Mar  2 13:05:25 dnsmasq[482]: using only locally-known addresses for invalid
Mar  2 13:05:25 dnsmasq[482]: using only locally-known addresses for localhost
Mar  2 13:05:25 dnsmasq[482]: using only locally-known addresses for test
Mar  2 13:05:25 dnsmasq[482]: read /etc/hosts - 7 addresses
Mar  2 13:05:25 dnsmasq[482]: read /etc/pihole/custom.list - 0 addresses
Mar  2 13:05:25 dnsmasq[482]: read /etc/pihole/local.list - 0 addresses
Mar  2 13:05:26 dnsmasq[482]: query[A] raw.githubusercontent.com from 127.0.0.1
Mar  2 13:05:26 dnsmasq[482]: forwarded raw.githubusercontent.com to 8.8.8.8
Mar  2 13:05:26 dnsmasq[482]: forwarded raw.githubusercontent.com to 8.8.4.4
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 185.199.110.133
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 185.199.108.133
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 185.199.111.133
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 185.199.109.133
Mar  2 13:05:26 dnsmasq[482]: query[AAAA] raw.githubusercontent.com from 127.0.0.1
Mar  2 13:05:26 dnsmasq[482]: forwarded raw.githubusercontent.com to 8.8.8.8
Mar  2 13:05:26 dnsmasq[482]: query[A] raw.githubusercontent.com from 127.0.0.1
Mar  2 13:05:26 dnsmasq[482]: cached raw.githubusercontent.com is 185.199.109.133
Mar  2 13:05:26 dnsmasq[482]: cached raw.githubusercontent.com is 185.199.111.133
Mar  2 13:05:26 dnsmasq[482]: cached raw.githubusercontent.com is 185.199.108.133
Mar  2 13:05:26 dnsmasq[482]: cached raw.githubusercontent.com is 185.199.110.133
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 2606:50c0:8003::154
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 2606:50c0:8001::154
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 2606:50c0:8002::154
Mar  2 13:05:26 dnsmasq[482]: reply raw.githubusercontent.com is 2606:50c0:8000::154
Mar  2 13:05:27 dnsmasq[482]: query[PTR] 8.8.8.8.in-addr.arpa from 127.0.0.1
Mar  2 13:05:27 dnsmasq[482]: forwarded 8.8.8.8.in-addr.arpa to 8.8.8.8
Mar  2 13:05:27 dnsmasq[482]: reply 8.8.8.8 is dns.google
Mar  2 13:05:27 dnsmasq[482]: query[PTR] 4.4.8.8.in-addr.arpa from 127.0.0.1
Mar  2 13:05:27 dnsmasq[482]: forwarded 4.4.8.8.in-addr.arpa to 8.8.8.8
Mar  2 13:05:27 dnsmasq[482]: reply 8.8.4.4 is dns.google
Mar  2 13:05:29 dnsmasq[482]: read /etc/hosts - 7 addresses
Mar  2 13:05:29 dnsmasq[482]: read /etc/pihole/custom.list - 0 addresses
Mar  2 13:05:29 dnsmasq[482]: read /etc/pihole/local.list - 0 addresses
Mar  2 13:05:51 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:05:51 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:05:55 dnsmasq[482]: query[A] api.github.com from 127.0.0.1
Mar  2 13:05:55 dnsmasq[482]: forwarded api.github.com to 8.8.8.8
Mar  2 13:05:55 dnsmasq[482]: query[AAAA] api.github.com from 127.0.0.1
Mar  2 13:05:55 dnsmasq[482]: forwarded api.github.com to 8.8.8.8
Mar  2 13:05:55 dnsmasq[482]: reply api.github.com is NODATA-IPv6
Mar  2 13:05:55 dnsmasq[482]: reply api.github.com is 140.82.121.6
Mar  2 13:05:55 dnsmasq[482]: query[A] api.github.com from 127.0.0.1
Mar  2 13:05:55 dnsmasq[482]: cached api.github.com is 140.82.121.6
Mar  2 13:05:55 dnsmasq[482]: query[AAAA] api.github.com from 127.0.0.1
Mar  2 13:05:55 dnsmasq[482]: cached api.github.com is NODATA-IPv6
Mar  2 13:05:56 dnsmasq[482]: query[AAAA] api.github.com from 127.0.0.1
Mar  2 13:05:56 dnsmasq[482]: cached api.github.com is NODATA-IPv6
Mar  2 13:05:56 dnsmasq[482]: query[A] api.github.com from 127.0.0.1
Mar  2 13:05:56 dnsmasq[482]: cached api.github.com is 140.82.121.6
Mar  2 13:06:22 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:06:22 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:06:52 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:06:52 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:07:22 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:07:22 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:07:53 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:07:53 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:08:23 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:08:23 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:08:54 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:08:54 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:09:24 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:09:24 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:09:54 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:09:54 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:10:25 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:10:25 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:10:55 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:10:55 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:11:26 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:11:26 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:11:56 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:11:56 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:12:26 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:12:26 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:12:56 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:12:56 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:13:27 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:13:27 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:13:57 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:13:57 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:14:27 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:14:27 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:14:58 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:14:58 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0
Mar  2 13:15:28 dnsmasq[482]: query[A] pi.hole from 127.0.0.1
Mar  2 13:15:28 dnsmasq[482]: Pi-hole hostname pi.hole is 0.0.0.0

pihole-FTL.log

[2022-03-02 13:05:25.790 482M] Using log file /var/log/pihole-FTL.log
[2022-03-02 13:05:25.790 482M] ########## FTL started on pihole! ##########
[2022-03-02 13:05:25.790 482M] FTL branch: master
[2022-03-02 13:05:25.790 482M] FTL version: v5.14
[2022-03-02 13:05:25.790 482M] FTL commit: 52e6b95
[2022-03-02 13:05:25.790 482M] FTL date: 2022-02-12 19:58:34 +0000
[2022-03-02 13:05:25.790 482M] FTL user: pihole
[2022-03-02 13:05:25.790 482M] Compiled for armv7hf (compiled on CI) using arm-linux-gnueabihf-gcc (Debian 6.3.0-18) 6.3.0 20170516
[2022-03-02 13:05:25.790 482M] Creating mutex
[2022-03-02 13:05:25.790 482M] Creating mutex
[2022-03-02 13:05:25.792 482M] Starting config file parsing (/etc/pihole/pihole-FTL.conf)
[2022-03-02 13:05:25.793 482M]    SOCKET_LISTENING: only local
[2022-03-02 13:05:25.793 482M]    AAAA_QUERY_ANALYSIS: Show AAAA queries
[2022-03-02 13:05:25.793 482M]    MAXDBDAYS: max age for stored queries is 365 days
[2022-03-02 13:05:25.793 482M]    RESOLVE_IPV6: Resolve IPv6 addresses
[2022-03-02 13:05:25.793 482M]    RESOLVE_IPV4: Resolve IPv4 addresses
[2022-03-02 13:05:25.793 482M]    DBINTERVAL: saving to DB file every minute
[2022-03-02 13:05:25.793 482M]    DBFILE: Using /etc/pihole/pihole-FTL.db
[2022-03-02 13:05:25.793 482M]    MAXLOGAGE: Importing up to 24.0 hours of log data
[2022-03-02 13:05:25.793 482M]    PRIVACYLEVEL: Set to 0
[2022-03-02 13:05:25.793 482M]    IGNORE_LOCALHOST: Show queries from localhost
[2022-03-02 13:05:25.793 482M]    BLOCKINGMODE: Null IPs for blocked domains
[2022-03-02 13:05:25.793 482M]    ANALYZE_ONLY_A_AND_AAAA: Disabled. Analyzing all queries
[2022-03-02 13:05:25.793 482M]    DBIMPORT: Importing history from database
[2022-03-02 13:05:25.794 482M]    PIDFILE: Using /run/pihole-FTL.pid
[2022-03-02 13:05:25.794 482M]    PORTFILE: Using /run/pihole-FTL.port
[2022-03-02 13:05:25.794 482M]    SOCKETFILE: Using /run/pihole/FTL.sock
[2022-03-02 13:05:25.794 482M]    SETUPVARSFILE: Using /etc/pihole/setupVars.conf
[2022-03-02 13:05:25.794 482M]    MACVENDORDB: Using /etc/pihole/macvendor.db
[2022-03-02 13:05:25.794 482M]    GRAVITYDB: Using /etc/pihole/gravity.db
[2022-03-02 13:05:25.794 482M]    PARSE_ARP_CACHE: Active
[2022-03-02 13:05:25.794 482M]    CNAME_DEEP_INSPECT: Active
[2022-03-02 13:05:25.795 482M]    DELAY_STARTUP: No delay requested.
[2022-03-02 13:05:25.795 482M]    BLOCK_ESNI: Enabled, blocking _esni.{blocked domain}
[2022-03-02 13:05:25.795 482M]    NICE: Cannot change niceness to -10 (permission denied)
[2022-03-02 13:05:25.795 482M]    MAXNETAGE: Removing IP addresses and host names from network table after 365 days
[2022-03-02 13:05:25.795 482M]    NAMES_FROM_NETDB: Enabled, trying to get names from network database
[2022-03-02 13:05:25.795 482M]    EDNS0_ECS: Overwrite client from ECS information
[2022-03-02 13:05:25.795 482M]    REFRESH_HOSTNAMES: Periodically refreshing IPv4 names
[2022-03-02 13:05:25.795 482M]    RATE_LIMIT: Rate-limiting client making more than 1000 queries in 60 seconds
[2022-03-02 13:05:25.795 482M]    LOCAL_IPV4: Automatic interface-dependent detection of address
[2022-03-02 13:05:25.795 482M]    LOCAL_IPV6: Automatic interface-dependent detection of address
[2022-03-02 13:05:25.795 482M]    BLOCK_IPV4: Automatic interface-dependent detection of address
[2022-03-02 13:05:25.795 482M]    BLOCK_IPV6: Automatic interface-dependent detection of address
[2022-03-02 13:05:25.795 482M]    REPLY_ADDR4: Using IPv4 address 0.0.0.0 instead of automatically determined IP address
[2022-03-02 13:05:25.796 482M]    SHOW_DNSSEC: Enabled, showing automatically generated DNSSEC queries
[2022-03-02 13:05:25.796 482M]    MOZILLA_CANARY: Enabled
[2022-03-02 13:05:25.796 482M]    PIHOLE_PTR: internal PTR generation enabled (pi.hole)
[2022-03-02 13:05:25.796 482M]    ADDR2LINE: Enabled
[2022-03-02 13:05:25.796 482M]    REPLY_WHEN_BUSY: Permit queries when the database is busy
[2022-03-02 13:05:25.796 482M]    BLOCK_TTL: 2 seconds
[2022-03-02 13:05:25.796 482M]    BLOCK_ICLOUD_PR: Enabled
[2022-03-02 13:05:25.796 482M]    CHECK_LOAD: Enabled
[2022-03-02 13:05:25.796 482M]    CHECK_SHMEM: Warning if shared-memory usage exceeds 90%
[2022-03-02 13:05:25.796 482M]    CHECK_DISK: Warning if certain disk usage exceeds 90%
[2022-03-02 13:05:25.796 482M] Finished config file parsing
[2022-03-02 13:05:25.798 482M] Database version is 12
[2022-03-02 13:05:25.798 482M] Resizing "FTL-strings" from 40960 to (81920 * 1) == 81920 (/dev/shm: 1.1MB used, 67.1MB total, FTL uses 1.1MB)
[2022-03-02 13:05:25.798 482M] Imported 0 alias-clients
[2022-03-02 13:05:25.798 482M] Database successfully initialized
[2022-03-02 13:05:25.936 482M] New upstream server: 8.8.8.8:53 (0/256)
[2022-03-02 13:05:25.937 482M] New upstream server: 8.8.4.4:53 (1/256)
[2022-03-02 13:05:25.937 482M] Imported 52 queries from the long-term database
[2022-03-02 13:05:25.938 482M]  -> Total DNS queries: 52
[2022-03-02 13:05:25.938 482M]  -> Cached DNS queries: 24
[2022-03-02 13:05:25.938 482M]  -> Forwarded DNS queries: 28
[2022-03-02 13:05:25.938 482M]  -> Blocked DNS queries: 0
[2022-03-02 13:05:25.938 482M]  -> Unknown DNS queries: 0
[2022-03-02 13:05:25.938 482M]  -> Unique domains: 4
[2022-03-02 13:05:25.938 482M]  -> Unique clients: 1
[2022-03-02 13:05:25.938 482M]  -> Known forward destinations: 2
[2022-03-02 13:05:25.938 482M] Successfully accessed setupVars.conf
[2022-03-02 13:05:25.939 482M] listening on 0.0.0.0 port 53
[2022-03-02 13:05:25.939 482M] listening on :: port 53
[2022-03-02 13:05:25.943 482M] PID of FTL process: 482
[2022-03-02 13:05:25.943 482/T502] Listening on port 4711 for incoming IPv4 telnet connections
[2022-03-02 13:05:25.944 482M] INFO: FTL is running as user pihole (UID 999)
[2022-03-02 13:05:25.944 482M] Reloading DNS cache
[2022-03-02 13:05:25.945 482/T504] Listening on Unix socket
[2022-03-02 13:05:26.100 482M] Blocking status is enabled
[2022-03-02 13:05:26.947 482/T505] Compiled 0 whitelist and 0 blacklist regex filters for 1 clients in 0.4 msec
[2022-03-02 13:05:29.856 482M] Reloading DNS cache
[2022-03-02 13:05:29.952 482/T505] SQLite3 message: file renamed while open: /etc/pihole/gravity.db (28)
[2022-03-02 13:05:29.955 482/T505] Compiled 0 whitelist and 0 blacklist regex filters for 1 clients in 0.5 msec
[2022-03-02 13:05:55.850 482M] Blocking status is enabled
3

Any chance you can provide the details to your macvlan config? It should look something like this:

networks:
  pihole_network:
    driver: macvlan
    driver_opts:
      parent: eth0
    ipam:
      config:
        - subnet: 192.168.10.0/24            # <-- Update
          gateway: 192.168.10.252              # <-- Update
          ip_range: 192.168.10.201/32        # <-- Update
4

macvlan was created with those parameters

docker network create -d macvlan --subnet=192.168.2.0/24 --ip-range=192.168.2.160/30 --aux-address 'host=192.168.2.202' --gateway=192.168.2.1 -o parent=eth0 docker_vlan

5

Darn every piece looks like it's in place. I usually don't put 127.0.0.1 as a DNS resolver in the configuration of docker for pi.hole but other than that it looks like it should work.

6

Jup, I already tried what happens if I set only 8.8.8.8 as a DNS provider. Still no luck. The GUI keeps telling me 403.

8

Unfortunatley still no progress on my side. I can not figure out why the PiHole installation prevents me form accessing the GUI or why the regular Docker command failes while executing the container at all.

9

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.