16 lines
928 B
Markdown
16 lines
928 B
Markdown
|
---
|
||
|
|
name: SearXNG must NOT use --cap-drop ALL
|
||
|
|
description: SearXNG container needs write access to /etc/searxng/ for settings.yml — cap-drop ALL causes Permission denied and exit 127
|
||
|
|
type: feedback
|
||
|
|
---
|
||
|
|
|
||
|
|
Do NOT use `--cap-drop ALL` or `--security-opt no-new-privileges:true` when creating the SearXNG container. SearXNG needs to create `/etc/searxng/settings.yml` on first run.
|
||
|
|
|
||
|
|
**Why:** SearXNG's entrypoint creates a settings file from a template. With `--cap-drop ALL`, it gets "Permission denied: can't create '/etc/searxng/settings.yml'" and exits with code 127. The .228 reference server runs SearXNG with default capabilities (only drops CAP_AUDIT_WRITE, CAP_MKNOD, CAP_NET_RAW).
|
||
|
|
|
||
|
|
**How to apply:** When creating SearXNG containers, use:
|
||
|
|
```bash
|
||
|
|
sudo podman run -d --name searxng --restart unless-stopped -p 8888:8080 docker.io/searxng/searxng:latest
|
||
|
|
```
|
||
|
|
No `--cap-drop ALL`, no `--security-opt no-new-privileges:true`.
|