Frequently Asked Questions¶

Some x86_64 hosts running older versions of the Docker engine are not compatible with some images based on Ubuntu Jammy.

If your host is affected you may see errors in your containers such as:

ERROR - Unable to determine java version; make sure Java is installed and callable

Or

Failed to create CoreCLR, HRESULT: 0x80070008

Or

WARNING :: MAIN : webStart.py:initialize:249 : can't start new thread

Long-Term Fix

Upgrade your Docker engine to at least version 20.10.10. Refer to the official Docker docs for installation/update details.

Short-Term Fix

For Docker CLI, run your container with:

--security-opt seccomp=unconfined

For Docker Compose, run your container with:

security_opt:
    - seccomp=unconfined

Some x86_64 hosts have issues running rdesktop based images even with the latest Docker version due to syscalls that are unknown to Docker.

If your host is affected you may see errors in your containers such as:

Failed to close file descriptor for child process (Operation not permitted)

For Docker CLI, run your container with:

--security-opt seccomp=unconfined

For Docker Compose, run your container with:

    security_opt:
    - seccomp=unconfined

This only affects 32 bit installs of distros based on Debian Buster.

This is due to a bug in the libseccomp2 library (dependency of Docker itself), which is fixed. However, it's not pushed to all the repositories.

A GitHub issue tracking this

You have a few options as noted below. Options 1 is short-term, while option 2 is considered the best option if you don't plan to reinstall the device (option 3).

• 502 errors in Jellyfin as seen in linuxserver/docker-jellyfin#71
• Error starting framework core messages in the docker log for Plex. linuxserver/docker-plex#247
• No WebUI for Radarr, even though the container is running. linuxserver/docker-radarr#118
• Images based on our Nginx base-image(Nextcloud, SWAG, Nginx, etc.) fails to generate a certificate, with a message similar to error getting time:crypto/asn1/a_time.c:330
• docker exec <container-name> date returns 1970

If you decide to do option 1 or 2, you should just need to restart the container after confirming you have libseccomp2.4.4 installed.

If 1 or 2 did not work, ensure your Docker install is at least version 20.10.0, refer to the official Docker docs for installation.

Manual patch

Manually install an updated version of the library with dpkg.

wget http://ftp.us.debian.org/debian/pool/main/libs/libseccomp/libseccomp2_2.4.4-1~bpo10+1_armhf.deb
sudo dpkg -i libseccomp2_2.4.4-1~bpo10+1_armhf.deb

Automatic Patch

Add the backports repo for DebianBuster. As seen here.

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC 648ACFD622F3D138
echo "deb http://deb.debian.org/debian buster-backports main" | sudo tee -a /etc/apt/sources.list.d/buster-backports.list
sudo apt update
sudo apt install -t buster-backports libseccomp2

Move to a compatible OS

Reinstall/update your OS to a version that still gets updates.

• Any distro based on DebianStretch does not seem to have this package available
• DebianBuster based distros can get the package trough backports, as outlined in point 2.

Some host file systems types are not compatible with the default storage driver of docker (overlay2)

If your host is affected you may see errors in your containers such as:

ERROR Found no accessible config files

or

Directory not empty. This directory contains an empty ignorecommands sub-directory

As shown in Docker docs

A host filesystem of zfs requires a docker storage driver of zfs and a host file system of btrfs requires a docker storage driver of btrfs. Correcting this oversight will resolve the issue. This is not something that a container change will resolve.

In this example, we will configure a serverTransport rule we can apply to a service, as well as telling Traefik to use https on the backend for the service.

Create a ServerTransport in your dynamic Traefik configuration; we are calling ours ignorecert.

    http:
    serversTransports:
        ignorecert:
        insecureSkipVerify: true

Then on our foo service we tell it to use this rule, as well as telling Traefik the backend is running on https.

    - traefik.http.services.foo.loadbalancer.serverstransport=ignorecert
    - traefik.http.services.foo.loadbalancer.server.scheme=https

Many users have been facing issues that are simply inexplicable. The logs show no problems, the compose is fine, eventually it turns out they've installed the SNAP version of docker which is the source of the issues.

It's difficult to identify the symptoms, but if you are running ubuntu and believe you have done everything correctly, check for SNAP docker.

First the user must be on an appropriate version of ubuntu to face this issue (as far as I am aware)

lsb_release -a would result in something similar to the below output

No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.3 LTS
Release:        22.04
Codename:       jammy

snap list | grep docker would result in something similar to the below output

docker  20.10.24       2904   latest/stable  canonical**  -

This means the snap version of docker is installed. Unfortunately, even if the user installed docker from the proper repo, this snap version will coexist AND be preferred. They will need to remove it, as shown below.

oliver@home-server:~/plexDockerImage$ sudo snap remove docker
[sudo] password for oliver:
2023-11-15T01:06:26Z INFO Waiting for "snap.docker.dockerd.service" to stop.
docker removed
oliver@home-server:~/plexDockerImage$

Following this, confirm nothing related to snap still shows.

~$ sudo whereis docker
docker: /usr/libexec/docker

~$ sudo whereis docker

docker: /usr/bin/docker /etc/docker /usr/libexec/docker /snap/bin/docker.machine /snap/bin/docker.help /snap/bin/docker.compose /snap/bin/docker /usr/share/man/man1/docker.1.gz

Once this is complete, if the expected version isn't present, simply follow docker install on ubuntu

When they finish, running docker commands may result in -bash: /snap/bin/docker: No such file or directory if this is the case, this is simply a shell patch issue, they can launch a new shell or simply input hash -r which should resolve the problem. Version info at the time of this writing should be

~ # docker --version && docker compose version
Docker version 24.0.7, build afdd53b
Docker Compose version v2.21.0