Beszel agent Podman Quadlet SMART and podman container monitoring not working

[ZPortal01]

Description

Dear henrygd,

On my server I'm using Podman quadlets, it's very nice that you have made podman documentation and intergration. But even with this i don't get Beszel agent quadlet to work all the way. I've had podman monitoring with making the container think it's the docker.sock, but not as podman.sock.
Volume=/run/user/1001/podman/podman.sock:/var/run/docker.sock:ro
While this need to be the origina.
Volume=/run/user/1001/podman/podman.sock:/run/user/1001/podman/podman.sock:ro

I use the alpine image version cause I wanted to get SMART working. I added all the devices I would like it to monitor and get an INFO smartctl failed device=/dev/sda err="exit status 2". Wich mean a premission problem. If i go into the container and exec smartctl --scan everything is normal but putting smartctl --all /dev/sda gives me Smartctl open device: /dev/sda failed: Permission denied I run al my nvme ddrives in a RAID config. But normally the sda drive shouldn't give me a problem.

I turned of SELinux because that is always a problem with premissions but then still the container gives me premission errors. Nothing seems to work.

Hope some one can help me figure this out.

I also have some questions left about the podman socket proxy and how that works.

OS / Architecture

Fedora Server

Beszel version

alpine

Installation method

Other (please describe above)

Configuration

## Beszel Pod ##

[Unit]
Description=Beszel-Pod

[Pod]
PodName=
Network=pasta
PublishPort=10900:8090


## Beszel Host Quadlet ##

[Unit]
Description=BeszelHostContainer

[Container]
ContainerName=Beszel
Pod=beszel.pod
Image=docker.io/henrygd/beszel
AutoUpdate=Registry

Volume=%h/containers/beszel/beszel_data:/beszel_data:z

NoNewPrivileges=true

[Install]
WantedBy=default.target


## Beszel-Agent Quadlet ##

[Unit]
Description=Beszel-Agent-Container

[Container]
ContainerName=Beszel-Agent
Image=docker.io/henrygd/beszel-agent:alpine
AutoUpdate=Registry

Pod=beszel.pod

AddCapability=CAP_SYS_RAWIO
AddCapability=CAP_SYS_ADMIN

Volume=/run/user/1001/podman/podman.sock:/var/run/docker.sock:ro
Volume=%h/containers/beszel/beszel_agent_data:/var/lib/beszel-agent:Z

Volume=/mnt/raid/.beszel:/extra-filesystems/md0__Raid:ro

Environment=KEY=""
Environment=LISTEN=45876
Environment=TOKEN=""
Environment=HUB_URL="*****"
Environment=FILESYSTEM="/dev/sda__Rootfs"
Environment=EXTRA_FILESYSTEMS="/dev/md0__Raid"
Environment="SMART_DEVICES="/dev/sda"
Environment=LOG_LEVEL=debug

AddDevice=/dev/sda:/dev/sda:r
AddDevice=/dev/nvme0:/dev/nvme0:r
AddDevice=/dev/nvme1:/dev/nvme1:r
AddDevice=/dev/nvme2:/dev/nvme2:r
AddDevice=/dev/nvme3:/dev/nvme3:r

Network=host

[Services]
Restart=unless-stopped
TimeoutStartSec=300

[Install]
WantedBy=default.target

Hub Logs

No response

Agent Logs

2025/12/16 02:05:02 DEBUG sysinfo data="{Hostname:**** KernelVersion:6.17.11-300.fc43.x86_64 Cores:8 Threads:16 CpuModel:AMD Ryzen 7 9700X 8-Core Processor Uptime:6700 Cpu:1.38 MemPct:18.33 DiskPct:20.77 Bandwidth:0 AgentVersion:0.17.0 Podman:false GpuPct:0 DashboardTemp:39.625 Os:0 LoadAvg1:0.58 LoadAvg5:0.56 LoadAvg15:0.47 BandwidthBytes:0 LoadAvg:[0.58 0.56 0.47] ConnectionType:2 ExtraFsPct:map[] Services:[]}"
2025/12/16 02:05:02 DEBUG Containers err="Get \"http://localhost/containers/json\": dial unix /var/run/docker.sock: connect: no such file or directory"
2025/12/16 02:05:02 DEBUG Extra FS data=map[Raid:0xc0000ab360]
2025/12/16 02:05:02 INFO SMART_DEVICES value=/dev/sda
2025/12/16 02:05:02 INFO smartctl failed device=/dev/sda err="exit status 2"
2025/12/16 02:05:02 INFO smartctl failed device=/dev/nvme0 err="exit status 2"
2025/12/16 02:05:02 INFO smartctl failed device=/dev/nvme1 err="exit status 2"
2025/12/16 02:05:02 INFO smartctl failed device=/dev/nvme2 err="exit status 2"
2025/12/16 02:05:02 INFO smartctl failed device=/dev/nvme3 err="exit status 2"

[ZPortal01]

Environment="DOCKER_HOST=unix:///run/user/1001/podman/podman.sock"
Putting in this environment variable fixes the podman socket issue. I saw this in disscussion #211. This is one solution but not ideal.

[henrygd]

Are you able to run smartctl --all /dev/sda successfully outside the container with your regular user?

Not sure why the podman socket location wasn't picked up automatically. Maybe /var/run/docker.sock also exists so it defaults to that. The code for that is here:

beszel/agent/docker.go

Lines 633 to 643 in 35329ab

	// Test docker / podman sockets and return if one exists
	func getDockerHost() string {
	scheme := "unix://"
	socks := []string{"/var/run/docker.sock", fmt.Sprintf("/run/user/%v/podman/podman.sock", os.Getuid())}
	for _, sock := range socks {
	if _, err := os.Stat(sock); err == nil {
	return scheme + sock
	}
	}
	return scheme + socks[0]
	}

[ZPortal01]

Yes the user can, I also tried to run the container under the same user with UserNS=keep-id. But then it also gives the same error.

Why it doesn't see the socket I find strange, there is no docker installed on the server. So no docker.sock should be here. Also I don't bind it to the container so it should even know it's there in the first place, right? But with the hard fix it works fine.

[siette]

Hi everyone! I had the same issue where I couldn't see my containers in Beszel. I'm on Fedora 43 using Rootless Podman (Quadlets).

To fix it, I made these specific changes in my .container file. I didn't need to disable SELinux or use extra capabilities:

[Container]
# This line fixed the container monitoring for me
PodmanArgs=--security-opt=label=type:container_runtime_t --cap-drop=ALL
# Correct volumes for Fedora Rootless (replace 1000 with your UID)
Volume=%h/beszel_agent_data:/var/lib/beszel-agent:Z
Volume=%t/podman/podman.sock:/run/user/1000/podman/podman.sock:ro,z
[Service]
# Important to specify your UID
User=1000

With these settings, container stats and SMART monitoring started working immediately. No need for CAP_SYS_ADMIN or disabling security.

Hope this helps!

[ZPortal01]

How did you get smartctl working without sudo? I need to be root to use the command.

[siette]

The Beszel agent handles this automatically. Even if Podman is running in rootless mode, the process inside the container thinks it is "root" (mapped to your user UID).

In my Fedora setup, as long as my user has permissions to read the disk devices, the agent can access the SMART data without needing sudo or extra privileges. With the configuration I shared, it just worked out of the box!

[schultzter]

I'm having the same issue, I get the basic server stats but nothing else - no containers or SMART!

I'm on Fedora IoT 43 and everything is running in rootless podman containers (user 1000).

Here's how I set them up:

POD:

podman pod create \
--hostname=beszel \
--name=beszel \
--network=host

HUB:

podman run -d --replace \
  --env=APP_URL=http://localhost:8090 \
  --name=hub \
  --restart=unless-stopped \
  --pod=beszel \
  --volume=beszel:/beszel_data \
  docker.io/henrygd/beszel:latest

AGENT:

podman run -d --replace \
  --env=DOCKER_HOST=unix:///run/user/1001/podman/podman.sock \
  --env=HUB_URL=http://localhost:8090 \
  --env=KEY="****" \
  --env=LISTEN=45876 \
  --env=TOKEN=**** \
  --name=agent \
  --pod=beszel \
  --restart=unless-stopped \
  --volume=beszel_agent:/var/lib/beszel-agent \
  --volume=/run/user/1000/podman/podman.sock:/run/user/1000/podman/podman.sock:ro,z \
  docker.io/henrygd/beszel-agent:latest

I had --user=1000 in there but that made things worse!

How do I see my containers in Beszel?!

If I could just vent for a minute, Beszel is the first monitor I found that tries to support Podman (besides Cockpit obviously), everything else I tried barely, if at all, acknowledged Podman's existence! Why so little love for Podman?!

[schultzter]

i added --security-opt label=disable \ to my agent's podman run command and that solved the problem. But now the reasons for running rootless on Fedora with SELinux is gone!

[suuuehgi]

I just had the same issue. You have to set LOG_LEVEL to debug to see:

DEBUG Containers err="Get \"http://localhost/containers/json\": dial unix /run/user/1000/podman/podman.sock: connect: permission denied"

---

There are several way to mitigate this but I'm unsure about the correct way. Maybe one of the developers can help.

---

Yes, you can set --security-opt label=disable or

[Container]
SecurityLabelDisable=true

in the .container file but that disables SELinux completely for the container.

---

I went for an other way -- still not ideal but it least it works for now:

You can make podman on the host listen to tcp connections via e.g. podman system service --time=0 tcp:127.0.0.1:2375.
Then set the env variable DOCKER_HOST to tcp://localhost:2375. You can strip all other socket mounts.

So, the bare minimum quadlet for the agent should look something like the following:

[Unit]
Description=Beszel Agent

[Container]
Image=docker.io/henrygd/beszel-agent

Network=host

EnvironmentFile=%h/.config/containers/beszel/beszel.env

Volume=beszel-agent.volume:/var/lib/beszel-agent:Z

AutoUpdate=registry

[Service]
Restart=always
RestartSec=5

[Install]
WantedBy=default.target

Notice the separate podman volume beszel-agent.volume and that all environment variables are collected in the file:

~/.config/containers/beszel/beszel.env

LISTEN=45876
HUB_URL=http://localhost:8090
APP_URL=http://localhost:8090
DOCKER_HOST=tcp://localhost:2375

LOG_LEVEL=debug

KEY=ssh-ed25519 <key>
TOKEN=<token>

I furthermore wrapped the socket command into a systemd service:

~/.config/systemd/user/beszel-socket.service

[Unit]
Description=Podman API Service for Beszel Agent (TCP on 127.0.0.1:2375)
Documentation=man:podman-system-service(1)

[Service]
Type=exec
Environment=LOGGING=--log-level=info
ExecStart=/usr/bin/podman $LOGGING system service --time=0 tcp:127.0.0.1:2375
Restart=on-failure

and add the dependency to the above quadlet:

[Unit]
Wants=beszel-socket.service
After=beszel-socket.service