From 7d305a0146ff9ccd287e058824d3721cdca64f8a Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Fri, 24 Apr 2026 14:35:40 +0700 Subject: [PATCH] fix: pass /dev/kmsg via devices: so cgroup allows the read bind-mounting /dev/kmsg under volumes: creates the node but leaves the device-cgroup controller blocking the read (EPERM). cap_drop=[ALL] clears the default device allow-list, so even with CAP_SYSLOG the kernel refuses. moving it under devices: adds the cgroup allow rule alongside the bind-mount, which is what cadvisor actually needs. --- docker-compose.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index dd58cd3..6216094 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -18,6 +18,8 @@ services: security_opt: [ "no-new-privileges:true" ] cap_drop: [ ALL ] cap_add: [ DAC_OVERRIDE, SYSLOG ] # DAC_OVERRIDE: write alloy-owned /var/lib/alloy/data + read root-owned mounts. SYSLOG: read /dev/kmsg when kernel.dmesg_restrict=1. + devices: + - /dev/kmsg:/dev/kmsg:r # cadvisor OOM detection (needs device-cgroup allow, not just bind-mount) volumes: - alloy-data:/var/lib/alloy/data # remotecfg + storage state - /var/run/docker.sock:/var/run/docker.sock:ro # discovery.docker + loki.source.docker (streams log API) @@ -27,7 +29,6 @@ services: - /:/rootfs:ro,rslave # filesystem collector (rslave picks up new mounts) - /var/log/journal:/var/log/journal:ro # loki.source.journal - /etc/machine-id:/etc/machine-id:ro # stable host id for journal reader - - /dev/kmsg:/dev/kmsg:ro # cadvisor OOM event detection - /run/udev/data:/run/udev/data:ro # node-exporter diskstats device labels (model/serial/WWN) configs: - { source: alloy_config, target: /etc/alloy/config.alloy }