diff --git a/casaos-fix-docker-api-version/README.md b/casaos-fix-docker-api-version/README.md index ec9b869..16f4185 100644 --- a/casaos-fix-docker-api-version/README.md +++ b/casaos-fix-docker-api-version/README.md @@ -9,12 +9,12 @@ This script fixes common Docker errors with CasaOS including: ## The Problem These errors commonly occur with **CasaOS** when: -1. Docker gets upgraded to a very recent version (API 1.44+) that is incompatible with CasaOS's older Docker client +1. Docker gets upgraded to a very recent version (API 1.45+) that is incompatible with CasaOS's older Docker client 2. Docker overlay2 filesystem permissions become corrupted 3. Container runtime state becomes inconsistent 4. **NEW**: containerd.io 1.7.28-2 or newer causes AppArmor permission errors in LXC/Proxmox containers -CasaOS uses Docker API 1.43, and when the system Docker gets auto-upgraded or the storage becomes corrupted, it breaks compatibility. +Older CasaOS versions use Docker API 1.43, and when the system Docker gets auto-upgraded or the storage becomes corrupted, it breaks compatibility. ### Special Note for LXC/Proxmox Users @@ -30,7 +30,7 @@ open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission de This script automatically detects LXC environments and installs **containerd.io 1.7.28-1** (the last version before the breaking change) to prevent this issue. **References:** -- GitHub Issue: https://github.com/opencontainers/runc/issues/4968 +- GitHub Issue: [opencontainers/runc#4968](https://github.com/opencontainers/runc/issues/4968) - Proxmox Forum: https://forum.proxmox.com/threads/docker-inside-lxc-net-ipv4-ip_unprivileged_port_start-error.175437/ ## What does this script do? @@ -44,9 +44,9 @@ This script automatically detects LXC environments and installs **containerd.io - Cleans Docker runtime state and fixes permissions - **Ensures all Docker processes are completely terminated** before upgrade - Fixes overlay2 directory permissions -- Downgrades Docker to version 24.0.7 (compatible with both CasaOS and modern systems) +- Installs Docker 28.0.x (one version behind latest for stability, API 1.47/1.48) - **Verifies the dockerd binary version** after installation -- **Installs containerd.io 1.7.28-1** in LXC/Proxmox to avoid CVE-2025-52881 AppArmor issues +- **Installs containerd.io 1.7.28-1** to avoid CVE-2025-52881 AppArmor issues in LXC/Proxmox - Configures Docker daemon with proper settings - Holds Docker packages to prevent automatic upgrades - Removes standalone docker-compose if present @@ -62,22 +62,6 @@ This script automatically detects LXC environments and installs **containerd.io bash -c "$(wget -qLO - https://raw.githubusercontent.com/bigbeartechworld/big-bear-scripts/master/casaos-fix-docker-api-version/run.sh)" ``` -## Testing the Script - -A test script is available to verify the fix script works correctly. See [TEST-SCRIPT-README.md](TEST-SCRIPT-README.md) for details. - -```bash -# Download and run the test script -wget https://raw.githubusercontent.com/bigbeartechworld/big-bear-scripts/master/casaos-fix-docker-api-version/test-script.sh -chmod +x test-script.sh - -# Run the full test (upgrade Docker, then fix it) -./test-script.sh full - -# Or check current status -./test-script.sh status -``` - ## Can't Resolve Domain To resolve this issue, please follow these steps: @@ -93,8 +77,8 @@ bash run.sh ## What causes these errors? These errors occur when: -- Docker gets auto-upgraded to version 25+ or 26+ (API 1.44+) -- CasaOS still uses Docker API 1.43 in older versions +- Docker gets auto-upgraded to version 27+, 28+, or 29+ (API 1.45+) +- Older CasaOS versions still use Docker API 1.43 - There's a version mismatch between CasaOS's Docker client and the system's Docker daemon - System updates automatically upgrade Docker without considering CasaOS compatibility - Docker overlay2 storage permissions become corrupted @@ -116,14 +100,16 @@ You can verify the fix by running: docker version ``` -Both the client and server API versions should now be compatible. The script installs Docker 24.0.7 which: -- Supports API version 1.43 (compatible with older CasaOS) -- Is stable and well-tested +Both the client and server API versions should now be compatible. The script installs Docker 28.0.x which: +- Supports API version 1.47 or 1.48 (compatible with modern CasaOS and newer distros) +- Provides modern features while maintaining stability +- Is one version behind the latest (29.0.x) for reliability - Is held at this version to prevent auto-upgrades +- Works with both older CasaOS (via API override) and newer versions ### If the API version didn't change -If you ran the script but `docker version` still shows a newer API version (1.45, 1.46, etc.), the script will display diagnostic information. Common causes and fixes: +If you ran the script but `docker version` still shows an unexpected API version, the script will display diagnostic information. Common causes and fixes: 1. **Docker daemon didn't restart properly** ```bash @@ -136,7 +122,7 @@ If you ran the script but `docker version` still shows a newer API version (1.45 2. **Verify the dockerd binary was replaced** ```bash dockerd --version - # Should show: Docker version 24.0.7 + # Should show: Docker version 28.0.x ``` 3. **Check for multiple Docker installations** @@ -149,10 +135,10 @@ If you ran the script but `docker version` still shows a newer API version (1.45 4. **Verify package versions** ```bash dpkg -l | grep docker-ce - # Should show version 5:24.0.7-1~... + # Should show version 5:28.0.x-1~... ``` -If the packages show the correct version (24.0.7) but `docker version` still shows a newer API: +If the packages show the correct version (28.0.x) but `docker version` still shows a newer API: - The dockerd process may not have fully restarted - Try rebooting your system - Check for lingering processes: `ps aux | grep dockerd` @@ -171,16 +157,23 @@ If you want to allow Docker upgrades in the future (after confirming CasaOS comp sudo apt-mark unhold docker-ce docker-ce-cli containerd.io ``` -⚠️ **Warning for LXC users**: Before unholdingcontainerd.io, check if the AppArmor issue has been fixed: -- Check: https://github.com/opencontainers/runc/issues/4968 +⚠️ **Warning for LXC/Proxmox users**: Before unholding containerd.io, check if the AppArmor issue has been fixed: +- Check: [opencontainers/runc#4968](https://github.com/opencontainers/runc/issues/4968) - Or test in a non-production environment first +- The script installs containerd.io 1.7.28-1 for both the downgrade and override paths to ensure consistency ## Version Information -- Docker CE: 24.0.7 -- Docker API: 1.43 compatible -- containerd.io: 1.7.28-1 (for LXC/Proxmox environments) -- Works with CasaOS 0.4.x series +- **Script Version**: 1.6.1 +- **Docker CE**: 28.0.x (one version behind latest) +- **Docker API**: 1.47 or 1.48 (Docker 28.0.x series) +- **containerd.io**: 1.7.28-1 (prevents CVE-2025-52881 AppArmor issues) +- **Works with**: + - Modern CasaOS versions (0.4.x+) + - Older CasaOS versions (via Docker API override) + - Ubuntu 20.04, 22.04, 24.04 + - Debian 11 (Bullseye), 12 (Bookworm), 13 (Trixie) + - LXC/Proxmox environments ## Alternative Solutions for LXC/Proxmox (Advanced) diff --git a/casaos-fix-docker-api-version/run.sh b/casaos-fix-docker-api-version/run.sh index 77007d8..7256ffc 100755 --- a/casaos-fix-docker-api-version/run.sh +++ b/casaos-fix-docker-api-version/run.sh @@ -20,7 +20,7 @@ else fi echo "==========================================" -echo "BigBear CasaOS Docker Version Fix Script 1.6.0" +echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" echo "Here are some links:" @@ -34,10 +34,10 @@ echo "==========================================" echo "" # Compatible Docker versions for CasaOS -# Using Docker 28.0.x series which supports API 1.47 -# Docker 28.0.x is one version behind the latest (29.0.x / API 1.52) +# Using Docker 28.x series which supports API 1.47/1.48 +# Docker 28.x is one version behind the latest (29.0.x / API 1.52) # This provides modern features while maintaining stability -# DOCKER_VERSION will be resolved at runtime to find latest available 28.0.x +# DOCKER_VERSION will be resolved at runtime to find latest available 28.x.x # Using containerd.io 1.7.28-1 to avoid CVE-2025-52881 AppArmor issues in LXC/Proxmox # Version 1.7.28-2 and newer cause "permission denied" errors on sysctl in nested containers readonly CONTAINERD_VERSION="1.7.28-1" @@ -82,18 +82,18 @@ detect_os() { echo "" } -# Function to check if Docker 28.0.x is available for this OS version +# Function to check if Docker 28.x is available for this OS version check_docker_availability() { - echo "Checking Docker 28.0.x availability for $OS $VERSION_CODENAME..." + echo "Checking Docker 28.x availability for $OS $VERSION_CODENAME..." - # List of OS versions known to NOT have Docker 28.0.x packages + # List of OS versions known to NOT have Docker 28.x packages # For these, we'll keep the latest available Docker with API override local unsupported_versions=( - # Note: All currently supported distros should have Docker 28.0.x available + # Note: All currently supported distros should have Docker 28.x available # This list is kept for future compatibility ) - # Known supported versions (have Docker 28.0.x available): + # Known supported versions (have Docker 28.x available): # - Ubuntu 20.04 (focal) # - Ubuntu 22.04 (jammy) # - Ubuntu 24.04 (noble) @@ -129,7 +129,7 @@ check_docker_availability() { fi done - echo "✓ Docker 28.0.x should be available for your OS version" + echo "✓ Docker 28.x should be available for your OS version" echo "" return 0 } @@ -300,9 +300,9 @@ verify_dockerd_binary_version() { local dockerd_version=$(dockerd --version 2>/dev/null | head -n1) echo "dockerd binary version: $dockerd_version" - # Check if it contains "28.0" - if echo "$dockerd_version" | grep -q "28.0"; then - echo "✓ dockerd binary is version 28.0.x" + # Check if it contains "28." (28.0, 28.1, 28.5, etc.) + if echo "$dockerd_version" | grep -qE "Docker version 28\."; then + echo "✓ dockerd binary is version 28.x" echo "" return 0 else @@ -361,19 +361,31 @@ verify_docker_api_version() { echo "Current Docker API version: $api_version" echo "" - # Check if it's 1.47 or compatible (Docker 28.0.x) - if [[ "$api_version" == "1.47" ]]; then - echo "✓ Docker API version is compatible with CasaOS (1.47)" + # Check if API version is below 1.52 (Docker 29.x breaking change) + # Docker 28.x series uses API 1.47-1.51, all compatible with CasaOS + # Use awk for decimal comparison (doesn't require bc) + if awk -v ver="$api_version" 'BEGIN {exit !(ver >= 1.47 && ver < 1.52)}'; then + echo "✓ Docker API version is compatible with CasaOS ($api_version)" echo "" return 0 else echo "⚠ WARNING: Docker API version is $api_version" - echo "Expected: 1.47 for CasaOS compatibility" + echo "Expected: 1.47-1.51 (Docker 28.x - before API 1.52 breaking change)" echo "" - echo "This might indicate:" - echo " - The Docker package installation didn't work properly" - echo " - A different Docker binary is being used" - echo " - The Docker daemon didn't restart with the new version" + echo "Current version: $api_version" + if (( $(echo "$api_version > 1.47" | bc -l) )); then + echo "You have a newer Docker version installed (API $api_version)" + echo "" + echo "This might indicate:" + echo " - The Docker repository setup failed (check for GPG key conflicts)" + echo " - The Docker package installation didn't work properly" + echo " - You may need to use the 'apply-override' method instead" + else + echo "This might indicate:" + echo " - The Docker package installation didn't work properly" + echo " - A different Docker binary is being used" + echo " - The Docker daemon didn't restart with the new version" + fi echo "" return 1 fi @@ -769,6 +781,18 @@ setup_docker_repository() { $SUDO rm -f /etc/apt/sources.list.d/docker*.list fi + # Remove old GPG keys that might conflict + echo "Removing old Docker GPG keys..." + if [ -f /usr/share/keyrings/docker.gpg ]; then + $SUDO rm -f /usr/share/keyrings/docker.gpg + fi + if [ -f /etc/apt/keyrings/docker.gpg ]; then + $SUDO rm -f /etc/apt/keyrings/docker.gpg + fi + if [ -f /etc/apt/keyrings/docker.asc ]; then + $SUDO rm -f /etc/apt/keyrings/docker.asc + fi + # Clean apt cache to force fresh download echo "Cleaning apt cache..." $SUDO apt-get clean @@ -875,7 +899,12 @@ clean_docker_state() { # Clean up Docker runtime state (sockets, pids) if [ -d /var/run/docker ]; then echo "Cleaning Docker sockets and pids..." - $SUDO rm -rf /var/run/docker/* + # Try to remove, but don't fail if network namespaces are busy + $SUDO find /var/run/docker -mindepth 1 -maxdepth 1 ! -path '/var/run/docker/netns' -delete 2>/dev/null || true + # Try to clean netns, but ignore "device busy" errors + if [ -d /var/run/docker/netns ]; then + $SUDO find /var/run/docker/netns -type f -delete 2>/dev/null || true + fi echo "" fi @@ -899,18 +928,22 @@ clean_docker_state() { echo "" } -# Function to resolve latest available Docker 28.0.x version +# Function to resolve latest available Docker 28.x version resolve_docker_version() { - # Query available docker-ce versions and filter for 28.0.x + # Query available docker-ce versions and filter for 28.x.x (any patch in 28 series) + # Pattern matches: 5:28.X.X-1~ (Docker 28.x.x series - includes 28.0.x, 28.1.x, 28.5.x, etc.) + # Handles various distro suffixes: ~debian.13~trixie, ~ubuntu.22.04~jammy, etc. + # Sort versions to get the latest (highest version number) local available_version=$(apt-cache madison docker-ce 2>/dev/null | \ - grep -E '5:28\.0\.[0-9]+-1~' | \ - head -n1 | \ - awk '{print $3}') + awk '{print $3}' | \ + grep -E '^5:28\.[0-9]+\.[0-9]+-1~' | \ + sort -V -r | \ + head -n1) if [ -z "$available_version" ]; then - echo "ERROR: Could not find any Docker 28.0.x version in repository" >&2 + echo "ERROR: Could not find any Docker 28.x version in repository" >&2 echo "Available versions:" >&2 - apt-cache madison docker-ce 2>/dev/null | head -n 5 >&2 + apt-cache madison docker-ce 2>/dev/null | head -n 10 >&2 return 1 fi @@ -957,7 +990,7 @@ downgrade_docker() { fi # Resolve exact Docker version at runtime - echo "Resolving exact Docker 28.0.x version from repository..." + echo "Resolving latest Docker 28.x version from repository..." DOCKER_VERSION=$(resolve_docker_version) if [ $? -ne 0 ] || [ -z "$DOCKER_VERSION" ]; then echo "ERROR: Failed to resolve Docker version" @@ -989,8 +1022,8 @@ downgrade_docker() { fi echo "" - # Install latest Docker 28.0.x version compatible with CasaOS - echo "Installing Docker 28.0.x (API 1.47) - one version behind latest..." + # Install latest Docker 28.x version compatible with CasaOS + echo "Installing Docker 28.x (API 1.47/1.48) - one version behind latest..." # Check if we're in LXC and warn about containerd version if check_lxc_environment; then @@ -1030,7 +1063,7 @@ downgrade_docker() { return 1 fi - echo "✓ Successfully installed Docker 28.0.x (API 1.47)" + echo "✓ Successfully installed Docker 28.x (API 1.47/1.48)" echo "" # Hold packages to prevent auto-upgrade @@ -1302,13 +1335,13 @@ show_usage() { echo " help - Show this help message" echo "" echo "Default behavior (no arguments):" - echo " Installs Docker 28.0.x (API 1.47) - compatible with CasaOS" + echo " Installs Docker 28.x (API 1.47/1.48) - compatible with CasaOS" echo " Use on: Ubuntu 20.04, 22.04, 24.04, Debian 11, 12, 13" echo "" echo "Alternative fix (apply-override):" echo " Sets DOCKER_MIN_API_VERSION=1.24 environment variable" echo " Allows newer Docker versions (29.x) to work with CasaOS" - echo " Use on: Distros where Docker 28.0.x is not available" + echo " Use on: Distros where Docker 28.x is not available" echo "" echo "Examples:" echo " $0 # Run the downgrade fix (default)" @@ -1324,7 +1357,7 @@ main() { case "$1" in apply-override|override) echo "==========================================" - echo "BigBear CasaOS Docker Version Fix Script 1.6.0" + echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" apply_docker_api_override @@ -1332,7 +1365,7 @@ main() { ;; remove-override|no-override) echo "==========================================" - echo "BigBear CasaOS Docker Version Fix Script 1.6.0" + echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" remove_docker_api_override @@ -1340,7 +1373,7 @@ main() { ;; help|--help|-h) echo "==========================================" - echo "BigBear CasaOS Docker Version Fix Script 1.6.0" + echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" show_usage @@ -1359,11 +1392,11 @@ main() { check_sudo detect_os - echo "Step 1a: Verifying Docker 28.0.x availability..." + echo "Step 1a: Verifying Docker 28.x availability..." check_docker_availability local availability_result=$? - # If return code is 2, Docker 24.0.x is not available - use override method + # If return code is 2, Docker 28.x is not available - use override method if [ $availability_result -eq 2 ]; then echo "Proceeding with Docker API override method..." echo ""