Docker level=error msg="Error listening to socket: listen ip4:icmp 0.0.0.0: socket: operation not permitted" file=icmp.go line=32 about blackbox_exporter HOT 12 CLOSED

The ping binary should not have suid set, but rather have appropriate capabilities:

$ getcap /bin/ping
/bin/ping = cap_net_raw+ep

Same goes for the exporter:
sudo setcap cap_net_raw+ep blackbox_exporter

With this setting the exporter will run properly without suid/uid=0 set.

from blackbox_exporter.

I'm hitting this problem as well. Can't use setcap within the container either.

from blackbox_exporter.

Can you guys try with the master tag ?
The current latest tag is based on alpine and run with an unprivileged user golang.
The current master tag is based on busybox and run as root.

from blackbox_exporter.

This seems like more of a Docker/security/systemd problem than one with the blackbox exporter. I'd suggest asking those communities how to get raw socket access.

0 means failure, in general for boolean metrics 0 is false and 1 is true.

from blackbox_exporter.

Is the golang program somehow dropping perms I wonder? Inside the container I can ping fine.

[root@rojak system]# docker exec -i -t blackboxprober sh
/bin $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=58 time=2.023 ms
64 bytes from 8.8.8.8: seq=1 ttl=58 time=1.748 ms
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss

from blackbox_exporter.

ping is SUID, so it has root.

from blackbox_exporter.

can't the golang binary be setup to also have suid in the Dockerfile?

from blackbox_exporter.

So if we want to run this in Docker we should probably try to do the same thing in this exporter? AFAIK ping is suid, raises privs to open socket & then returns to non-suid to continue. Can we do the same?

from blackbox_exporter.

It's a bit more complicated as 1) we'd need to support dropping privs on all platforms with all the associated options and 2) we'd need to share the one open socket across all the scrapes.

from blackbox_exporter.

True but doable. Could be a "fun" challenge :)

from blackbox_exporter.

Working!

probe_success 1

Thanks!

from blackbox_exporter.

We've documented the requirements now.

from blackbox_exporter.