Docker container permission denied while creating paste

[Simon1511]

Describe the problem/question

I'm running PrivateBin through Cloudflare. The site loads fine, but whenever I want to add a paste it tells me "Couldn't create text: Error saving the text".

Did you use the FAQ section?

• Yes, I have read the FAQ and I found no solution/answer there.

What you did?

1. I checked the FAQ and adjusted my Cloudflare config accordingly. RocketLoader is disabled, AutoMinify for JavaScript is disabled too. Also Caching is set to "Bypass".
2. Adjused conf.php to contain the correct URL of my PrivateBin instance
3. Pressed F12 to see the error message, which are as follows:

Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
Content-Security-Policy: The page’s settings blocked the loading of a resource at inline (“style-src”).

What happens

PrivateBin shows an error message when trying to save anything: "Couldn't create text: Error saving the text"

What should happen

Pastes should be saved.

Additional information

No response

Server address

No response

Server OS

Debian 12

Webserver

NGINX

PrivateBin version

1.7.1

Browser and version

Firefox 124, MS Edge

Local operating system and version

Fedora 39, Windows 10, Windows 11

Issue reproducibility

No, I cannot reproduce it on https://privatebin.net.

[Simon1511]

Update: I just tried to access it locally with PrivateBin being proxied by my local NGINX server and there I'm getting the same error message.

[Simon1511]

I'm using the Docker version, so not sure how I would check any of that.

[elrido]

docker logs, of course

Edit: If using one of the images provided by this project, the README.md describes that:

All logs of php-fpm and Nginx (access & errors) are forwarded to docker logs.

You can check those using:

docker logs <your container name here>

[Simon1511]

Sorry, thanks, was looking at logs some time after I tried to paste something and it wasn't showing anything.

So I checked again just now while trying to paste something and got following error:

2024/03/30 17:58:44 [error] 18#18: *3 FastCGI sent in stderr: "PHP message: failed to store the server salt, delete tokens, traffic limiter and user icons won't work; PHP message: failed to store the traffic limiter, it probably contains outdated information; PHP message: failed to store the purge limiter, skipping purge cycle to avoid getting stuck in a purge loop; PHP message: PHP Warning: mkdir(): Permission denied in /srv/lib/Data/Filesystem.php on line 98" while reading response header from upstream, client: 192.168.178.245, server: , request: "POST / HTTP/1.1", upstream: "fastcgi://unix:/run/php-fpm.sock:", host: "mydomain", referrer: "https://mydomain/"

Seems like it doesn't have the neccessary permissions to create a folder. The privatebin-data folder outside of the container is set to 0755 root:root.

[Simon1511]

Okay, I have no idea why this is needed, but setting the perms of the privatebin-data folder to 1000:1000 fixes it.

[elrido]

For future reference, this is documented in the README.md file, section "Running the image":

Note that the volume mounted must be owned by UID 65534 / GID 82. If you run the container in a docker instance with "userns-remap" you need to add your subuid/subgid range to these numbers.

This is because the processes inside the image run under those IDs and not as the root user. This is part of the strategy to minimize risks and ensure the minimal necessary privileges are used to run the services. If your services don't run as root, root privilege escalation becomes much harder.

[Simon1511]

Thanks for the hint, guess I overlooked that.