mirror of
https://github.com/juanfont/headscale.git
synced 2026-01-11 20:00:28 +01:00
Running headscale commands as non-root produces generic "deadline exceeded" error message #245
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @victorhooi on GitHub (Mar 23, 2022).
Bug description
If you attempt to run "headscale" commands as a non-root user, it prints out a generic and somewhat unhelpful "context deadline exceeded" error message:
This is rather unhelpful, and doesn't really tell the user where the problem is.
I upped the logging level to "trace", and noticed that it was trying to access
/var/run/headscale.sock- I re-ran withsudo, and the command worked:Ideally:
rootuserheadscaleshould detect when run as a non-root user, and print out a friendlier error message. (e.g. `headscale requires permissions to run. Please run as root")headscale.sockfile - this should be documented.To Reproduce
Run a
headscalecommand as a normal (non-root) user.Context info
@e-zk commented on GitHub (Mar 23, 2022):
Hello! headscale runs as a non-root user and seems to work fine in my setup.
I think what's wrong here could be your file permissions on the headscale related stuff in
/var/*. Could you run a quickls -lon those files to make sure that isn't the case?Edit: I see you've actually mentioned this in your post - adding docs about how to change these permissions seems like a good idea. I'll see what I can do.
@victorhooi commented on GitHub (Mar 24, 2022):
Here are the permissions for the socket file on my system:
This is on a Debian 11 machine.
From memory, when I was following along the docs at https://github.com/juanfont/headscale/blob/main/docs/running-headscale-linux.md - I had to use
sudoto run themkdircommands:sudo mkdir -p /var/lib/headscale(I assume that's expected behaviour, right?)
Or is there another way we should create those directories, with user access?
@e-zk commented on GitHub (Mar 24, 2022):
Yeah so I think that's the root (heh) of the problem.
When you've created that directory with sudo it's given ownership rights to root and root only.
If you're running headscale as a non-root user you should change the ownership of this dir to that non-root user.
Try running:
Where
hscaleis the username of your non-root user headscale is running as.@victorhooi commented on GitHub (Mar 25, 2022):
Hmm - ok, so you're saying we should create a dedicated
headscale(orhscale) user and group, and set ownership of the headscale directories (/etc/headscale,/var/lib/headscaleto that.). Should the/usr/local/bin/headscalebinary also be set to belong toheadscale:headscale?If this is the recommended approach - we should document it in https://github.com/juanfont/headscale/blob/main/docs/running-headscale-linux.md.
There is mention of a headscale user, but it's a passing reference at the bottom of the page in the systemd section. I suspect many people are like me, and just start at the "Configure and run headscale" section at the top 😛, and follow the instructions.
@e-zk commented on GitHub (Mar 26, 2022):
I'm not saying you should create a dedicated headscale user (unless you want to - I personally do).
You said you are running headscale as a non-root user, correct? What I am saying, is to make sure that non-root user has the right permissions to access the config files and stuff in
/var.@e-zk commented on GitHub (Mar 26, 2022):
Because that non-root user currently can't access anything in /var, because it's all owned by
root. You understand that, right?@victorhooi commented on GitHub (Mar 29, 2022):
Yup, I do understand it =) - thanks for clarifying.
My question is more - if somebody is just blindly following the instructions at https://github.com/juanfont/headscale/blob/main/docs/running-headscale-linux.md - they're going to need to run
headscaleas root, which sounds like it's not necessarily a great idea.Would it make sense to add some steps there - possibly just add a headscale user, and set appropriate ownerships on the folders/files?
@thenitai commented on GitHub (Apr 14, 2022):
hmmmm........ I came here because of that "context deadline exceeded" issue. However in my experience it's because I'm running headscale with systemd.
According to the docs you would need to change the path for the sock. However, when you do that the command "headscale namespaces list" throws that error.
As soon as you stop the deamon. Change the socks path and start with "headscale server" all commands work again.
@thenitai commented on GitHub (Apr 14, 2022):
Ok, I got it to work. All that is required is to create the directory for the sock:
and then it works with the path to the socket as described in the docs, i.e., unix_socket: /var/run/headscale/headscale.sock