0.7.6-nbxyz2 version fails to start on Synology NAS (dnsmasq permissions)

[andrew-potachits]

took latest version 0.7.6-nbxyz2 and it failed to start on Synology NAS Container manager. The errors are like this:

netbootxyz  | [init] Setting up user nbxyz with PUID=1000 and PGID=1000
netbootxyz  |             _   _                 _                      
netbootxyz  |  _ __   ___| |_| |__   ___   ___ | |_  __  ___   _ ____  
netbootxyz  | | '_ \ / _ \ __| '_ \ / _ \ / _ \| __| \ \/ / | | |_  /  
netbootxyz  | | | | |  __/ |_| |_) | (_) | (_) | |_ _ >  <| |_| |/ /   
netbootxyz  | |_| |_|\___|\__|_.__/ \___/ \___/ \__(_)_/\_\__,  /___| 
netbootxyz  |                                              |___/       
netbootxyz  | 
netbootxyz  | If you enjoy netboot.xyz projects, please support us at:
netbootxyz  | 
netbootxyz  | https://opencollective.com/netbootxyz
netbootxyz  | https://github.com/sponsors/netbootxyz
netbootxyz  | 
netbootxyz  | [start] Starting supervisord (programs will run as nbxyz)
netbootxyz  | 
netbootxyz  | /usr/lib/python3.12/site-packages/supervisor/options.py:13: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
netbootxyz  |   import pkg_resources
netbootxyz  | 2025-06-14 16:56:18,875 INFO Set uid to user 0 succeeded
netbootxyz  | 2025-06-14 16:56:18,879 INFO supervisord started with pid 1
netbootxyz  | 2025-06-14 16:56:19,882 INFO spawned: 'nginx' with pid 22
netbootxyz  | 2025-06-14 16:56:19,883 INFO spawned: 'dnsmasq' with pid 23
netbootxyz  | 2025-06-14 16:56:19,884 INFO spawned: 'webapp' with pid 24
netbootxyz  | [dnsmasq] Starting TFTP server on port 69
netbootxyz  | [dnsmasq] TFTP root: /config/menus
netbootxyz  | [dnsmasq] TFTP security: enabled
netbootxyz  | [dnsmasq] Logging: enabled (dhcp and queries)
netbootxyz  | 
netbootxyz  | dnsmasq: failed to create listening socket for port 69: Permission denied
netbootxyz  | 
netbootxyz  | 2025-06-14 16:56:19,905 WARN exited: dnsmasq (exit status 2; not expected)
netbootxyz  | 2025-06-14 16:56:19,912 WARN exited: nginx (exit status 1; not expected)

the compose file is this:

services:
  netbootxyz:
    image: ghcr.io/netbootxyz/netbootxyz
    container_name: netbootxyz
    environment:
      - MENU_VERSION=2.0.47 # optional
      - NGINX_PORT=80 # optional
      - WEB_APP_PORT=3000 # optional
    volumes:
      - ./config:/config # optional
      - ./assets:/assets # optional
    ports:
      - 3000:3000  # optional, destination should match ${WEB_APP_PORT} variable above.
      - 69:69/udp
      - 8080:80  # optional, destination should match ${NGINX_PORT} variable above.
    restart: unless-stopped

rolled back to 0.7.5-nbxyz9 and it works fine.

[antonym]

Thanks for the report, I'll play around with it on my Synology. I refactored the container a bit in the latest release so I'll see if there's some stuff to tune.

[notylou]

I also encountered this problem. This failure made me realize that netbootxyz, as an important infrastructure of homelab, really cannot be automatically updated by watchtower...

[stavros-k]

Most likely dnsmasq missing the net_bind_service cap due to it starting via gosu

[sever-sever]

The same on VyOS even with privileged flag

add container image netbootxyz/netbootxyz
configure

set container name netboot allow-host-networks
set container name netboot capability 'net-bind-service'
set container name netboot image 'netbootxyz/netbootxyz'
set container name netboot port tftp destination '69'
set container name netboot port tftp source '69'
set container name netboot privileged

image:

vyos@r14#  run show container image 
REPOSITORY                                   TAG           IMAGE ID      CREATED       SIZE
docker.io/netbootxyz/netbootxyz              latest        7014069081be  7 days ago    172 MB

logs:

vyos@r14# run show log container netboot 
[init] Setting up user nbxyz with PUID=1000 and PGID=1000
[netbootxyz-init] Downloading netboot.xyz at 2.0.87
            _   _                 _                      
 _ __   ___| |_| |__   ___   ___ | |_  __  ___   _ ____  
| '_ \ / _ \ __| '_ \ / _ \ / _ \| __| \ \/ / | | |_  /  
| | | |  __/ |_| |_) | (_) | (_) | |_ _ >  <| |_| |/ /   
|_| |_|\___|\__|_.__/ \___/ \___/ \__(_)_/\_\__,  /___| 
                                             |___/       

If you enjoy netboot.xyz projects, please support us at:

https://opencollective.com/netbootxyz
https://github.com/sponsors/netbootxyz

[start] Starting supervisord (programs will run as nbxyz)
/usr/lib/python3.12/site-packages/supervisor/options.py:13: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
2025-06-19 11:04:25,173 INFO Set uid to user 0 succeeded
2025-06-19 11:04:25,176 INFO supervisord started with pid 1
2025-06-19 11:04:26,180 INFO spawned: 'nginx' with pid 36
2025-06-19 11:04:26,182 INFO spawned: 'dnsmasq' with pid 37
2025-06-19 11:04:26,185 INFO spawned: 'webapp' with pid 38
[dnsmasq] Starting TFTP server on port 69
[dnsmasq] TFTP root: /config/menus
[dnsmasq] TFTP security: enabled
[dnsmasq] Logging: enabled (dhcp and queries)

dnsmasq: failed to create listening socket for port 69: Permission denied
2025-06-19 11:04:26,198 WARN exited: dnsmasq (exit status 2; not expected)
2025-06-19 11:04:26,209 WARN exited: nginx (exit status 1; not expected)
2025-06-19 11:04:27,545 INFO spawned: 'nginx' with pid 60
2025-06-19 11:04:27,547 INFO spawned: 'dnsmasq' with pid 61
2025-06-19 11:04:27,548 INFO success: webapp entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
[dnsmasq] Starting TFTP server on port 69
[dnsmasq] TFTP root: /config/menus
[dnsmasq] TFTP security: enabled
[dnsmasq] Logging: enabled (dhcp and queries)

dnsmasq: failed to create listening socket for port 69: Permission denied
2025-06-19 11:04:27,560 WARN exited: dnsmasq (exit status 2; not expected)
2025-06-19 11:04:27,566 WARN exited: nginx (exit status 1; not expected)
2025-06-19 11:04:29,570 INFO spawned: 'nginx' with pid 72
2025-06-19 11:04:29,573 INFO spawned: 'dnsmasq' with pid 73
[dnsmasq] Starting TFTP server on port 69
[dnsmasq] TFTP root: /config/menus
[dnsmasq] TFTP security: enabled
[dnsmasq] Logging: enabled (dhcp and queries)

dnsmasq: failed to create listening socket for port 69: Permission denied
2025-06-19 11:04:29,584 WARN exited: dnsmasq (exit status 2; not expected)
2025-06-19 11:04:29,590 WARN exited: nginx (exit status 1; not expected)
2025-06-19 11:04:30,592 INFO gave up: nginx entered FATAL state, too many start retries too quickly
2025-06-19 11:04:33,071 INFO spawned: 'dnsmasq' with pid 88
[dnsmasq] Starting TFTP server on port 69
[dnsmasq] TFTP root: /config/menus
[dnsmasq] TFTP security: enabled
[dnsmasq] Logging: enabled (dhcp and queries)

dnsmasq: failed to create listening socket for port 69: Permission denied
2025-06-19 11:04:33,082 WARN exited: dnsmasq (exit status 2; not expected)
2025-06-19 11:04:34,084 INFO gave up: dnsmasq entered FATAL state, too many start retries too quickly
[edit]
vyos@r14#  

The latest working version etbootxyz/netbootxyz:0.7.5-nbxyz9

vyos@r14# sudo netstat -tulpn | grep 69
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      18269/nginx: master 
udp        0      0 0.0.0.0:69              0.0.0.0:*                           18271/dnsmasq       
udp6       0      0 :::69                   :::*                                18271/dnsmasq       
[edit]

vyos@r14# run show log container netboot 
[netbootxyz-init] Downloading netboot.xyz at 2.0.87
            _   _                 _                      
 _ __   ___| |_| |__   ___   ___ | |_  __  ___   _ ____  
| '_ \ / _ \ __| '_ \ / _ \ / _ \| __| \ \/ / | | |_  /  
| | | |  __/ |_| |_) | (_) | (_) | |_ _ >  <| |_| |/ /   
|_| |_|\___|\__|_.__/ \___/ \___/ \__(_)_/\_\__,  /___| 
                                             |___/       

If you enjoy netboot.xyz projects, please support us at:

https://opencollective.com/netbootxyz
https://github.com/sponsors/netbootxyz

/usr/lib/python3.12/site-packages/supervisor/options.py:13: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
2025-06-19 11:21:38,630 INFO Set uid to user 0 succeeded
2025-06-19 11:21:38,635 INFO supervisord started with pid 28
2025-06-19 11:21:39,639 INFO spawned: 'syslog-ng' with pid 29
2025-06-19 11:21:39,641 INFO spawned: 'nginx' with pid 30
2025-06-19 11:21:39,644 INFO spawned: 'webapp' with pid 31
2025-06-19 11:21:39,647 INFO spawned: 'dnsmasq' with pid 32
2025-06-19 11:21:39,651 INFO spawned: 'messages-log' with pid 33
2025-06-19 11:21:39,658 WARN exited: messages-log (exit status 1; not expected)
2025-06-19 11:21:41,044 INFO success: syslog-ng entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-06-19 11:21:41,044 INFO success: nginx entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-06-19 11:21:41,044 INFO success: webapp entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-06-19 11:21:41,045 INFO success: dnsmasq entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-06-19 11:21:41,047 INFO spawned: 'messages-log' with pid 46
2025-06-19 11:21:39 notice syslog-ng[29]: syslog-ng starting up; version='4.8.3'
2025-06-19 11:21:42,054 INFO success: messages-log entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
[edit]
vyos@r14# 

[antonym]

Made a few changes and it works on my Synology now, got rid of gosu and running the app, dnsmasq as nbxyz users using root to initially bind the port. nginx workers run as nbxyz. Originally it was working on my Debian Docker machine, but this should simplify it.

Give 0.7.6-nbxyz4 a try.

[sever-sever]

Give 0.7.6-nbxyz4 a try.

Worked for me
VyOS + podman backend

podman                           4.9.5

check

vyos@r14# run show conf com | match netboo
set container name netboot allow-host-networks
set container name netboot capability 'net-bind-service'
set container name netboot image 'netbootxyz/netbootxyz:0.7.6-nbxyz4'
[edit]
vyos@r14# 
[edit]
vyos@r14# sudo netstat -tulpn | match "69|80|3000|8080"
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      6418/nginx: master  
tcp6       0      0 :::3000                 :::*                    LISTEN      6420/node           
udp        0      0 0.0.0.0:69              0.0.0.0:*                           6419/dnsmasq        
udp6       0      0 :::69                   :::*                                6419/dnsmasq        
[edit]
vyos@r14# 
[edit]
vyos@r14# run show container log netboot | match "ngin|dns|weba"
2025-06-19 16:55:56,831 INFO spawned: 'nginx' with pid 36
2025-06-19 16:55:56,834 INFO spawned: 'dnsmasq' with pid 37
2025-06-19 16:55:56,836 INFO spawned: 'webapp' with pid 38
[dnsmasq] Starting TFTP server on port 69
[dnsmasq] TFTP root: /config/menus
[dnsmasq] TFTP security: enabled
[dnsmasq] Logging: enabled (dhcp and queries)
dnsmasq[37]: started, version 2.91 DNS disabled
dnsmasq[37]: compile time options: IPv6 GNU-getopt no-DBus no-UBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset no-nftset auth no-DNSSEC loop-detect inotify dumpfile
dnsmasq-tftp[37]: TFTP root is /config/menus secure mode 
2025-06-19 16:55:58,203 INFO success: nginx entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-06-19 16:55:58,203 INFO success: dnsmasq entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2025-06-19 16:55:58,203 INFO success: webapp entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
[edit]
vyos@r14# 

@antonym Thanks for the quick fix.