# Filebeat in docker, permission denied when trying to place registry on the host

**URL:** <https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [July 31, 2023, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694 "2023-07-31T12:56:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [July 31, 2023, 12:56pm UTC](https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694/1 "2023-07-31T12:56:24Z")

</div>

I would like to move the registry outside the filebeat folder, to be able to easy kill it.  
I have this config file:

```auto
  filebeat_for_dmarc:
    image: docker.elastic.co/beats/filebeat:${STACK_VERSION}
    container_name: filebeat_for_dmarc
    mem_limit: 1073741824
    depends_on:
      logstash
    volumes:
      - ./dmarc/dmarclogs:/dmarclogs
      - ./dmarc/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./dmarc/registry:/usr/share/filebeat/data/registry/filebeat
    depends_on:
      - logstash

```

The ./dmarc/dmarclogs folder works, but the ./dmarc/registry does not? I get this error

```auto
ERROR instance/beat.go:1014 Exiting: failed to open store 'filebeat': open /usr/share/filebeat/data/registry/filebeat/meta.json: no such file or directory
filebeat_for_dmarc | Exiting: failed to open store 'filebeat': open /usr/share/filebeat/data/registry/filebeat/meta.json: no such file or directory

```

I have the folder registry under the dmarc folder.  
It has the same rights as the dmarclogs  
I've temporarily disabled SELinux

Why can't I get this to work?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 31, 2023, 3:38pm UTC](https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694/2 "2023-07-31T15:38:01Z")

</div>

Hey @fribse,

I think that by seeing the registry directory Filebeat believes that there is an existing registry, and it fails when trying to load it.

Instead of mounting only the registry directory, try mounting the whole data directory.

Something like this:

```auto
  filebeat_for_dmarc:
    image: docker.elastic.co/beats/filebeat:${STACK_VERSION}
    container_name: filebeat_for_dmarc
    mem_limit: 1073741824
    depends_on:
      logstash
    volumes:
      - ./dmarc/dmarclogs:/dmarclogs
      - ./dmarc/filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro
      - ./dmarc/filebeat-data:/usr/share/filebeat/data
    depends_on:
      - logstash

```

---

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [August 1, 2023, 7:34am UTC](https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694/3 "2023-08-01T07:34:26Z")

</div>

Yeah, I had that idea as well, but I still get an error:

```auto
filebeat_for_dmarc | 2023-08-01T07:33:28.207Z INFO instance/beat.go:685 Home path: [/usr/share/filebeat] Config path: [/usr/share/filebeat] Data path: [/usr/share/filebeat/data] Logs path: [/usr/share/filebeat/logs] Hostfs Path: [/]
filebeat_for_dmarc | 2023-08-01T07:33:28.208Z ERROR instance/beat.go:1014 Exiting: Failed to create Beat meta file: open /usr/share/filebeat/data/meta.json.new: permission denied
filebeat_for_dmarc | Exiting: Failed to create Beat meta file: open /usr/share/filebeat/data/meta.json.new: permission denied
filebeat_for_dmarc exited with code 1

```

I just did an experiment, just to check for filerights. I deleted the 'registry' folder on the host, and docker created it without problems.  
So at least now I know it's not a host rights issue.

---

<div class="post-metadata">

**Author:** ![fribse](https://avatars.discourse-cdn.com/v4/letter/f/c67d28/32.png) [@fribse](https://discuss.elastic.co/u/fribse)\
**Post date:** [August 8, 2023, 7:59am UTC](https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694/4 "2023-08-08T07:59:55Z")

</div>

Could it be there is a limit in filebeat for the registry that it will not allow it to be outside the container on the host?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2023, 10:00am UTC](https://discuss.elastic.co/t/filebeat-in-docker-permission-denied-when-trying-to-place-registry-on-the-host/339694/5 "2023-09-05T10:00:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.