Struggling with permissions in DSM using Docker

[lynchpin]

Hi all,

I'm using my DS218+ mainly as a media center, and recently I've set up Docker and I'm running Syncthing (amazing!) to sync files from a remote seedbox to my NAS, and then Filebot to rename and move the files to my Plex directories. This was all working fine before, but I decided to migrate to Filebot via Docker instead of an APK. That's when my problems started!

Filebot and Syncthing seem to be "fighting" over permissions. I have two directories that have been having issues: "docker" which stores all my Docker config files. Syncthing started failing because it didn't have permission anymore to create certificates, but I seem to have sorted this out. The other is my "sync" folder, which is where downloads go to and Filebot monitors to rename and move them.

Setting Filebot to "copy" files works fine, but that's not ideal as I then need to manually clean them up. Setting it to "move" results in a permission error:

[amc] Input: /watch/movie_filename.mkv
[amc] Group: {Movie Actual Name} => [movie_filename.mkv]
[amc] Rename movies using [TheMovieDB]
[amc] Auto-detect movie from context [/watch/movie_filename.mkv]
[amc] [MOVE] from [/watch/movie_filename.mkv] to [/output/Movies/Movie Actual Name.mkv]
[amc] [MOVE] from [/watch/movie_filename.mkv] to [/output/Movies/Movie Actual Name.mkv.mkv] failed due to I/O error [Access Denied: /watch/movie_filename.mkv]
[amc] Processed 0 files

I have set the users for both Filebot and Syncthing to have the same read/write permissions on the "sync" folder in DSM, to no avail. I was able to temporarily fix the issue by following these instructions here: Filebot via Docker on Synology - AMC copies but can't move - FileBot

But now the issue has returned. I know my way around DSM well enough to set permissions (I think) but doing anything via SSH... well I don't have much experience with it.

Does anyone have any ideas or tips or things I can look at to try and remedy the issue?

Thanks so much!

 

[Rusty]

What FB image are you using and is the container running as a 1028 user?

 

[lynchpin]

What FB image are you using and is the container running as a 1028 user?

This is the image: jlesage/docker-filebot

ID in the container for Filebot is 1028. 1026 for Syncthing...

 

[Rusty]

This is the image: jlesage/docker-filebot

ID in the container for Filebot is 1028. 1026 for Syncthing...

can you share your docker-compose you are running with?

 

[lynchpin]

can you share your docker-compose you are running with?

I, ah, didn't / haven't used Compose at all. I just set the containers up in the Docker app on my Synology.

 

[Rusty]

Well if a copy is not a problem, but move, that would suggest that permissions are missing for the "1028" account on some other location. DSM doesn't move, it's actually a copy/delete operation. So does the 1028 account have the delete permission on the original location where the files are downloaded? Is that what the images are showing above?

If so, are you sure that 1028 has permissions on all the files and folders in the entire structure? Are you sure that files that need manipulation already have 1028 user permissions on them?

Considering that you are running with 2 separate accounts, looks like something doesn't have permission on the folder that needs to be cleared.

 

[lynchpin]

Well if a copy is not a problem, but move, that would suggest that permissions are missing for the "1028" account on some other location. DSM doesn't move, it's actually a copy/delete operation. So does the 1028 account have the delete permission on the original location where the files are downloaded? Is that what the images are showing above?

If so, are you sure that 1028 has permissions on all the files and folders in the entire structure? Are you sure that files that need manipulation already have 1028 user permissions on them?

Considering that you are running with 2 separate accounts, looks like something doesn't have permission on the folder that needs to be cleared.

That's my problem. Both users have read/write access based on the settings in DSM, and these settings seem persistent in the DSM GUI but intermittently one of the users is losing write access. I have applied the read/write permissions for subdirectories and both users should be able to read/write on the sync folder, but it's not working (for Filebot at present)

 

[Rusty]

looks like that when sync is completed, that specific file doesn't have 1028 permission applied on it, and delete/remove fails.

 

[lynchpin]

looks like that when sync is completed, that specific file doesn't have 1028 permission applied on it, and delete/remove fails.

Hmm, can you think of any reason why that might be and how to go around it? If the file is being downloaded to a directory Filebot has access to, it should be able to exercise its read/write permissions on it, shouldn't it?

Are there any permission strategies to get around this?

-- post merged: 9. Jul 2021 --

looks like that when sync is completed, that specific file doesn't have 1028 permission applied on it, and delete/remove fails.

Here's a screenshot of the permissions on a recently downloaded file:

No mention of Syncthing or Filebot there, and "everyone" only has read access...

 

[Rusty]

Hmm, can you think of any reason why that might be and how to go around it? If the file is being downloaded to a directory Filebot has access to, it should be able to exercise its read/write permissions on it, shouldn't it?

Are there any permission strategies to get around this?

It's not being downloaded directly right? you are using sync to push it from seedbox to your nas?

Also you are setting these permissions via File Station using an "admin" class account? Have you selected the option to apply settings and permission to all child objects?

 

[lynchpin]

It's not being downloaded directly right? you are using sync to push it from seedbox to your nas?

Also you are setting these permissions via File Station using an "admin" class account? Have you selected the option to apply settings and permission to all child objects?

That's right, Syncthing is doing the downloading.

I checked both users on the parent directory, and it looks good:

 

[Rusty]

That's right, Syncthing is doing the downloading.

I checked both users on the parent directory, and it looks good:

View attachment 3956

What about this setting?

Also, Sync platform is in docker from what you wrote? This "sc-syncthing" is the account you created or it this a legacy account from when sync was running bare metal? You are certain that that account is 1026?

 

[lynchpin]

What about this setting?

View attachment 3957

Also, Sync platform is in docker from what you wrote? This "sc-syncthing" is the account you created or it this a legacy account from when sync was running bare metal? You are certain that that account is 1026?

Where can I find that setting, sorry?

It's set to 1026 in the container based on checking ID's via SSH. Syncthing, I don't think, was ever running bare metal; I'm pretty sure it was always via Docker and it always worked with sc-syncthing (which is a group, not a specific user, if I understand this right).

Filebot uses user "automation" which definitely has 1028 access (just checked via SSH).

Could I try setting Syncthing to use the same "automation" user?

 

[Rusty]

Could I try setting Syncthing to use the same "automation" user?

give that a go.

I don't think, was ever running bare metal

the reason I am asking is that the name structure points to something that was created automatically. So if its a group, have you created it?

What does id command return for both of those accounts?

 

[lynchpin]

give that a go.


the reason I am asking is that the name structure points to something that was created automatically. So if its a group, have you created it?

What does id command return for both of those accounts?

1028 is the "automation" user which Filebot uses. That's really the only one having an issue right now. Syncthing is working fine, but Filebot won't move a file, it'll only copy it. And it has read/write permissions all the way down on the "sync" folder

 

[Rusty]

have you tried to use the same account for both apps?