Docker container startup on DietPi failed with exit code 126.

[MojoMC]

What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?

• I have searched the existing open and closed issues and I checked the docs https://docs.netalertx.com/

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Edge
• Safari (unsupported) - PRs welcome
• N/A - This is an issue with the backend

Current Behavior

Hi,

the docker run command from https://docs.netalertx.com/DOCKER_INSTALLATION/#docker-guide-releases-docs-plugins-website does not start a docker container.
The docker run command from https://github.com/netalertx/NetAlertX ("Quick Start") does create a container that is constantly restarting.

If I run docker run --rm -it ghcr.io/netalertx/netalertx:latest the first few lines in the resulting output are:
Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py

Further errors may be possible.

I found the issue #1545 with a similar error message but that was closed already.
I am willing to provide further information or logs (if I know where to find them). Right now I don't have a docker-compose.yml or can set the highest log level in Settings -> Core.

Thanks in advance
MojoMC

Expected Behavior

I expected the docker container to start and not restart constantly.

Steps To Reproduce

I prepared my fresh basic DietPi Installation for NetAlertX by installing Docker, Docker-Compose and Python 3 via dietpi-software.
Otherwise I just used the docker run command from https://docs.netalertx.com/DOCKER_INSTALLATION/#docker-guide-releases-docs-plugins-website and from https://github.com/netalertx/NetAlertX ("Quick Start").

Relevant app.conf settings

docker-compose.yml

Debug or Trace enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

Relevant app.log section

  PASTE LOG HERE. Using the triple backticks preserves format.

Docker Logs

 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com


Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
══════════════════════════════════════════════════════════════════════════════
🆕  First run detected. Default configuration written to /data/config/app.conf.

    Review your settings in the UI or edit the file directly before trusting
    this instance in production.
══════════════════════════════════════════════════════════════════════════════
--> first run db.sh
══════════════════════════════════════════════════════════════════════════════
🆕  First run detected — building initial database at: /data/db/app.db

    Do not interrupt this step. When complete, consider backing up the fresh
    DB before onboarding sensitive or critical networks.
══════════════════════════════════════════════════════════════════════════════
--> mandatory folders.sh
--> apply conf override.sh
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  WARNING: ARP flux sysctls are not set.

    Expected values:
      net.ipv4.conf.all.arp_ignore=1
      net.ipv4.conf.all.arp_announce=2

    Note: If using 'network_mode: host', setting these via docker-compose sysctls
    requires the NET_ADMIN capability. When granted, these sysctls will
    modify the host namespace. Otherwise, you must configure them directly
    on your host operating system instead.

    Detection accuracy may be reduced until configured.

    See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/
══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  ATTENTION: NetAlertX is not running with --network=host.

    Bridge networking blocks passive discovery (ARP, NBNS, mDNS) and active
    scanning accuracy. Most plugins expect raw access to the LAN through host
    networking and CAP_NET_RAW capabilities.

    Restart the container with:
        docker run --network=host --cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=NET_BIND_SERVICE
    or set "network_mode: host" in docker-compose.yml.

    https://docs.netalertx.com/docker-troubleshooting/network-mode
══════════════════════════════════════════════════════════════════════════════
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

    Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
    required in this container. Please remove unnecessary capabilities.

    https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Container is running as read-write, not in read-only mode.

    Please mount the root filesystem as --read-only or use read_only: true
    https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
Note: su-exec failed (exit 0); continuing as current user without privilege drop.
ℹ️  NetAlertX startup: Running privilege check and path priming as ROOT.
    (On modern systems, privileges will be dropped to PUID after setup)

 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com


Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  WARNING: ARP flux sysctls are not set.

    Expected values:
      net.ipv4.conf.all.arp_ignore=1
      net.ipv4.conf.all.arp_announce=2

    Note: If using 'network_mode: host', setting these via docker-compose sysctls
    requires the NET_ADMIN capability. When granted, these sysctls will
    modify the host namespace. Otherwise, you must configure them directly
    on your host operating system instead.

    Detection accuracy may be reduced until configured.

    See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/
══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  ATTENTION: NetAlertX is not running with --network=host.

    Bridge networking blocks passive discovery (ARP, NBNS, mDNS) and active
    scanning accuracy. Most plugins expect raw access to the LAN through host
    networking and CAP_NET_RAW capabilities.

    Restart the container with:
        docker run --network=host --cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=NET_BIND_SERVICE
    or set "network_mode: host" in docker-compose.yml.

    https://docs.netalertx.com/docker-troubleshooting/network-mode
══════════════════════════════════════════════════════════════════════════════
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

    Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
    required in this container. Please remove unnecessary capabilities.

    https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Container is running as read-write, not in read-only mode.

    Please mount the root filesystem as --read-only or use read_only: true
    https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
Note: su-exec failed (exit 0); continuing as current user without privilege drop.

 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com


Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  WARNING: ARP flux sysctls are not set.

    Expected values:
      net.ipv4.conf.all.arp_ignore=1
      net.ipv4.conf.all.arp_announce=2

    Note: If using 'network_mode: host', setting these via docker-compose sysctls
    requires the NET_ADMIN capability. When granted, these sysctls will
    modify the host namespace. Otherwise, you must configure them directly
    on your host operating system instead.

    Detection accuracy may be reduced until configured.

    See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/
══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh

NetAlertX note: current UID 0 GID 0, expected UID 20211 GID 20211
--> host mode network.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  ATTENTION: NetAlertX is not running with --network=host.

    Bridge networking blocks passive discovery (ARP, NBNS, mDNS) and active
    scanning accuracy. Most plugins expect raw access to the LAN through host
    networking and CAP_NET_RAW capabilities.

    Restart the container with:
        docker run --network=host --cap-add=NET_RAW --cap-add=NET_ADMIN --cap-add=NET_BIND_SERVICE
    or set "network_mode: host" in docker-compose.yml.

    https://docs.netalertx.com/docker-troubleshooting/network-mode
══════════════════════════════════════════════════════════════════════════════
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

    Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
    required in this container. Please remove unnecessary capabilities.

    https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Container is running as read-write, not in read-only mode.

    Please mount the root filesystem as --read-only or use read_only: true
    https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.

[jokob-sk]

Hi,

The command you are running is missing some parameters - not sure where you got it form. The page you linked has this example:

docker run -d --rm --network=host \
  -v /local_data_dir:/data \
  -v /etc/localtime:/etc/localtime \
  --tmpfs /tmp:uid=${NETALERTX_UID:-20211},gid=${NETALERTX_GID:-20211},mode=1700 \
  -e PORT=20211 \
  -e APP_CONF_OVERRIDE={"GRAPHQL_PORT":"20214"} \
  ghcr.io/netalertx/netalertx:latest

Yours is missing mount points. There is also no "Quick start" section on any of the pages you listed so I'm confused a bit.

[MojoMC]

The docker command I used to show whats going on in the container during start-up was missing options, that was my mistake.

tl,dr:

• fresh dietpi
• install Docker, Docker-Compose and Python 3 via dietpi-software
• run one of the two docker commands form the documentation
• no success

If I use docker run -d --rm --network=host \ -v /local_data_dir:/data \ -v /etc/localtime:/etc/localtime \ --tmpfs /tmp:uid=${NETALERTX_UID:-20211},gid=${NETALERTX_GID:-20211},mode=1700 \ -e PORT=20211 \ -e APP_CONF_OVERRIDE={"GRAPHQL_PORT":"20214"} \ ghcr.io/netalertx/netalertx:latest from https://docs.netalertx.com/DOCKER_INSTALLATION/#docker-guide-releases-docs-plugins-website without detaching I get the following output:

 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com


Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
    * Creating DB locked log.
    * Creating Execution queue log.
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝  APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

    Make sure the JSON content is correct before starting the application.
══════════════════════════════════════════════════════════════════════════════
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  WARNING: ARP flux sysctls are not set.

    Expected values:
      net.ipv4.conf.all.arp_ignore=1
      net.ipv4.conf.all.arp_announce=2

    Note: If using 'network_mode: host', setting these via docker-compose sysctls
    requires the NET_ADMIN capability. When granted, these sysctls will
    modify the host namespace. Otherwise, you must configure them directly
    on your host operating system instead.

    Detection accuracy may be reduced until configured.

    See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/
══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

    Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
    required in this container. Please remove unnecessary capabilities.

    https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Container is running as read-write, not in read-only mode.

    Please mount the root filesystem as --read-only or use read_only: true
    https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
Note: su-exec failed (exit 0); continuing as current user without privilege drop.
ℹ️  NetAlertX startup: Running privilege check and path priming as ROOT.
    (On modern systems, privileges will be dropped to PUID after setup)

 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com


Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝  APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

    Make sure the JSON content is correct before starting the application.
══════════════════════════════════════════════════════════════════════════════
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  WARNING: ARP flux sysctls are not set.

    Expected values:
      net.ipv4.conf.all.arp_ignore=1
      net.ipv4.conf.all.arp_announce=2

    Note: If using 'network_mode: host', setting these via docker-compose sysctls
    requires the NET_ADMIN capability. When granted, these sysctls will
    modify the host namespace. Otherwise, you must configure them directly
    on your host operating system instead.

    Detection accuracy may be reduced until configured.

    See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/
══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

    Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
    required in this container. Please remove unnecessary capabilities.

    https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Container is running as read-write, not in read-only mode.

    Please mount the root filesystem as --read-only or use read_only: true
    https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
Note: su-exec failed (exit 0); continuing as current user without privilege drop.

 _   _      _    ___  _           _  __   __
| \ | |    | |  / _ \| |         | | \ \ / /
|  \| | ___| |_/ /_\ \ | ___ _ __| |_ \ V /
| .   |/ _ \ __|  _  | |/ _ \  __| __|/   \
| |\  |  __/ |_| | | | |  __/ |  | |_/ /^\ \
\_| \_/\___|\__\_| |_/_|\___|_|   \__\/   \/
   Network intruder and presence detector.
   https://netalertx.com


Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝  APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

    Make sure the JSON content is correct before starting the application.
══════════════════════════════════════════════════════════════════════════════
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  WARNING: ARP flux sysctls are not set.

    Expected values:
      net.ipv4.conf.all.arp_ignore=1
      net.ipv4.conf.all.arp_announce=2

    Note: If using 'network_mode: host', setting these via docker-compose sysctls
    requires the NET_ADMIN capability. When granted, these sysctls will
    modify the host namespace. Otherwise, you must configure them directly
    on your host operating system instead.

    Detection accuracy may be reduced until configured.

    See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/
══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh

NetAlertX note: current UID 0 GID 0, expected UID 20211 GID 20211
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

    Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
    required in this container. Please remove unnecessary capabilities.

    https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities
══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️  Warning: Container is running as read-write, not in read-only mode.

    Please mount the root filesystem as --read-only or use read_only: true
    https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem
══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.```

If I use the slightly different `docker run -d \
  --network=host \
  --restart unless-stopped \
  -v /local_data_dir:/data \
  -v /etc/localtime:/etc/localtime:ro \
  --tmpfs /tmp:uid=20211,gid=20211,mode=1700 \
  -e PORT=20211 \
  -e APP_CONF_OVERRIDE='{"GRAPHQL_PORT":"20214"}' \
  ghcr.io/netalertx/netalertx:latest` from [[](url)](https://github.com/netalertx/NetAlertX#quick-start) (where IT IS located under the menu point named "Quick Start" and described with _"Start NetAlertX in seconds with Docker"_) without detaching I get the output

---

| \ | | | | / _ | | | | \ \ / /
| | | | |/ /\ \ | ___ _ _| | \ V /
| . |/ _ \ __| _ | |/ _ \ __| __|/
| |\ | __/ || | | | | / | | |_/ /^\
_| _/_|__| |/|___|| __/ /
Network intruder and presence detector.
https://netalertx.com

Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
* Creating DB locked log.
* Creating Execution queue log.
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝 APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

Make sure the JSON content is correct before starting the application.

══════════════════════════════════════════════════════════════════════════════
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ WARNING: ARP flux sysctls are not set.

Expected values:
  net.ipv4.conf.all.arp_ignore=1
  net.ipv4.conf.all.arp_announce=2

Note: If using 'network_mode: host', setting these via docker-compose sysctls
requires the NET_ADMIN capability. When granted, these sysctls will
modify the host namespace. Otherwise, you must configure them directly
on your host operating system instead.

Detection accuracy may be reduced until configured.

See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/

══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.

https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities

══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Container is running as read-write, not in read-only mode.

Please mount the root filesystem as --read-only or use read_only: true
https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem

══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
Note: su-exec failed (exit 0); continuing as current user without privilege drop.
ℹ️ NetAlertX startup: Running privilege check and path priming as ROOT.
(On modern systems, privileges will be dropped to PUID after setup)

---

| \ | | | | / _ | | | | \ \ / /
| | | | |/ /\ \ | ___ _ _| | \ V /
| . |/ _ \ __| _ | |/ _ \ __| __|/
| |\ | __/ || | | | | / | | |_/ /^\
_| _/_|__| |/|___|| __/ /
Network intruder and presence detector.
https://netalertx.com

Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝 APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

Make sure the JSON content is correct before starting the application.

══════════════════════════════════════════════════════════════════════════════
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ WARNING: ARP flux sysctls are not set.

Expected values:
  net.ipv4.conf.all.arp_ignore=1
  net.ipv4.conf.all.arp_announce=2

Note: If using 'network_mode: host', setting these via docker-compose sysctls
requires the NET_ADMIN capability. When granted, these sysctls will
modify the host namespace. Otherwise, you must configure them directly
on your host operating system instead.

Detection accuracy may be reduced until configured.

See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/

══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.

https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities

══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Container is running as read-write, not in read-only mode.

Please mount the root filesystem as --read-only or use read_only: true
https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem

══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
Note: su-exec failed (exit 0); continuing as current user without privilege drop.

---

| \ | | | | / _ | | | | \ \ / /
| | | | |/ /\ \ | ___ _ _| | \ V /
| . |/ _ \ __| _ | |/ _ \ __| __|/
| |\ | __/ || | | | | / | | |_/ /^\
_| _/_|__| |/|___|| __/ /
Network intruder and presence detector.
https://netalertx.com

Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝 APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

Make sure the JSON content is correct before starting the application.

══════════════════════════════════════════════════════════════════════════════
--> override individual settings.sh
--> host optimization.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ WARNING: ARP flux sysctls are not set.

Expected values:
  net.ipv4.conf.all.arp_ignore=1
  net.ipv4.conf.all.arp_announce=2

Note: If using 'network_mode: host', setting these via docker-compose sysctls
requires the NET_ADMIN capability. When granted, these sysctls will
modify the host namespace. Otherwise, you must configure them directly
on your host operating system instead.

Detection accuracy may be reduced until configured.

See: https://docs.netalertx.com/docker-troubleshooting/arp-flux-sysctls/

══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh

NetAlertX note: current UID 0 GID 0, expected UID 20211 GID 20211
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.

https://docs.netalertx.com/docker-troubleshooting/excessive-capabilities

══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Container is running as read-write, not in read-only mode.

Please mount the root filesystem as --read-only or use read_only: true
https://docs.netalertx.com/docker-troubleshooting/read-only-filesystem

══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.```

I can't determine from the documentation if I need a different type of run command for my type of setup. Any help is appreciated.

[jokob-sk]

Thanks for the detailed report and for re-testing with both documented run commands.

From the logs, the startup command itself does not appear to be the issue. Both variants fail at the exact same point:

env: can't execute 'python3': Operation not permitted

This happens before the NetAlertX application actually starts. The failing component is the container runtime/kernel refusing to execute the Python interpreter itself inside the container.

The important detail is that this is not:

python3: not found

Instead, it is:

Operation not permitted

which usually indicates one of the following host/runtime-level issues:

• Docker storage mounted with noexec
• AppArmor/security policy restrictions
• Rootless Docker limitations
• CPU architecture mismatch
• Broken Docker/container runtime setup

The warnings about ARP flux, excessive capabilities, read-only mode, etc. are unrelated and non-fatal.

A few documentation pages that may be relevant here:

• AUFS Legacy Storage Driver Support - especially relevant if Docker is using aufs instead of overlay2, or if this is an older Synology/DietPi-style setup. This page specifically discusses Operation not permitted issues caused by capability stripping and legacy storage drivers.
• Incorrect Container User - relevant because your logs show:
  current UID 0 GID 0, expected UID 20211 GID 20211
• PUID/PGID Security - relevant because the logs also show:
  su-exec failed
• Mount Configuration Issues] -useful in case the Docker storage or mounted paths are using noexec

Could you please provide the output of the following commands?

docker run --rm ghcr.io/netalertx/netalertx:latest /bin/sh -c 'which python3 && ls -l $(which python3) && python3 --version'

uname -a
uname -m

docker info

mount | grep noexec
mount | grep docker

Also helpful:

docker inspect ghcr.io/netalertx/netalertx:latest --format '{{.Os}}/{{.Architecture}}'

And specifically from docker info, please check/report:

• Storage Driver
• Security Options
• Rootless mode status

At the moment this looks more like a host/container-runtime execution issue than a NetAlertX configuration problem, but the above output should help narrow it down quickly.

[MojoMC]

docker run --rm ghcr.io/netalertx/netalertx:latest /bin/sh -c 'which python3 && ls -l $(which python3) && python3 --version' results in
/opt/venv/bin/python3
lrwxrwxrwx 1 readonly readonly 6 May 4 05:03 /opt/venv/bin/python3 -> python
/bin/sh: python3: Operation not permitted
Note: su-exec failed (exit 0); continuing as current user without privilege drop.
/opt/venv/bin/python3
lrwxrwxrwx 1 readonly readonly 6 May 4 05:03 /opt/venv/bin/python3 -> python
/bin/sh: python3: Operation not permitted

uname -a results in
Linux PiZero 6.18.29+rpt-rpi-v6 #1 Raspbian 1:6.18.29-1+rpt1 (2026-05-12) armv6l GNU/Linux

uname -m results in
armv6l

docker info results in
Client: Docker Engine - Community
Version: 28.5.2
Context: default
Debug Mode: false
Plugins:
compose: Docker Compose (Docker Inc.)
Version: v5.0.2
Path: /usr/libexec/docker/cli-plugins/docker-compose
Server:
Containers: 2
Running: 0
Paused: 0
Stopped: 2
Images: 1
Server Version: 28.5.2
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: journald
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: dea7da592f5d1d2b7755e3a161be07f43fad8f75
runc version: v1.3.4-0-gd6d73eb8
init version: de40ad0
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.18.29+rpt-rpi-v6
Operating System: Raspbian GNU/Linux 13 (trixie)
OSType: linux
Architecture: armv6l
CPUs: 1
Total Memory: 474.7MiB
Name: PiZero
ID: b73c4f36-110c-4551-af5b-9ced77a75881
Docker Root Dir: /mnt/dietpi_userdata/docker-data
Debug Mode: false
Experimental: false
Insecure Registries:
::1/128
127.0.0.0/8
Live Restore Enabled: false
WARNING: No cpuset support

mount | grep noexec results in
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
none on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/credentials/getty@tty1.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,noswap)

mount | grep docker just springs back to the prompt without any output.

docker inspect ghcr.io/netalertx/netalertx:latest --format '{{.Os}}/{{.Architecture}}' results in
linux/arm

[jokob-sk]

Thanks, this is useful context. Before changing anything in the build or dependencies, we should confirm where the failure is actually occurring (container runtime vs interpreter vs privilege drop).

Could you run the following inside the same image and share the output?

1. Check the actual Python binary (not the symlink)

docker run --rm -it ghcr.io/netalertx/netalertx:latest /bin/sh -c '
ls -l /opt/venv/bin/python &&
file /opt/venv/bin/python &&
/opt/venv/bin/python --version
'

---

2. Try bypassing python3 wrapper entirely

docker run --rm -it ghcr.io/netalertx/netalertx:latest /bin/sh -c '
/opt/venv/bin/python --version
echo $?
'

---

3. Check execution capability on a minimal script

docker run --rm -it ghcr.io/netalertx/netalertx:latest /bin/sh -c '
echo "print(\"ok\")" > /tmp/test.py
/opt/venv/bin/python /tmp/test.py
'

---

4. Confirm runtime user / permissions context

docker run --rm -it ghcr.io/netalertx/netalertx:latest /bin/sh -c '
id
mount | grep -E " /opt|/app|noexec"
'

---

Once we have these results we can clearly determine whether:

• the Python interpreter itself is broken/execution-blocked
• the venv build/copy is incompatible
• or this is a permission / capability / su-exec issue during startup