<p>The cardano-node inside the docker run as root, and created node.socket as root:</p>
<pre><code>srwxr-xr-x 1 root root    0 Oct 19 00:13 node.socket
</code></pre>
<p>HOW TO:</p>
<p>METHOD 1: You can try to change the owner directly, but next time restart the docker compose, it will back to root again.</p>
<pre><code>sudo chown $USER node.socket
</code></pre>
<p>METHOD 2: Try to run cardano-node as your user id.
add <code>-u $(id -u ${USER}):$(id -g ${USER})</code> in docker run command or <code>user: &lt;user id&gt;:&lt;user group&gt;</code> in docker compose</p>
<p>METHOD 3: Remap User ID.
Here is the config guide
<a href="https://docs.docker.com/engine/security/userns-remap" rel="noreferrer">https://docs.docker.com/engine/security/userns-remap</a></p>

CC BY-SA 4.0
2022-10-19T08:39:02.183Z
2022-10-19T08:39:02.183Z
Weili Yi
<p>I am putting together an application in docker (compose) that has 2 services:</p>
<ul>
<li>Cardano Node</li>
<li>Web Application</li>
</ul>
<p>Both services/containers shares the node-ipc via volume mount, when I try <code>query tip</code> via the web application, I am getting permission denied. This is my <code>docker-compose.yml</code></p>
<pre class="lang-yml prettyprint-override"><code>version: &quot;3.5&quot;

services:

  cardano-node:
    container_name: cardano-node
    image: inputoutput/cardano-node:${CARDANO_NODE_VERSION}
    networks: [ my-app-network ]
    environment:
      - NETWORK=${NETWORK}
      - CARDANO_NODE_SOCKET_PATH=/ipc/node.socket
    volumes:
      - node-db:/data/db
      - node-ipc:/ipc
    logging:
      driver: &quot;json-file&quot;
      options:
        max-size: &quot;200k&quot;
        max-file: &quot;10&quot;

  web-service:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    container_name: web-service
    tty: true
    networks: [ my-app-network ]
    volumes:
      - ../application:/home/web/application
      - node-ipc:/ipc
    environment:
      - CARDANO_NODE_SOCKET_PATH=/ipc/node.socket
    ports: [ &quot;8080:80&quot; ]

volumes:
  node-db:
  node-ipc:

networks:
  my-app-network:
</code></pre>
<p>After building the above, I shelled into the <code>web-service</code> container and ran the following:</p>
<pre><code>./bin/cardano-cli query tip --testnet-magic 2
</code></pre>
<p>Getting this error:</p>
<blockquote>
<p>cardano-cli: Network.Socket.connect: &lt;socket: 11&gt;: permission denied (Permission denied)</p>
</blockquote>
<p>I checked the <code>/ipc/node.socket</code> exists via the shared volume mount and I can see it:</p>
<pre><code>web_service@0f78c2f4136e:~/application$ ls -lah /ipc
total 8.0K
drwxr-xr-x 2 root root 4.0K Oct 19 00:13 .
drwxr-xr-x 1 root root 4.0K Oct 19 00:13 ..
srwxr-xr-x 1 root root    0 Oct 19 00:13 node.socket
</code></pre>
<p>Any idea why I can't seem to share the <code>node.socket</code> via volume mount?</p>

CC BY-SA 4.0
2022-10-19T01:38:15.460Z
According to the docs, this should be possible: https://hub.docker.com/r/inputoutput/cardano-node


 Mount a volume for establishing cross-container communication via node.socket

`docker run -e NETWORK=mainnet -v node-ipc:/ipc inputoutput/cardano-node`
`docker run -e NETWORK=mainnet -v node-ipc:/ipc inputoutput/some-node-client`
Latheesan
<cardano-cli><cardano-node><docker>
Network.Socket.connect: <socket: 11>: permission denied error accessing node.socket over shared volume mount in docker
# Network.Socket.connect: <socket: 11>: permission denied error accessing node.socket over shared volume mount in docker

(Asked by: username_0 on 2022-10-19)

I am putting together an application in docker (compose) that has 2 services:

Cardano Node
Web Application

Both services/containers shares the node-ipc via volume mount, when I try query tip via the web application, I am getting permission denied. This is my docker-compose.yml
version: "3.5"

services:

  cardano-node:
    container_name: cardano-node
    image: inputoutput/cardano-node:${CARDANO_NODE_VERSION}
    networks: [ my-app-network ]
    environment:
      - NETWORK=${NETWORK}
      - CARDANO_NODE_SOCKET_PATH=/ipc/node.socket
    volumes:
      - node-db:/data/db
      - node-ipc:/ipc
    logging:
      driver: "json-file"
      options:
        max-size: "200k"
        max-file: "10"

  web-service:
    build:
      context: ..
      dockerfile: docker/Dockerfile
    container_name: web-service
    tty: true
    networks: [ my-app-network ]
    volumes:
      - ../application:/home/web/application
      - node-ipc:/ipc
    environment:
      - CARDANO_NODE_SOCKET_PATH=/ipc/node.socket
    ports: [ "8080:80" ]

volumes:
  node-db:
  node-ipc:

networks:
  my-app-network:

After building the above, I shelled into the web-service container and ran the following:
./bin/cardano-cli query tip --testnet-magic 2

Getting this error:

cardano-cli: Network.Socket.connect: : permission denied (Permission denied)

I checked the /ipc/node.socket exists via the shared volume mount and I can see it:
web_service@0f78c2f4136e:~/application$ ls -lah /ipc
total 8.0K
drwxr-xr-x 2 root root 4.0K Oct 19 00:13 .
drwxr-xr-x 1 root root 4.0K Oct 19 00:13 ..
srwxr-xr-x 1 root root    0 Oct 19 00:13 node.socket

Any idea why I can't seem to share the node.socket via volume mount?

**Tags:** cardano-cli, cardano-node, docker
> **Comments:**
> **username_0**: According to the docs, this should be possible: https://hub.docker.com/r/inputoutput/cardano-node    Mount a volume for establishing cross-container communication via node.socket  `docker run -e NETWORK=mainnet -v node-ipc:/ipc inputoutput/cardano-node` `docker run -e NETWORK=mainnet -v node-ipc:/ipc inputoutput/some-node-client`  

---

## 1 answers

### Answer by username_1 on 2022-10-19. Score: 5

The cardano-node inside the docker run as root, and created node.socket as root:
srwxr-xr-x 1 root root    0 Oct 19 00:13 node.socket

HOW TO:
METHOD 1: You can try to change the owner directly, but next time restart the docker compose, it will back to root again.
sudo chown $USER node.socket

METHOD 2: Try to run cardano-node as your user id.
add -u $(id -u ${USER}):$(id -g ${USER}) in docker run command or user: : in docker compose
METHOD 3: Remap User ID.
Here is the config guide
https://docs.docker.com/engine/security/userns-remap


---

