DB unable to be initialized

[droidus]

What installation are you running?

Production (netalertx) 📦

Did I research?

• I have searched the docs https://jokob-sk.github.io/NetAlertX/
• I have searched the existing open and closed issues
• I confirm my SCAN_SUBNETS is configured and tested as per https://github.com/jokob-sk/NetAlertX/blob/main/docs/SUBNETS.md

The issue occurs in the following browsers. Select at least 2.

• Firefox
• Chrome
• Other (unsupported) - PRs welcome
• N/A - This is an issue with the backend

What I want to do

Install/run the app.

Relevant settings you changed

run --network=host -v ./data:/data -v /etc/localtime:/etc/localtime --tmpfs /tmp:uid=${NETALERTX_UID:-20211},gid=${NETALERTX_GID:-20211},mode=1700 -e PORT=20211 -e APP_CONF_OVERRIDE={"GRAPHQL_PORT":"20214"} ghcr.io/jokob-sk/netalertx:latest

docker-compose.yml

app.log

Startup pre-checks
--> storage permission.sh
--> data migration.sh
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/10-mounts.py
--> first run config.sh
--> first run db.sh
══════════════════════════════════════════════════════════════════════════════
🆕 First run detected. Building initial database schema in /data/db/app.db.

Do not interrupt this step. Once complete, consider backing up the fresh
database before onboarding sensitive networks.

══════════════════════════════════════════════════════════════════════════════
Error: unable to open database "/data/db/app.db": unable to open database file
══════════════════════════════════════════════════════════════════════════════
❌ CRITICAL: Database schema creation failed for /data/db/app.db.

NetAlertX cannot start without a properly initialized database. This
failure typically indicates:

* Insufficient disk space or write permissions in the database directory
* Corrupted or inaccessible SQLite installation
* File system issues preventing database file creation

Check the logs for detailed SQLite error messages. Ensure the container
has write access to the database path and adequate storage space.

══════════════════════════════════════════════════════════════════════════════

Debug enabled

• I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.

[jokob-sk]

Hi,

Can you either try switching to the netalertx-dev image or map the /data/db and /data/config folders separately?

[droidus]

`Startup pre-checks
--> data migration.sh
--> capabilities audit.sh
══════════════════════════════════════════════════════════════════════════════
🚨 ALERT: Python execution capabilities (NET_RAW/NET_ADMIN) are missing.

The Python binary in this image has file capabilities (+eip) that
require these bits in the container's bounding set. Without them,
the binary will fail to execute (Operation not permitted).

Restart with: --cap-add=NET_RAW --cap-add=NET_ADMIN

══════════════════════════════════════════════════════════════════════════════
══════════════════════════════════════════════════════════════════════════════
⚠️ WARNING: Reduced functionality (NET_BIND_SERVICE missing).

Tools like nbtscan cannot bind to privileged ports (UDP 137).
This will reduce discovery accuracy for legacy devices.

Consider adding: --cap-add=NET_BIND_SERVICE

══════════════════════════════════════════════════════════════════════════════
Security context: Operational capabilities (CHOWN SETGID SETUID) not granted.
See https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/missing-capabilities.md
--> mounts.py
env: can't execute 'python3': Operation not permitted
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/15-mounts.py
--> first run config.sh
--> first run db.sh
--> mandatory folders.sh
--> apply conf override.sh
══════════════════════════════════════════════════════════════════════════════
📝 APP_CONF_OVERRIDE detected. Configuration written to /data/config/app_conf_override.json.

Make sure the JSON content is correct before starting the application.

══════════════════════════════════════════════════════════════════════════════
--> writable config.sh
--> nginx config.sh
--> expected user id match.sh

NetAlertX note: current UID 0 GID 0, expected UID 20211 GID 20211
--> host mode network.sh
--> excessive capabilities.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Excessive capabilities detected (bounding caps: 0x00000000a80425fb).

Only CHOWN, SETGID, SETUID, NET_ADMIN, NET_BIND_SERVICE, and NET_RAW are
required in this container. Please remove unnecessary capabilities.

https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/excessive-capabilities.md

══════════════════════════════════════════════════════════════════════════════
--> appliance integrity.sh
══════════════════════════════════════════════════════════════════════════════
⚠️ Warning: Container is running as read-write, not in read-only mode.

Please mount the root filesystem as --read-only or use read_only: true
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/read-only-filesystem.md

══════════════════════════════════════════════════════════════════════════════
--> ports available.sh
Container startup checks failed with exit code 126.
`

[jokob-sk]

Hi @adamoutler - can you have a look? I'm getting lost in these permission issues a bit.

[adamoutler]

This should be working if you remove any users from docker compose now. if you need a specific user, use PUID/GUID environmental variables.

[luckylinux]

From my Experience, using /data/config and /data/db separately does NOT work.

This is what I do typically with other Containers (split Data, Configuration and Database), but here it will fail the Permission Check about the Root Folder (even if /data is indeed bind-mounted, i.e. I had /data, /data/config and /data/db all bind-mounted inside the Container).

Cannot be 100% sure if that was with netalertx-dev or netalertx though.

[droidus]

This should be working if you remove any users from docker compose now. if you need a specific user, use PUID/GUID environmental variables.

What do you mean "remove any users from docker compose"?
Here's how I'm running it: docker run --network=host -v ./data:/data -v /etc/localtime:/etc/localtime --tmpfs /tmp:uid=${NETALERTX_UID:-20211},gid=${NETALERTX_GID:-20211},mode=1700 -e PORT=20211 -e APP_CONF_OVERRIDE={"GRAPHQL_PORT":"20214"} ghcr.io/jokob-sk/netalertx-dev:latest

[Flagelmann]

Hello,

I'm also getting the critical db creation error using the docker approach also specified into the documentation.

For now I think I will switch to another solution, as I tried also with GID/UID 20211 and anyway it is failing.

I'm on a Trixie Raspberry Pi 5 x64.

Startup pre-checks
--> storage permission.sh
--> data migration.sh
--> mounts.py
mounts.py: FAILED with 126
Failure detected in: /entrypoint.d/10-mounts.py
--> first run config.sh
env: can't execute 'python3': Operation not permitted
--> first run db.sh
══════════════════════════════════════════════════════════════════════════════
🆕 First run detected. Building initial database schema in /data/db/app.db.

Do not interrupt this step. Once complete, consider backing up the fresh
database before onboarding sensitive networks.

══════════════════════════════════════════════════════════════════════════════
Error: unable to open database "/data/db/app.db": unable to open database file
══════════════════════════════════════════════════════════════════════════════
❌ CRITICAL: Database schema creation failed for /data/db/app.db.

NetAlertX cannot start without a properly initialized database. This
failure typically indicates:

* Insufficient disk space or write permissions in the database directory
* Corrupted or inaccessible SQLite installation
* File system issues preventing database file creation

Check the logs for detailed SQLite error messages. Ensure the container
has write access to the database path and adequate storage space.

══════════════════════════════════════════════════════════════════════════════
\033[1;31m══════════════════════════════════════════════════════════════════════════════
❌ NetAlertX startup aborted: critical failure in first run db.sh.
https://github.com/jokob-sk/NetAlertX/blob/main/docs/docker-troubleshooting/troubleshooting.md
══════════════════════════════════════════════════════════════════════════════

Kind regards

[jokob-sk]

Workarounds which were confirmed working:

• Mount /data/db and /data/config separately
• Switch to the netalertx-dev image

[jamsoft]

I've been trying to get this working for hours and keep running into issues. I've gotten a little further with the dev image but it's still blowing up.

My yaml:

services:
  netalertx:
    container_name: netalertx
    image: "jokobsk/netalertx-dev:latest"
    network_mode: host
    restart: unless-stopped
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - NET_BIND_SERVICE
    volumes:
      - /volume1/docker/netalertx/data/config:/config
      - /volume1/docker/netalertx/data/db:/data:rw
      - /etc/localtime:/etc/localtime:ro
    tmpfs:
      - "/tmp:uid=20211,gid=20211,mode=1700,rw,noexec,nosuid,nodev,async,noatime,nodiratime"
    environment:
      - PORT=20211

There are many errors in the log:

php-fpm stopped! (exit 143)
mkdir: can't create directory '/tmp/nginx': Permission denied
mkdir: can't create directory '/tmp/run': Permission denied
mkdir: can't create directory '/tmp/log': Permission denied
/services/start-cron.sh: line 37: /tmp/log/cron.log: No such file or directory
/tmp/nginx/active-config | ✅| ❌|   ✅  |    ✅   |      ✅     |    ✅
/tmp/run                 | ✅| ❌|   ✅  |    ✅   |      ✅     |    ✅
/tmp/log                 | ✅| ❌|   ✅  |    ✅   |      ✅     |    ✅
/tmp/api                 | ✅| ❌|   ✅  |    ✅   |      ✅     |    ✅
/tmp/run/tmp             | ✅| ❌|   ✅  |    ✅   |      ✅     |    ✅
/data/config             | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅
/data/db                 | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅
/data                    | ✅| ✅|   ✅  |    ➖   |      ➖     |    ✅

Any advice would be great.

[jokob-sk]

Looks like tmpfs doesn't have sufficient permissions.

If you are on a synology w/ aufs disk driver run as ROOT: https://docs.netalertx.com/FILE_PERMISSIONS/?h=root
More info: https://docs.netalertx.com/docker-troubleshooting/aufs-capabilities/?h=aufs

[jokob-sk]

Releasing -> Closing