Docker module: Can't connect to /var/run/docker.sock

Elastic Stack Beats
1

Hi,

I'm running metricbeat with the docker module, with the following configuration:

metricbeat.modules:
- module: docker
  period: 20s
  metricsets:
    - container
    - cpu
    - diskio
    - image
    - info
    - memory
  hosts: ["unix:///var/run/docker.sock"]

and the following command:

docker run -d \          
  --network=elk_elk  \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v etc:/etc/metricbeat \
  docker.elastic.co/beats/metricbeat:5.4.0 \
  metricbeat -e -c /etc/metricbeat/metricbeat.yml

However, in the events sent to Elasticsearch, there's an error field, which says

Get http://unix.sock/images/json?: dial unix /var/run/docker.sock: connect: permission denied

I noticed that my Docker socket belongs to root:docker (gid 999), which corresponds to the input group in the container.

Is there a way to make this Docker module work with my local Unix socket?

2

Try adding -u root to the docker command. By default the container image for metricbeat drops privileges.

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.