From d9ab8f257b2a751a9e048a8cd9fb84b3014a4c9b Mon Sep 17 00:00:00 2001 From: Christopher <1289128+dragonfire1119@users.noreply.github.com> Date: Sun, 16 Nov 2025 01:37:56 -0600 Subject: [PATCH] Fix issues in fixing docker (#64) * Improve Docker API version checks and cleanup Enhanced Docker API version verification with clearer messaging for newer versions and added checks for GPG key conflicts. Improved Docker repository setup by removing old GPG keys and refined Docker runtime cleanup to handle network namespace files more safely. * Update script version to 1.6.1 Bump displayed version in casaos-fix-docker-api-version/run.sh from 1.6.0 to 1.6.1 for consistency across script output and help messages. * Update README for Docker 28.0.x and API changes Revised documentation to reflect support for Docker 28.0.x (API 1.47/1.48) instead of 24.0.7, clarified compatibility notes for CasaOS versions, and updated instructions for LXC/Proxmox environments. Also improved versioning details and troubleshooting steps for Docker and containerd.io installations. * Remove testing instructions from README Deleted the section describing how to test the fix script and related usage details from the README. This streamlines the documentation and removes references to the test script. * Improve Docker version resolution in run.sh Updated the script to correctly compare Docker API versions using bc for numeric comparison. Enhanced the Docker version resolver to support all 28.x.x releases, not just 28.0.x, and improved filtering and sorting to select the latest available version. * Update script to support Docker 28.x series Replaces references to Docker 28.0.x with 28.x throughout the script to reflect support for all 28.x versions. Updates compatibility checks, messages, and comments to include API versions 1.47 and 1.48, ensuring broader compatibility with CasaOS. * Update runc issue links to markdown format in README Changed plain URLs referencing the opencontainers/runc issue to markdown link format for improved readability in the documentation. * Improve Docker API version compatibility check Updated the version check logic in run.sh to use awk for decimal comparison and support Docker API versions 1.47 to 1.51, ensuring compatibility with CasaOS. Adjusted warning messages to reflect the broader compatible range and upcoming breaking changes in API 1.52. * Update script version to 1.6.2 Bump displayed version in casaos-fix-docker-api-version/run.sh from 1.6.1 to 1.6.2 for consistency across script output and usage instructions. * Update script version to 1.6.1 in run.sh Changed displayed version from 1.6.2 to 1.6.1 in all relevant echo statements for consistency with the actual script version. --- casaos-fix-docker-api-version/README.md | 65 ++++++-------- casaos-fix-docker-api-version/run.sh | 113 +++++++++++++++--------- 2 files changed, 102 insertions(+), 76 deletions(-) diff --git a/casaos-fix-docker-api-version/README.md b/casaos-fix-docker-api-version/README.md index ec9b869..16f4185 100644 --- a/casaos-fix-docker-api-version/README.md +++ b/casaos-fix-docker-api-version/README.md @@ -9,12 +9,12 @@ This script fixes common Docker errors with CasaOS including: ## The Problem These errors commonly occur with **CasaOS** when: -1. Docker gets upgraded to a very recent version (API 1.44+) that is incompatible with CasaOS's older Docker client +1. Docker gets upgraded to a very recent version (API 1.45+) that is incompatible with CasaOS's older Docker client 2. Docker overlay2 filesystem permissions become corrupted 3. Container runtime state becomes inconsistent 4. **NEW**: containerd.io 1.7.28-2 or newer causes AppArmor permission errors in LXC/Proxmox containers -CasaOS uses Docker API 1.43, and when the system Docker gets auto-upgraded or the storage becomes corrupted, it breaks compatibility. +Older CasaOS versions use Docker API 1.43, and when the system Docker gets auto-upgraded or the storage becomes corrupted, it breaks compatibility. ### Special Note for LXC/Proxmox Users @@ -30,7 +30,7 @@ open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission de This script automatically detects LXC environments and installs **containerd.io 1.7.28-1** (the last version before the breaking change) to prevent this issue. **References:** -- GitHub Issue: https://github.com/opencontainers/runc/issues/4968 +- GitHub Issue: [opencontainers/runc#4968](https://github.com/opencontainers/runc/issues/4968) - Proxmox Forum: https://forum.proxmox.com/threads/docker-inside-lxc-net-ipv4-ip_unprivileged_port_start-error.175437/ ## What does this script do? @@ -44,9 +44,9 @@ This script automatically detects LXC environments and installs **containerd.io - Cleans Docker runtime state and fixes permissions - **Ensures all Docker processes are completely terminated** before upgrade - Fixes overlay2 directory permissions -- Downgrades Docker to version 24.0.7 (compatible with both CasaOS and modern systems) +- Installs Docker 28.0.x (one version behind latest for stability, API 1.47/1.48) - **Verifies the dockerd binary version** after installation -- **Installs containerd.io 1.7.28-1** in LXC/Proxmox to avoid CVE-2025-52881 AppArmor issues +- **Installs containerd.io 1.7.28-1** to avoid CVE-2025-52881 AppArmor issues in LXC/Proxmox - Configures Docker daemon with proper settings - Holds Docker packages to prevent automatic upgrades - Removes standalone docker-compose if present @@ -62,22 +62,6 @@ This script automatically detects LXC environments and installs **containerd.io bash -c "$(wget -qLO - https://raw.githubusercontent.com/bigbeartechworld/big-bear-scripts/master/casaos-fix-docker-api-version/run.sh)" ``` -## Testing the Script - -A test script is available to verify the fix script works correctly. See [TEST-SCRIPT-README.md](TEST-SCRIPT-README.md) for details. - -```bash -# Download and run the test script -wget https://raw.githubusercontent.com/bigbeartechworld/big-bear-scripts/master/casaos-fix-docker-api-version/test-script.sh -chmod +x test-script.sh - -# Run the full test (upgrade Docker, then fix it) -./test-script.sh full - -# Or check current status -./test-script.sh status -``` - ## Can't Resolve Domain To resolve this issue, please follow these steps: @@ -93,8 +77,8 @@ bash run.sh ## What causes these errors? These errors occur when: -- Docker gets auto-upgraded to version 25+ or 26+ (API 1.44+) -- CasaOS still uses Docker API 1.43 in older versions +- Docker gets auto-upgraded to version 27+, 28+, or 29+ (API 1.45+) +- Older CasaOS versions still use Docker API 1.43 - There's a version mismatch between CasaOS's Docker client and the system's Docker daemon - System updates automatically upgrade Docker without considering CasaOS compatibility - Docker overlay2 storage permissions become corrupted @@ -116,14 +100,16 @@ You can verify the fix by running: docker version ``` -Both the client and server API versions should now be compatible. The script installs Docker 24.0.7 which: -- Supports API version 1.43 (compatible with older CasaOS) -- Is stable and well-tested +Both the client and server API versions should now be compatible. The script installs Docker 28.0.x which: +- Supports API version 1.47 or 1.48 (compatible with modern CasaOS and newer distros) +- Provides modern features while maintaining stability +- Is one version behind the latest (29.0.x) for reliability - Is held at this version to prevent auto-upgrades +- Works with both older CasaOS (via API override) and newer versions ### If the API version didn't change -If you ran the script but `docker version` still shows a newer API version (1.45, 1.46, etc.), the script will display diagnostic information. Common causes and fixes: +If you ran the script but `docker version` still shows an unexpected API version, the script will display diagnostic information. Common causes and fixes: 1. **Docker daemon didn't restart properly** ```bash @@ -136,7 +122,7 @@ If you ran the script but `docker version` still shows a newer API version (1.45 2. **Verify the dockerd binary was replaced** ```bash dockerd --version - # Should show: Docker version 24.0.7 + # Should show: Docker version 28.0.x ``` 3. **Check for multiple Docker installations** @@ -149,10 +135,10 @@ If you ran the script but `docker version` still shows a newer API version (1.45 4. **Verify package versions** ```bash dpkg -l | grep docker-ce - # Should show version 5:24.0.7-1~... + # Should show version 5:28.0.x-1~... ``` -If the packages show the correct version (24.0.7) but `docker version` still shows a newer API: +If the packages show the correct version (28.0.x) but `docker version` still shows a newer API: - The dockerd process may not have fully restarted - Try rebooting your system - Check for lingering processes: `ps aux | grep dockerd` @@ -171,16 +157,23 @@ If you want to allow Docker upgrades in the future (after confirming CasaOS comp sudo apt-mark unhold docker-ce docker-ce-cli containerd.io ``` -⚠️ **Warning for LXC users**: Before unholdingcontainerd.io, check if the AppArmor issue has been fixed: -- Check: https://github.com/opencontainers/runc/issues/4968 +⚠️ **Warning for LXC/Proxmox users**: Before unholding containerd.io, check if the AppArmor issue has been fixed: +- Check: [opencontainers/runc#4968](https://github.com/opencontainers/runc/issues/4968) - Or test in a non-production environment first +- The script installs containerd.io 1.7.28-1 for both the downgrade and override paths to ensure consistency ## Version Information -- Docker CE: 24.0.7 -- Docker API: 1.43 compatible -- containerd.io: 1.7.28-1 (for LXC/Proxmox environments) -- Works with CasaOS 0.4.x series +- **Script Version**: 1.6.1 +- **Docker CE**: 28.0.x (one version behind latest) +- **Docker API**: 1.47 or 1.48 (Docker 28.0.x series) +- **containerd.io**: 1.7.28-1 (prevents CVE-2025-52881 AppArmor issues) +- **Works with**: + - Modern CasaOS versions (0.4.x+) + - Older CasaOS versions (via Docker API override) + - Ubuntu 20.04, 22.04, 24.04 + - Debian 11 (Bullseye), 12 (Bookworm), 13 (Trixie) + - LXC/Proxmox environments ## Alternative Solutions for LXC/Proxmox (Advanced) diff --git a/casaos-fix-docker-api-version/run.sh b/casaos-fix-docker-api-version/run.sh index 77007d8..7256ffc 100755 --- a/casaos-fix-docker-api-version/run.sh +++ b/casaos-fix-docker-api-version/run.sh @@ -20,7 +20,7 @@ else fi echo "==========================================" -echo "BigBear CasaOS Docker Version Fix Script 1.6.0" +echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" echo "Here are some links:" @@ -34,10 +34,10 @@ echo "==========================================" echo "" # Compatible Docker versions for CasaOS -# Using Docker 28.0.x series which supports API 1.47 -# Docker 28.0.x is one version behind the latest (29.0.x / API 1.52) +# Using Docker 28.x series which supports API 1.47/1.48 +# Docker 28.x is one version behind the latest (29.0.x / API 1.52) # This provides modern features while maintaining stability -# DOCKER_VERSION will be resolved at runtime to find latest available 28.0.x +# DOCKER_VERSION will be resolved at runtime to find latest available 28.x.x # Using containerd.io 1.7.28-1 to avoid CVE-2025-52881 AppArmor issues in LXC/Proxmox # Version 1.7.28-2 and newer cause "permission denied" errors on sysctl in nested containers readonly CONTAINERD_VERSION="1.7.28-1" @@ -82,18 +82,18 @@ detect_os() { echo "" } -# Function to check if Docker 28.0.x is available for this OS version +# Function to check if Docker 28.x is available for this OS version check_docker_availability() { - echo "Checking Docker 28.0.x availability for $OS $VERSION_CODENAME..." + echo "Checking Docker 28.x availability for $OS $VERSION_CODENAME..." - # List of OS versions known to NOT have Docker 28.0.x packages + # List of OS versions known to NOT have Docker 28.x packages # For these, we'll keep the latest available Docker with API override local unsupported_versions=( - # Note: All currently supported distros should have Docker 28.0.x available + # Note: All currently supported distros should have Docker 28.x available # This list is kept for future compatibility ) - # Known supported versions (have Docker 28.0.x available): + # Known supported versions (have Docker 28.x available): # - Ubuntu 20.04 (focal) # - Ubuntu 22.04 (jammy) # - Ubuntu 24.04 (noble) @@ -129,7 +129,7 @@ check_docker_availability() { fi done - echo "✓ Docker 28.0.x should be available for your OS version" + echo "✓ Docker 28.x should be available for your OS version" echo "" return 0 } @@ -300,9 +300,9 @@ verify_dockerd_binary_version() { local dockerd_version=$(dockerd --version 2>/dev/null | head -n1) echo "dockerd binary version: $dockerd_version" - # Check if it contains "28.0" - if echo "$dockerd_version" | grep -q "28.0"; then - echo "✓ dockerd binary is version 28.0.x" + # Check if it contains "28." (28.0, 28.1, 28.5, etc.) + if echo "$dockerd_version" | grep -qE "Docker version 28\."; then + echo "✓ dockerd binary is version 28.x" echo "" return 0 else @@ -361,19 +361,31 @@ verify_docker_api_version() { echo "Current Docker API version: $api_version" echo "" - # Check if it's 1.47 or compatible (Docker 28.0.x) - if [[ "$api_version" == "1.47" ]]; then - echo "✓ Docker API version is compatible with CasaOS (1.47)" + # Check if API version is below 1.52 (Docker 29.x breaking change) + # Docker 28.x series uses API 1.47-1.51, all compatible with CasaOS + # Use awk for decimal comparison (doesn't require bc) + if awk -v ver="$api_version" 'BEGIN {exit !(ver >= 1.47 && ver < 1.52)}'; then + echo "✓ Docker API version is compatible with CasaOS ($api_version)" echo "" return 0 else echo "⚠ WARNING: Docker API version is $api_version" - echo "Expected: 1.47 for CasaOS compatibility" + echo "Expected: 1.47-1.51 (Docker 28.x - before API 1.52 breaking change)" echo "" - echo "This might indicate:" - echo " - The Docker package installation didn't work properly" - echo " - A different Docker binary is being used" - echo " - The Docker daemon didn't restart with the new version" + echo "Current version: $api_version" + if (( $(echo "$api_version > 1.47" | bc -l) )); then + echo "You have a newer Docker version installed (API $api_version)" + echo "" + echo "This might indicate:" + echo " - The Docker repository setup failed (check for GPG key conflicts)" + echo " - The Docker package installation didn't work properly" + echo " - You may need to use the 'apply-override' method instead" + else + echo "This might indicate:" + echo " - The Docker package installation didn't work properly" + echo " - A different Docker binary is being used" + echo " - The Docker daemon didn't restart with the new version" + fi echo "" return 1 fi @@ -769,6 +781,18 @@ setup_docker_repository() { $SUDO rm -f /etc/apt/sources.list.d/docker*.list fi + # Remove old GPG keys that might conflict + echo "Removing old Docker GPG keys..." + if [ -f /usr/share/keyrings/docker.gpg ]; then + $SUDO rm -f /usr/share/keyrings/docker.gpg + fi + if [ -f /etc/apt/keyrings/docker.gpg ]; then + $SUDO rm -f /etc/apt/keyrings/docker.gpg + fi + if [ -f /etc/apt/keyrings/docker.asc ]; then + $SUDO rm -f /etc/apt/keyrings/docker.asc + fi + # Clean apt cache to force fresh download echo "Cleaning apt cache..." $SUDO apt-get clean @@ -875,7 +899,12 @@ clean_docker_state() { # Clean up Docker runtime state (sockets, pids) if [ -d /var/run/docker ]; then echo "Cleaning Docker sockets and pids..." - $SUDO rm -rf /var/run/docker/* + # Try to remove, but don't fail if network namespaces are busy + $SUDO find /var/run/docker -mindepth 1 -maxdepth 1 ! -path '/var/run/docker/netns' -delete 2>/dev/null || true + # Try to clean netns, but ignore "device busy" errors + if [ -d /var/run/docker/netns ]; then + $SUDO find /var/run/docker/netns -type f -delete 2>/dev/null || true + fi echo "" fi @@ -899,18 +928,22 @@ clean_docker_state() { echo "" } -# Function to resolve latest available Docker 28.0.x version +# Function to resolve latest available Docker 28.x version resolve_docker_version() { - # Query available docker-ce versions and filter for 28.0.x + # Query available docker-ce versions and filter for 28.x.x (any patch in 28 series) + # Pattern matches: 5:28.X.X-1~ (Docker 28.x.x series - includes 28.0.x, 28.1.x, 28.5.x, etc.) + # Handles various distro suffixes: ~debian.13~trixie, ~ubuntu.22.04~jammy, etc. + # Sort versions to get the latest (highest version number) local available_version=$(apt-cache madison docker-ce 2>/dev/null | \ - grep -E '5:28\.0\.[0-9]+-1~' | \ - head -n1 | \ - awk '{print $3}') + awk '{print $3}' | \ + grep -E '^5:28\.[0-9]+\.[0-9]+-1~' | \ + sort -V -r | \ + head -n1) if [ -z "$available_version" ]; then - echo "ERROR: Could not find any Docker 28.0.x version in repository" >&2 + echo "ERROR: Could not find any Docker 28.x version in repository" >&2 echo "Available versions:" >&2 - apt-cache madison docker-ce 2>/dev/null | head -n 5 >&2 + apt-cache madison docker-ce 2>/dev/null | head -n 10 >&2 return 1 fi @@ -957,7 +990,7 @@ downgrade_docker() { fi # Resolve exact Docker version at runtime - echo "Resolving exact Docker 28.0.x version from repository..." + echo "Resolving latest Docker 28.x version from repository..." DOCKER_VERSION=$(resolve_docker_version) if [ $? -ne 0 ] || [ -z "$DOCKER_VERSION" ]; then echo "ERROR: Failed to resolve Docker version" @@ -989,8 +1022,8 @@ downgrade_docker() { fi echo "" - # Install latest Docker 28.0.x version compatible with CasaOS - echo "Installing Docker 28.0.x (API 1.47) - one version behind latest..." + # Install latest Docker 28.x version compatible with CasaOS + echo "Installing Docker 28.x (API 1.47/1.48) - one version behind latest..." # Check if we're in LXC and warn about containerd version if check_lxc_environment; then @@ -1030,7 +1063,7 @@ downgrade_docker() { return 1 fi - echo "✓ Successfully installed Docker 28.0.x (API 1.47)" + echo "✓ Successfully installed Docker 28.x (API 1.47/1.48)" echo "" # Hold packages to prevent auto-upgrade @@ -1302,13 +1335,13 @@ show_usage() { echo " help - Show this help message" echo "" echo "Default behavior (no arguments):" - echo " Installs Docker 28.0.x (API 1.47) - compatible with CasaOS" + echo " Installs Docker 28.x (API 1.47/1.48) - compatible with CasaOS" echo " Use on: Ubuntu 20.04, 22.04, 24.04, Debian 11, 12, 13" echo "" echo "Alternative fix (apply-override):" echo " Sets DOCKER_MIN_API_VERSION=1.24 environment variable" echo " Allows newer Docker versions (29.x) to work with CasaOS" - echo " Use on: Distros where Docker 28.0.x is not available" + echo " Use on: Distros where Docker 28.x is not available" echo "" echo "Examples:" echo " $0 # Run the downgrade fix (default)" @@ -1324,7 +1357,7 @@ main() { case "$1" in apply-override|override) echo "==========================================" - echo "BigBear CasaOS Docker Version Fix Script 1.6.0" + echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" apply_docker_api_override @@ -1332,7 +1365,7 @@ main() { ;; remove-override|no-override) echo "==========================================" - echo "BigBear CasaOS Docker Version Fix Script 1.6.0" + echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" remove_docker_api_override @@ -1340,7 +1373,7 @@ main() { ;; help|--help|-h) echo "==========================================" - echo "BigBear CasaOS Docker Version Fix Script 1.6.0" + echo "BigBear CasaOS Docker Version Fix Script 1.6.1" echo "==========================================" echo "" show_usage @@ -1359,11 +1392,11 @@ main() { check_sudo detect_os - echo "Step 1a: Verifying Docker 28.0.x availability..." + echo "Step 1a: Verifying Docker 28.x availability..." check_docker_availability local availability_result=$? - # If return code is 2, Docker 24.0.x is not available - use override method + # If return code is 2, Docker 28.x is not available - use override method if [ $availability_result -eq 2 ]; then echo "Proceeding with Docker API override method..." echo ""