Replies: 2 comments 5 replies
-
|
for now it works by disabling selinux |
Beta Was this translation helpful? Give feedback.
-
|
Disabling SELinux is always the correct solution when you want to share HOME USER data with a container. Because you DO NOT want the container to do SELinux relabeling of your home user's files! The purpose of SELinux labels and Since your Syncthing files are owned by your home user, you should NEVER use SELinux labels. |
Beta Was this translation helpful? Give feedback.
-
|
Oh and this does nothing at all: [Unit]
Description=Podman syncthing.service
Wants=network-online.target
After=network-online.targetYou can delete that section. You cannot set Unit targets for systemd Podman user-level services. |
Beta Was this translation helpful? Give feedback.
-
|
Since it will probably help a lot of people, here's my detailed configuration for Syncthing, with fully documenting comments for every parameter and the reasons. It's better than the config above. Here are the steps to activate it:
[Container]
# Which image to run in the container.
# NOTE: It must be a fully-qualified name for auto-updates to work, meaning that
# it needs a "registry hostname" prefix and a ":version" suffix.
Image=docker.io/syncthing/syncthing:latest
# Tell podman-auto-update that we want the latest version from the registry.
AutoUpdate=registry
# The container should have a recognizable name to discourage external management.
# NOTE: The container should never be manually started or stopped with external
# tools. Always use the systemd service for those tasks.
# NOTE: If nothing is provided, the default is "systemd-%N".
#ContainerName=systemd-%N
# Using the host's network means that the container appears natively on the local
# network, which allows automatic discovery by other local Syncthing devices.
# NOTE: You can disable this line to put the container in a sandboxed subnet
# instead, but then you'll need to manually add host's IP and port in clients,
# and you will have to set up a public internet IP if you want syncing available
# everywhere. Whereas with "Host" networking, Syncthing automatically uses either
# local network transfers or internet relay transfers based on current conditions.
Network=host
# Generate a unique container hostname based on the host's with a "st-" prefix.
# NOTE: We cannot use a suffix instead, since hostnames may end in a ".domain".
HostName=st-%H
# Map the host's user and group ID to the same values inside the container,
# to ensure that all files remain owned by the user that runs the server.
UserNS=keep-id
Environment=PUID=%U PGID=%G
# Disable SELinux labels since we're syncing normal user files, and security
# labels would interfere with the host's normal filesystem permissions.
# NOTE: Never use SELinux when a container deals with the user's own files!
SecurityLabelDisable=true
# The Web UI will only be bound to localhost (on the host).
# NOTE: The "PublishPort" settings have no effect when Host networking is used,
# but if you switch to a private container network, you can use these settings.
#PublishPort=127.0.0.1:8384:8384
# File transfer ports (for TCP, QUIC UDP, and discovery broadcast receival).
#PublishPort=22000:22000/tcp
#PublishPort=22000:22000/udp
#PublishPort=21027:21027/udp
# Store the Syncthing config in a unique directory on the host.
# NOTE: We don't use any ":z" or ":Z" SELinux relabeling suffixes, since we've
# disabled SELinux labels for this container.
Volume=%h/.config/syncthing-container:/var/syncthing/config
# Map the default Syncthing share to the host user's "~/Sync".
Volume=%h/Sync:/var/syncthing/Sync
# Additional sync volumes. Must be manually added in the Web UI too.
# NOTE: Don't escape spaces in paths. Podman will do that automatically.
#Volume=%h/Documents/Obsidian Vault:/var/syncthing/data-Obsidian-Vault
[Service]
# Extend startup timeout to 15 minutes to allow time to pull the images.
TimeoutStartSec=900
# Automatically restart service if it exits for any reason (for 100% uptime).
# NOTE: Use "on-failure" to only restart when container exits with errors.
# NOTE: Regardless of the choice, it respects systemctl commands (ie. "stop").
Restart=always
[Install]
# Start by default on every boot (before the graphical login manager).
# NOTE: Rootless "user" services will not start until the user has logged in.
WantedBy=multi-user.target default.target |
Beta Was this translation helpful? Give feedback.
-
|
As a sidenote: Podman 5.3.0 fixed a serious bug. If you use an older version of Podman, then Podman Quadlet services WILL NOT WORK if your system contains a mixture of cgroup v1 and cgroup v2. The services will fail to start and will shut themselves down immediately. You can check your own system with this command: grep -i cgroup /proc/mountsIf your system contains only one cgroup, you will see something like this, which will work perfectly: If your system has multiple cgroups (most commonly added by VPNs such as PIA and Mullvad, which use it for Split Tunneling (per-app VPN bypass)), then Podman Quadlets will not work, unless you update Podman to 5.3.0 or newer. Here's an example of a "broken" system: If your system is broken, the ONLY option is to either delete the extra cgroups (which may or may not be possible depending on how your VPN app creates its group, so you may have to uninstall the VPN app to get rid of it), or to upgrade Podman to 5.3.0 or newer. |
Beta Was this translation helpful? Give feedback.
-
|
@Arcitec Thanks for excellent write up. I have changed my settings accordingly. |
Beta Was this translation helpful? Give feedback.
-
|
@tazihad I'm glad to help! One of the biggest things you gain from this config is that It then establishes local discovery connections, which you can check in the Web UI under the "Discovery" counter, where it will say "IPv4 local". That feature doesn't work properly without With local IPv4 discovery, you will have much faster syncing and detection of file changes, usually propagating changes within 15 seconds. Without it, Syncthing instead has to use the global internet relays which will usually have many minutes of delay before syncing even starts. So I'd always recommend host networking for Syncthing. It's one of the only services where that really helps. But if you have other containers which do some kind of local discovery, you can consider the same change. :) |
Beta Was this translation helpful? Give feedback.
-
This my podman quadlet for syncthing:
host id:
The problem is selinux.
Here's my issue. Syncthing looks to be working great. But when I put a file to sync folder manually syncthing is unable to sync because of permission denied error. but If I restart podman service. the issue is fixed and permission denied error gone. I have found out why the issue happens.
As you can see the file I manually pasted on the sync folder is labelled with unconfined_u. Hence syncthing is getting permission denied.
:Zseems not autorelabelling. What am I missing here?Note that I can fix the permission error temporarily by
This relabels the file that I put manually.
Beta Was this translation helpful? Give feedback.
All reactions