Bitwarden server does not work with Podman

[Venefilyn]

After running bitwarden.sh with letsencrypt option enabled, I get the following error

Status: Image is up to date for docker.io/certbot/certbot:latest
The following error was encountered:
[Errno 13] Permission denied: '/etc/letsencrypt/logs'
Either run as root, or set --config-dir, --work-dir, and --logs-dir to writeable paths.

Repro steps

1. Grabbed bitwarden.sh from https://go.btwrdn.co/bw-sh
2. Ran ./bitwarden.sh install
3. Fill in domain that isn't localhost
4. Enter y for Let's Encrypt
5. Enter email

Expected results

Installation continues

Actual results

Installation fails with permission error

Run trace

# ./bitwarden.sh install
 _     _ _                         _            
| |__ (_) |___      ____ _ _ __ __| | ___ _ __  
| '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \ 
| |_) | | |_ \ V  V / (_| | | | (_| |  __/ | | |
|_.__/|_|\__| \_/\_/ \__,_|_|  \__,_|\___|_| |_|

Open source password management solutions
Copyright 2015-2019, 8bit Solutions LLC
https://bitwarden.com, https://github.com/bitwarden

===================================================

Docker version 1.13.1, build 1556cce-unsupported
docker-compose version 1.20.1, build 5d8c71b

(!) Enter the domain name for your Bitwarden instance (ex. bitwarden.company.com): bitwarden.example.com

(!) Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): y

(!) Enter your email address (Let's Encrypt will send you certificate expiration reminders): example@example.com

Using default tag: latest
Trying to pull repository docker.io/certbot/certbot ... 
sha256:ec4383b768b6a162889adcdce2d60cb4c760d2fa48287a354c0182c5e2330fed: Pulling from docker.io/certbot/certbot
Digest: sha256:ec4383b768b6a162889adcdce2d60cb4c760d2fa48287a354c0182c5e2330fed
Status: Image is up to date for docker.io/certbot/certbot:latest
The following error was encountered:
[Errno 13] Permission denied: '/etc/letsencrypt/logs'
Either run as root, or set --config-dir, --work-dir, and --logs-dir to writeable paths.

[kspearrin]

Looks like you do not have permissions to map volumes to the host. Maybe you need to run with sudo?

[Venefilyn]

Yeah that was the weird part, tried both with sudo and as root. Though I spotted I run an unsupported build of Docker, maybe that is playing up. Will look into it when I get a chance

[Venefilyn]

Yep, that was the case. Outdated Docker was the issue, switched to Podman while I was at it.

Thanks anyhow, appreciate the help :)

[Venefilyn]

Getting a different error now running podman 1.1.2

spytec@KeyraGuest1:~/Bitwarden$ ./bitwarden.sh install
 _     _ _                         _
| |__ (_) |___      ____ _ _ __ __| | ___ _ __
| '_ \| | __\ \ /\ / / _` | '__/ _` |/ _ \ '_ \
| |_) | | |_ \ V  V / (_| | | | (_| |  __/ | | |
|_.__/|_|\__| \_/\_/ \__,_|_|  \__,_|\___|_| |_|

Open source password management solutions
Copyright 2015-2019, 8bit Solutions LLC
https://bitwarden.com, https://github.com/bitwarden

===================================================

podman version 1.1.2
docker-compose version 1.20.1, build 5d8c71b

(!) Enter the domain name for your Bitwarden instance (ex. bitwarden.company.com): bitwarden.company.com

(!) Do you want to use Let's Encrypt to generate a free SSL certificate? (y/n): n

Trying to pull docker://bitwarden/setup:1.30.3...Getting image source signatures
Copying blob 743f2d6c1f65 [======================================] 21.4MiB / 21.4MiB
Copying blob e822a344dc4b [======================================] 16.9MiB / 16.9MiB
Copying blob 18c9661a68a5 [======================================] 2.8MiB / 2.8MiB
Copying blob 1103e508d13e [======================================] 28.1MiB / 28.1MiB
Copying blob ad367c85dc33 [======================================] 846.6KiB / 846.6KiB
Copying blob 16d3f5e1dd6d [======================================] 126b / 126b
Copying blob 7fb4289fbfba [======================================] 14.1MiB / 14.1MiB
Copying blob ab2972c2a9d3 [======================================] 517b / 517b
Copying blob d71a7028f643 [======================================] 517b / 517b
Copying config 60dca6a720 [======================================] 4.9KiB / 4.9KiB
Writing manifest to image destination
Storing signatures
60dca6a720fe51a343b3e06600088c30b89bf07979c4c2d4c571f6ef5d51a404
mkdir: cannot create directory '/bitwarden/docker': Permission denied
mkdir: cannot create directory '/bitwarden/ssl': Permission denied
mkdir: cannot create directory '/bitwarden/letsencrypt': Permission denied
mkdir: cannot create directory '/bitwarden/identity': Permission denied
mkdir: cannot create directory '/bitwarden/nginx': Permission denied
mkdir: cannot create directory '/bitwarden/ca-certificates': Permission denied
chown: cannot read directory '/bitwarden': Permission denied

[Venefilyn]

Same issue with:
podman version 1.3.1
docker-compose version 1.22.0, build f46880f

[Venefilyn]

Since Podman has replaced Docker in Fedora and can run Docker containers if setup correctly. Can the container files and scripts be updated to work better with non-root containers?

[Venefilyn]

This is most likely SELinux issues, would Bitwarden be interested in optimizing their docker compose to work better with SELinux?

Might even be as simple as adding :Z to the volume in run.sh https://github.com/bitwarden/server/blob/master/scripts/run.sh#L95

[kspearrin]

@spytec I do not know much about SELinux, so I would be interested in knowing what the issues here are and what the fix would be.

[Venefilyn]

I'm unable to experiment with the bitwarden.sh and run.sh scripts right now.

SELinux has contexts for processes and files which locks files down depending on where the files are located or what contexts the processes are given. Podman works a bit differently than Docker in that it by default runs non-root inside the container, and it also has security enhancements which might it difficult to run Docker commands under Podman instead.

I'm presuming that the volume mounted under Docker works fine as it runs as root-user inside the container, but as soon as we use Podman and Podman-Docker bridge we run into SELinux context issues as it's running as non-root.

Adding :Z would destructively change the context label on the mounted folder, meaning it would let the user container runs as be able to modify the content inside. As long as nothing with the project changes the context of the folder deliberately it should be safe to use :Z.

So instead of -v $OUTPUT_DIR:/bitwarden or would be -v $OUTPUT_DIR:/bitwarden:Z. Though I'd recommend trying this with both Docker and Podman to be sure

[kspearrin]

We do not run under root in the containers. We step down to a bitwarden user which has a UID/GID matching that of the host user (or as specified in ./bwdata/env).

[Mart124]

Did you try disabling SELinux first ?
SELINUX=disabled in /etc/selinux/config (then reboot)
Also try to run bitwarden.sh directly as root user, it could give you clues.

[Venefilyn]

@Mart124 the problem is SELinux in the containers, not on my machine. Bitwarden needs to be changed to work with Podman. Running bitwarden.sh as root will only help with opening ports above 1024, so wouldn't change anything there either

I've gone with bitwarden_rs however, as it allowed me to change container settings. Official Bitwarden was a bit of a mess for me to configure locally with all the different containers and generated docker-composes