tomsquest/docker-radicale

Docker image for Radicale calendar and contact server :calendar: + security :closed_lock_with_key: + addons :rocket:

docker-radicale's Issues

Daily releases to docker-radicale:latest image

Hi,

During the past week or so, I have been getting daily notification of new released image for docker-radicale:latest, however there is no sign of any changelog, or any releases here on github, so I'm wondering what is going on?

I can see the image on dockerhub is updated every day around 4:40 UTC, but last code change here on github is 9 days ago.
I started receiving alerts from my Diun container (docker image update notifier) around this time.

Can you check this please?

Emails from Diun:

Can't get server to authorise connection

Hi there,

I've been trying to get radicale running on my unRAID server and I managed to do so both using the minimal and the production-grade instruction from the readme. I logged in/created an account and then imported my Google Calendar (worked flawlessly). At this point, adding the calendar to a client (here: Calendar on Mac OS) worked, but the client told me after a few minutes that no connection could be made (makes sense, it added the calendar as no users were set up but connection was not possible still)

I then went on and edited the config a little bit, by adding plain text users (I know.. but that's ok, server is only reachable within the local network) and some other things. Apple Calendar now tells me that it is unable to very my account name and password (which is great: I know auth is at least activated).

My current config and users file can be found here, as well as the logs: https://pastebin.com/tVEUGk70

Any help is appreciated. Thanks so much for your docker!

No configuration file & permission error

After starting your container, I don't get the config file through the volume (I only get user.prop & user dir).
Also when I access <server>/user/main.ics I get this:

Traceback (most recent call last):
  File "/usr/local/lib/python3.5/wsgiref/handlers.py", line 137, in run
    self.result = application(self.environ, self.start_response)
  File "/usr/local/lib/python3.5/site-packages/radicale/__init__.py", line 332, in __call__
    user)
  File "/usr/local/lib/python3.5/site-packages/radicale/__init__.py", line 447, in do_GET
    "Content-Type": collection.mimetype,
  File "/usr/local/lib/python3.5/site-packages/radicale/ical.py", line 410, in mimetype
    if self.tag == "VADDRESSBOOK":
  File "/usr/local/lib/python3.5/site-packages/radicale/ical.py", line 405, in tag
    return props["tag"]
  File "/usr/local/lib/python3.5/contextlib.py", line 66, in __exit__
    next(self.gen)
  File "/usr/local/lib/python3.5/site-packages/radicale/storage/filesystem.py", line 143, in props
    with open(self._props_path, "w") as prop_file:
  File "/usr/local/lib/python3.5/contextlib.py", line 59, in __enter__
    return next(self.gen)
  File "/usr/local/lib/python3.5/site-packages/radicale/storage/filesystem.py", line 52, in open
    with codecs.open(abs_path, mode, config.get("encoding", "stock")) as fd:
  File "/usr/local/lib/python3.5/codecs.py", line 895, in open
    file = builtins.open(filename, mode, buffering)
PermissionError: [Errno 13] Permission denied: '/data.props'

Login possible with every letter combination

Hello,
on my installation, it is possible to access the backend with every letter combination in the username and password. I create a user on the host machine → user1 and a password with the following commands.

I install radicale with the following command:
docker run -d --name radicale \ -p 5232:5232 \ -v ~/radicale/data:/data \ tomsquest/docker-radicale

I add a user with the following command:
sudo addgroup --gid 2999 radicale
sudo adduser --gid 2999 --uid 2999 --shell /bin/false --no-create-home user1

Can you help me to fix this?

Thanks, Lucas

SSL configuration : Permission denied on key file

Hello Tomsquest,

I am trying to run radicale over SSL.
I used docker compose with Production-grade instruction to run radicale.
With "http" I have no problem everything runs perfectly.

I decided to activate SSL:

I followed instructions on radicale's documentation about SSL topic:

I generated the certificate and the key:
openssl req -x509 -newkey rsa:4096 -keyout radicale_key.pem -out radicale_cert.pem -nodes -days 9999

I modified the config file:

# SSL flag, enable HTTPS protocol
ssl = True
# SSL certificate path
certificate = /config/ssl/radicale_cert.pem
# SSL private key
key = /config/ssl/radicale_key.pem
# CA certificate for validating clients. This can be used to secure
# TCP traffic between Radicale and a reverse proxy
#certificate_authority = /config/ssl/client_cert.pem

I started Docker but i got this error on the log:

An exception occurred during server startup: Invalid filepath value for option 'key' in section 'server' in config file '/config/config': '/config/ssl/radicale_key.pem' ([Errno 13] Permission denied: '/config/ssl/radicale_key.pem')

I am a newbie on docker 😺 , it could be a basic error, Thanks for your help!

podman support

Hi,
sorry to open an issue, if it's not practical please close it. But I wonder if you have every tried to run this using podman ? And therefore add it as an option in the readme ?

publish a 1.1.7 version of radicale

Would you agree in publishing a 1.1.7 version of radicale as a docker image so that the container can be used to migrate data from 1.x version t 2.x version?

1.1.7 is the last 1.x version and contains the raquired code to convert data.

debian bullseye will be out in a few months and is providing radicale 2.x by default as the current stable version of debian is providing radicale 1.x by default. There should be a lot of migration in the newt year.

"Address not available" when starting docker

Hello, I'm having an issue starting this docker container on my unraid server. I'm using the "production" config with all the extra parameters provided. It starts successfully when I don't include the "hosts" field in the config, but I can't access the webUI. If I add in my server URL in the hosts field, I see an error saying "address not available". I have port 5232 exposed.

Invalid configuration: Failed to load config file

I created a user/group with id 2999 on the host, then ran the Production-grade instruction command from the README.md. Docker shows the container has exited immediately:

pip@ubuntu18:~$ sudo docker ps -a
CONTAINER ID        IMAGE                       COMMAND                  CREATED             STATUS                      PORTS               NAMES
354ec93509ed        tomsquest/docker-radicale   "docker-entrypoint.s…"   15 seconds ago      Exited (1) 14 seconds ago                       radicale

Digging up the log file for the container shows me this error:

{"log":"ERROR: Invalid configuration: Failed to load config file '/config/config': No such file: '/config/config'\n","stream":"stderr","time":"2019-09-15T21:00:58.133814892Z"}

And indeed /config/config isn't there. The folder for config and data have been created, but the config file is missing inside the config folder:

pip@ubuntu18:~$ ls -la ./radicale
total 16
drwxr-xr-x 4 root     root     4096 Sep 18 16:12 ./
drwxr-xr-x 6 pip      pip      4096 Sep 18 16:12 ../
drwxr-xr-x 2 root     root     4096 Sep 18 16:12 config/
drwxr-xr-x 2 radicale radicale 4096 Sep 18 16:12 data/

This is on a fresh Ubuntu 18 install with Docker version 19.03.2, build 6a30dfc.

Image type not selected by docker (for linux/arm/v7)

The description on https://hub.docker.com/r/tomsquest/docker-radicale says: "The correct image type for your architecture will be automatically selected by Docker."
This does not seem to be the case. On a Raspberry Pi 4 (linux/arm/v7) with this configuration for docker-compose:

  radicale:
    container_name: radicale
    image: tomsquest/docker-radicale
    volumes:
      - ./radicale:/data
    ports:
      - 5232:5232
    restart: unless-stopped

I get:

$ docker-compose up -d
Pulling radicale (tomsquest/docker-radicale:)...
latest: Pulling from tomsquest/docker-radicale
ERROR: no matching manifest for linux/arm/v7 in the manifest list entries

However, when I specify the image as image: tomsquest/docker-radicale:arm.3.0.6.0 it is working.

Another question:
My first (wrong) thought was, that no arm images are available and I was about to start work on a PR for building arm images. While looking through the code, I found that ci/build-push.sh only contains amd64 and arm64 archs and creates the manifest manually.

How are the arm images build, when only amd64 and arm64 are listed as architectures?
Why is docker buildx not used for building the multi-arch image?

unable to change path of config file

Hello,

I am using nomad to run the container and storing the config file in "/local/config" as it is being generated from a consul template.

however I am unable to change the location of the config file using the environment variable as I think it is being overwritten with line 56 of the docker file

CMD ["radicale", "--config", "/config/config"]

is it possible to remove the --config parameter and leave it as an environment variable?

Thanks,

Helthcheck uses http-based url while running server on https

Howdy,

while facing such SSL error which was repeating every 30 seconds

ERROR: An exception occurred during request: SSL handshake failed: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:841)

I was looking for the cause. All my clients were already moved to use https, so it took me a while to find it. It looks like that the health-check is using a hardcoded http request:

HEALTHCHECK --interval=30s --retries=3 CMD curl --fail http://localhost:5232 || exit 1

I didn't find any chance to redirect http requests to https nor found any possibility to expose an http and a different https port.

The container itself shows as unhealthy because of the requests throwing errors.
Is there any chance to have a work-around for this? Is it possible to have a fallback url (https-based) on the curl command?

Thanks,
Marcus

versioning not working.

I tried to set it up exactly how instructed, but I can't see it commit after changing stuff.

Should it somehow print debug when executing those git commands?
The logs so far stay empty.

I have no real clue what might be going on as I can't see anything related to that hook at all in the logs.

permission denied on .Radicale.lock

after starting the container everything is running fine for a few days and than radicale always complains about permission denied every time I try to access a calendar.

2019-09-30 08:29:55,967 - [7fc404417b10] ERROR: An exception occurred during PROPFIND request on '/nines/': [Errno 13] Permission denied: '/data/collections/.Radicale.lock'
2019-09-30 08:30:12,673 - [7fc404417b10] ERROR: An exception occurred during PROPFIND request on '/': [Errno 13] Permission denied: '/data/collections/.Radicale.lock'

any help is appreciated.

Improve tag/version handling and releasing

Currently, Radicale version is set in multiple file:

• Dockerfile
• .travis.yml
• test.py (version check)

Publishing the images is done by Travis, but no tag are pushed back to Github.

SSL handshake failed

Hello guys,
Hopefully you can help me further...
I was using a self-signed certificate and everything was working fine until yesterday. Now Im getting following error:

Traceback (most recent call last):
radicale_1  |   File "/usr/lib/python3.6/site-packages/radicale/__init__.py", line 197, in process_request_thread
radicale_1  |     raise RuntimeError("SSL handshake failed: %s" % e) from e
radicale_1  | RuntimeError: SSL handshake failed: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:841)
radicale_1  | [7f5962f78ae8] ERROR: An exception occurred during request: SSL handshake failed: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:841)
radicale_1  | Traceback (most recent call last):
radicale_1  |   File "/usr/lib/python3.6/site-packages/radicale/__init__.py", line 193, in process_request_thread
radicale_1  |     request.do_handshake()
radicale_1  |   File "/usr/lib/python3.6/ssl.py", line 1068, in do_handshake
radicale_1  |     self._sslobj.do_handshake()
radicale_1  |   File "/usr/lib/python3.6/ssl.py", line 689, in do_handshake
radicale_1  |     self._sslobj.do_handshake()
radicale_1  | ssl.SSLError: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:841)

I generated both key and certificate with openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout radicale.key.pem -out radicale.cert.pem.
Here the radicale config:

[server]
hosts = 0.0.0.0:5232
ssl = True
certificate = /data/cert/radicale.cert.pem
key = /data/cert/radicale.key.pem
#certificate_authority =
protocol = PROTOCOL_TLSv1_2
#ciphers =
#dns_lookup = True
#realm = Radicale - Password Required

[encoding]
#request = utf-8
#stock = utf-8

[auth]
type = htpasswd
htpasswd_filename = /config/users
htpasswd_encryption = plain

[rights]
file = /config/rights

[storage]
filesystem_folder = /data/collections

[web]
type = internal
#type = none

[logging]
debug = True

[headers]
#Access-Control-Allow-Origin = *

Fail to load infcloud

After configuring radicale to load radicale_infcloud, the following error popped out:

ERROR: An exception occurred during server startup: Failed to load web module 'radicale_infcloud': No module named 'radicale_infcloud'

Seems weird, is this a bug to #17?

Latest release tag

Please add a latest release tag like the upstream repo has.
This makes automated builds a lot easier.

Upgrade to Radicale 3.x

Do you plan do upgrade this docker image to the latest version 3.0.4 of Radicale?

Add volume for config

Hi,

it would be alot easier if we had a volume for the config file. Could you implement that?

docker run errors out after --init

Hi

I am having issues running your docker run command it errors out after --init

here is the output below

`

tim@openmediavault:~$ docker run -d --name radicale \
>     -p 127.0.0.1:5232:5232 \
>     --read-only \
>     --init \    
docker: invalid reference format.
See 'docker run --help'.
tim@openmediavault:~$     --security-opt="no-new-privileges:true" \
>     --cap-drop ALL \
>     --cap-add CHOWN \
>     --cap-add SETUID \
>     --cap-add SETGID \
>     --cap-add KILL \
>     --pids-limit 50 \
>     --memory 256M \
>     --health-cmd="curl --fail http://localhost:5232 || exit 1" \
>     --health-interval=30s \
>     --health-retries=3 \
>     -v ~/radicale/data:/data \
>     -v ~/radicale/config:/config:ro \
>     tomsquest/docker-radicale
--security-opt=no-new-privileges:true: command not found

`
I'm not sure what is causing the invalid reference , I apologise now if this is due to my ignorance

thanks in advance

How to use actual docker volumes INSTEAD of volume mounts?

I was playing around with runing 'rootless' docker (think change using the userns features) and wanted to use internal volumes instead. COuldn't figure it out. Kept getting '

ERROR: for radicale Cannot start service radicale: failed to create shim: OCI runtime create failed: invalid mount {Destination:data Type:bind Source:/var/lib/docker/volumes/397cb3669d401faf85adc54e5dfdbf76f33f3a7ae8bfdfbd05726ef17b127cf1/_data Options:[rbind]}: mount destination data not absolute: unknown

My docker-compose.yml follows:

version: '3.7'

volumes:
  data:
    name: data
services:
  radicale:
    image: radicale:latest
    container_name: radicale
    ports:
      - 127.0.0.1:5232:5232
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    healthcheck:
      test: curl -f http://127.0.0.1:5232 || exit 1
      interval: 30s
      retries: 3
    restart: unless-stopped
    volumes:
      - data:/data

`/config` could be readonly

Currently, /config is writeable (chmod 700 /config).
As radicale should only be able to write in /data, this could be a good idea.

@robertbeal what do you think of it? Good idea?

Document multi-arch builds and their tags in Readme

Failed to access by bash container

I wanted to access by bash but it gives an error
pi@raspberrypi:~ $ docker exec -it radicale bash
OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: exec: "bash": executable file not found in $PATH: unknown
Any solution?

attaching to container fails since last update

Since the last update i'm getting the following error:

docker-compose file which worked before:

version: "2.2"

services:
  server:
    container_name: radicale
    image: tomsquest/docker-radicale:latest
    restart: unless-stopped
    read_only: true
    volumes:
      - /home/foo/radicale/data:/data
      - /home/foo/radicale/config:/config:ro
    ports:
      - "127.0.0.1:5232:5232"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - KILL
    mem_limit: 256M
    pids_limit: 50
    read_only: true
    init: true

Feature request: support UMASK environment variable

Hi,

It would be great if the docker-entrypoint.sh could support providing a UMASK variable, and set this using the umask command before running radicale.
Currently data files created by this image is readable by "all", but I would like to use umask 027, so only owner/group ID is able to read the data files.

Thanks ;)

Docker image from latest master?

As the last release 2.1.11 of radicale is quite a while ago, is there a way to get an image from latest master?
Like an experimental/nightly build or pre-release? Would it be as simple as updateing Dockerfile line 33?

...
&& python3 -m pip install git+https://github.com/Kozea/Radicale.git@master passlib[bcrypt] \
...

Thx

feat: add Docker Manifest for multi-architecture builds

[FATAL tini (8)] exec docker-entrypoint.sh failed: Exec format error

Hi,

first of all thank you for your work.
I am using radicale more than one year now with a normal installation on a raspberry pi and want to change over to docker.
When I try to start your container on a pi I get the error mentioned in the headline.
The same configuration runs without any problem with docker on windows.

I checked out the repository from github and found that the lines in the script and some other files end with "crlf".
After changing eol from "crlf" to "lf" only and rebuilding the container on the pi the script works as expected.
Can you have a look at this ?

Git clone every time on startup and return fatal error

Hi

I think they are a problem with Git on container startup.
If you already have a cloned repo, the git command return fatal error and container go down :(

Building with native build. Learn about native build in Compose here: https://docs.docker.com/go/compose-native-build/
Recreating radicale ... done
Attaching to radicale
radicale    | fatal: destination path '/data/collections' already exists and is not an empty directory.
radicale exited with code 128

root password is empty

# docker exec radicale head -n 1 /etc/shadow
root:::0:::::

standard_init_linux.go:211: exec user process caused "operation not permitted"

Hi,

I cannot start up the container in the current setup using it with traefik ssl termination (which is needed to use with Mac Clients).
I have a second setup in a virtualbox, also with traefik ssl termination it works fine.

When checking docker logs I only get the following line:
standard_init_linux.go:211: exec user process caused "operation not permitted"

I have tried running the container in privileged mode without "cap_drop..." I have tried without "read_only: true", still the same error message.

Any help you can give will be appreciated.

error 401 when login

Move `config` file to root folder

The config/ folder only contain one file, config as logging was removed previously.
We could move the config/config file at /.
Still, we need to keep the /config directory inside the container to allow a custom configuration (one could mount a volume at /config)

Never starts

It's broken and never starting:
docker container ls returns:
Up 22 seconds (health: starting)

My problem is: it's not starting so cannot to register container in traefik

Reason for removed git docs

Was just wondering whether there is any reason for doc: remove part about integrating Radicale and Git that one should be aware of, or if using git versioning is still fine to do?

Radicale won't start

Hi, I am facing quite a wierd issue, where the radicale appears not to start up at all.
Steps to reproduce:

$ git clone https://github.com/tomsquest/docker-radicale
$ cd docker-radicale/
$ mkdir data
$ docker-compose up
$ docker-compose logs radicale
Attaching to radicale

The Attaching to radicale is the only message that ever appears in logs. Apart from that, webpage is inaccessible although the server seems to work a bit

$ curl -f http://127.0.0.1:5232
Redirected to /.web

Tried older version (3.1.6.0) and the result is the same.
I am running on Aynology DSM 6.2.4-25556 Update 4.

Error on startup

Hi, I am trying to run Radicale using docker-compose but as soon as I get the container running, the log shows this:

ERROR: An exception occurred during server startup: Failed to start server '192.168.1.200:5232': [Errno 99] Address not available

I can't reach http://localhost:5232/. any idea what could be causing this?

my docker-compose looks like this

radicale:
    image: tomsquest/docker-radicale:latest
    container_name: radicale
    ports:
      - 127.0.0.1:5232:5232
    volumes:
      - /volume1/docker/radicale/data:/data
      - /volume1/docker/radicale/config:/config:ro
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    healthcheck:
      test: curl -f myip:5232 || exit 1
      interval: 30s
      retries: 3
    restart: unless-stopped

Include radicale-imap auth plugin into the docker image

I wonder, if it is possible to include the radicale-imap authentication plugin into the docker image?

InfCloud as an alternative UI

how do i enable/configure InfCloud or access it. i don't see any documentation regarding it.
Thanks

chown: /data: Permission denied

Dear programmers

I was following the readme to establish radicale in a container. However, server was not accessible by web or thunderbird. Trying to enter the container interactively, I saw that initialising the container, some permission error occurs. More or less minimal command to launch the container looks like that:

$ sudo docker run -a STDERR --name radicale -p 127.0.0.1:5232:5232 --cap-drop ALL --cap-add CHOWN --cap-add SETUID --cap-add SETGID --cap-add KILL tomsquest/docker-radicale
chown: /data: Permission denied

Container is the established, but it looks, data it cannot provide. The experiment was run at Debian 10 buster.

How is the correct way to flawlessly run a radicale container?

Thanks, Axel

QUESTION: How do I create a single user account?

On my macOS Catalina system running docker, I can run the image, login to the web UI with any username/password, and even access the web UI from outside of my network.

I want to create a single user account, just for me. How should I do this? I looked to do it via htpasswd, but I cannot find that within the image.

These instructions look promising, but I am unfamiliar with adding users via the terminal. Would I run this from within the container, or from the host macOS system?

sudo addgroup --gid 2999 radicale
sudo adduser --gid 2999 --uid 2999 --shell /bin/false --disabled-password --no-create-home radicale

And, I do want a password, so should I leave out "--disabled-password"?

GitHub Action to test calendars

Hello! First of all, thank you very much for your work, it is a very useful tool.

I was wondering how would a GitHub Action setup would be created around this docker version of Radicale in order to automate having a calendar created to be used by integration tests of a system using CalDav calendars.

I guess that once a service with Radicale is up, you can always automate creating a calendar through the admin UI, then configuring some events in the calendar programatically (no need to configure a calendar client as it's an automation use case) to then test if the system using CalDav interacts correctly with the calendar. Other than this approach, maybe there is a way to do most of this workflow already through some variable/instruction available from the configuration of the docker version.

Anyway, any guidance would be much appreciated, even if it is to confirm the approach I described :)

exec /sbin/docker-init: operation not permitted

Hi, the container has been working perfectly, and after some restarts, the following error is thrown, without any extra explanation:

exec /sbin/docker-init: operation not permitted

I'm using docker compose with the following configuration:

  radicale:
    image: tomsquest/docker-radicale
    container_name: mic_radicale
    restart: "no"
    ports:
      - "5232:5232"
    networks:
      - backend
    environment:
      - TAKE_FILE_OWNERSHIP=false
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    healthcheck:
      test: curl -f http://localhost:5232 || exit 1
      interval: 30s
      retries: 3
    volumes:
      - radicale-testing:/data
      - ./radicale-config:/config:ro

volumes:
  radicale-testing:
    driver: local

Any ideas on what I have done? It has been working until now.

Docker version:

Docker version 20.10.17, build 100c70180f

Docker-compose version:

docker-compose version 1.29.2, build unknown

I'm running Kubuntu on:

Distributor ID: Ubuntu
Description:    Ubuntu 22.04.1 LTS
Release:        22.04
Codename:       jammy

Thank you very much for the container and the help ❤️

Bcrypt Question

Hi,

first things first: Thank you!
I set it up today and its working perfect, thanks alot! 👍

I guess you does not see any comments on closed Issues so I open a new one. More a question than an issue:

How did you configure bcrypt? The Documentation says to use htpasswd but with the command "docker exec radicale htpasswd" it gives me a executable file not found error. Is it even possible to configure bcrypt with the Docker Container? Iam currently using crypt but since it is only working but not secure I would like to switch to bcrypt.
And how do you use SSL Certs? I tried to make a volume for it but Radicale does not find the certs. But the volume is mounted, I can see this via SSH.

Than another thing: I saw your config file. Do you even use bcrypt? You changed authentication to none which seems weird to me.
You also changed "filesystem_folder = /data/collections". My Radicale created a "collection-root" folder, so my config looks "filesystem_folder = /data". Otherwise you would have one more folder which is unnecessary, but thats just my opinion ;-)

can't create secured users through htpasswd

Wanted to create a user for external access, but failed to create through htpasswd:
docker exec -ti radicale htpasswd -c /users user1
with error "...container process caused: exec: "htpasswd": executable file not found in $PATH..."
Can you confirm htpasswd is available in the container?

no config file created

just doing a quick eval of radicale but looks like your Dockerfile is not creating the intial config file

radicale | [2021-10-12 18:25:55 +0000] [7] [CRITICAL] Invalid configuration: Failed to load config file '/config/config': No such file: '/config/config'

so after running once I created config file from your example in my host volume and then restarted and that seemed to work.

using compose file

version: '3.7'

services:
  radicale:
    image: tomsquest/docker-radicale
    container_name: radicale
    ports:
      - 5232:5232
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    healthcheck:
      test: curl -f http://localhost:5232 || exit 1
      interval: 30s
      retries: 3
#   restart: unless-stopped
    volumes:
      - ./data:/data
      - ./config:/config:ro

cannot open /etc/group

Hey guys,

first of all I want to thank you for this piece of work. It's a good thing to start with as a linux/docker freshman.

Following the instructions, I would like to start the container the production-grade way.
The directories on the host system have been created and adapted in the start command of the container.

docker run -d --name radicale \
-p 127.0.0.1:5232:5232 \
--read-only \
--init \
--security-opt="no-new-privileges:true" \
--cap-drop ALL \
--cap-add CHOWN \
--cap-add SETUID \
--cap-add SETGID \
--cap-add KILL \
--pids-limit 50 \
--memory 256M \
--health-cmd="curl \
--fail http://localhost:5232 || exit 1" \
--health-interval=30s \
--health-retries=3 \
-v /media/NAS/opt/radicale/data:/data \
-v /media/NAS/opt/radicale/config:/config:ro \
tomsquest/docker-radicale

As soon as I type the command, the container goes into the "Exited" status. The logs of the container get me this message:

root@server:~# docker container logs radicale
groupmod: cannot open /etc/group
groupmod: failed to unlock /etc/group

Permissions of the directories:

root@server:~# ls -la /media/NAS/opt/radicale/
total 16
drwxr-xr-x 4 root     root     4096 Mär 21 10:03 .
drwxr-xr-x 3 root     root     4096 Mär 21 09:37 ..
drwxr-xr-x 2 root     root     4096 Mär 21 09:56 config
drwxrwx--- 2 radicale radicale 4096 Mär 21 10:03 data

I guess I'm reaching the limits of my narrow knowledge here.

Do you have any ideas?

Thanks

Passwords don't do anything

I am able to log into the system and use any calendar without using a password