Cannot mount remotes NFS/SMB

[slaranjeira77]

I have this issue only when XenOrchestra is running in docker, in my case a docker-swarm.

The NFS/SMB share is configured correctly as I can see it and mount it on another hosts, the showmount -e shows everything correctly.

When mounting this remote with the VM using your XenOrchestaInstaller it works flawlessly.

Here are the logs from XenOrchestra:

remote.test
{
  "id": "98f4d7b7-d55a-4616-a543-9e6695f6128f"
}
{
  "shortMessage": "Command failed with exit code 32: mount -o  -t nfs 10.10.0.40:/BACKUP /run/xo-server/mounts/98f4d7b7-d55a-4616-a543-9e6695f6128f",
  "command": "mount -o  -t nfs 10.10.0.40:/BACKUP /run/xo-server/mounts/98f4d7b7-d55a-4616-a543-9e6695f6128f",
  "escapedCommand": "mount -o \"\" -t nfs \"10.10.0.40:/BACKUP\" \"/run/xo-server/mounts/98f4d7b7-d55a-4616-a543-9e6695f6128f\"",
  "exitCode": 32,
  "stdout": "",
  "stderr": "mount.nfs: access denied by server while mounting 10.10.0.40:/BACKUP",
  "failed": true,
  "timedOut": false,
  "isCanceled": false,
  "killed": false,
  "message": "Command failed with exit code 32: mount -o  -t nfs 10.10.0.40:/BACKUP /run/xo-server/mounts/98f4d7b7-d55a-4616-a543-9e6695f6128f
mount.nfs: access denied by server while mounting 10.10.0.40:/BACKUP",
  "name": "Error",
  "stack": "Error: Command failed with exit code 32: mount -o  -t nfs 10.10.0.40:/BACKUP /run/xo-server/mounts/98f4d7b7-d55a-4616-a543-9e6695f6128f
mount.nfs: access denied by server while mounting 10.10.0.40:/BACKUP
    at makeError (/etc/xen-orchestra/node_modules/execa/lib/error.js:60:11)
    at handlePromise (/etc/xen-orchestra/node_modules/execa/index.js:118:26)
    at runNextTicks (node:internal/process/task_queues:60:5)
    at processImmediate (node:internal/timers:454:9)
    at process.callbackTrampoline (node:internal/async_hooks:130:17)
    at NfsHandler._sync (/etc/xen-orchestra/@xen-orchestra/fs/src/_mount.js:68:7)"
}

The container have all the privileges indicated on your documentation, I also tried with privileged: true with no success..

its seems to me a problem with mount privileges.

Server: Docker Engine - Community
 Engine:
  Version:          27.3.1
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.22.7
  Git commit:       41ca978
  Built:            Fri Sep 20 11:41:11 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.22
  GitCommit:        7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
 runc:
  Version:          1.1.14
  GitCommit:        v1.1.14-0-g2c9f560
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Tried with other docker images aswell with the same result, maybe a problem with the current XenOrchestra version?

Thanks for the help and keep up the good work

[ronivay]

Hey,

Have you checked your NFS server side logs for any hints why permission is denied? Could it be that it sees the container ip-address and isn't allowing connection from it?

[slaranjeira77]

I assumed that it was something on the NAS side like you by the logs but unfortunately its not. I have 3 (2 trueNas boxes and 1 QNAP) all with the same error. Even if I allow everyone (*) for that specific share for testing, I get the same result. Even with a SMB share, same exact error.

Also tried to do a macvlan on that container with no success.

The showmount -e shows the exports correctly.

[ronivay]

Hey,

Sorry for delay on this issue. I was finally able to test both NFS and SMB with the latest version of container. With documented privileges on a Debian docker host:

--cap-add sys_admin --cap-add dac_read_search and --security-opt apparmor:unconfined

I had no issues adding either NFS or SMB remote to XO so this has to be something specific to your environment and i don't have much to suggest as i can't reproduce the issue on my end.

[ronivay]

Any updates to this? Have you had time to confirm that container permissions were actually correctly set?

[slaranjeira77]

Hello ronivay and sorry for the late reply.

So I found the issue, this error happens only when on a swarm environment (I forgot to mention this rather important detail). Using a single docker host works flawlessly. I dont know if its possible to do this on a swarm, do you have any opinions on this?

[ronivay]

Hello ronivay and sorry for the late reply.

So I found the issue, this error happens only when on a swarm environment (I forgot to mention this rather important detail). Using a single docker host works flawlessly. I dont know if its possible to do this on a swarm, do you have any opinions on this?

Unfortunately i don't have a swarm cluster to test with right now, but clearly it's indeed a swarm specific thing. I couldn't immediately find any confirmation that this couldn't work in swarm so could simply be some permission difference compared to regular docker host. If you can't find any fix for this, I guess as a workaround you could also consider adding your NFS share as a docker volume, attach that to the container and use local remote inside XO.