# Permission denied when reading /proc/$pid/io **URL:** \ **Category:** Elastic Observability\ **Tags:** docker\ **Created:** [February 11, 2024, 6:49pm UTC](https://discuss.elastic.co/t/permission-denied-when-reading-proc-pid-io/353026 "2024-02-11T18:49:25Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![i.raisr](https://avatars.discourse-cdn.com/v4/letter/i/e47c2d/32.png) [@i.raisr](https://discuss.elastic.co/u/i.raisr)\ **Post date:** [February 11, 2024, 6:49pm UTC](https://discuss.elastic.co/t/permission-denied-when-reading-proc-pid-io/353026/1 "2024-02-11T18:49:25Z")
Dear all, Please could you comment what is the reason behind specifying required capabilities `NET_ADMIN` and `SETUID` in the following document which describes how to setup a private location for synthetics monitoring: > **[Monitor resources on private networks | Elastic Observability \[8.12\] | Elastic](https://www.elastic.co/guide/en/observability/current/synthetics-private-location.html#synthetics-private-location-connect)** More specifically, the documentation gives an example of a `docker run` and the following note: " The `elastic-agent-complete` Docker image requires additional capabilities to operate correctly. Ensure `NET_RAW` and `SETUID` are enabled on the container." However when SETUID capability is enabled for the docker container _AND_ "Collect Agent Metrics" options is enabled for the Elastic Agent policy, the following error messages start to appear in the docker container: ```auto {"log.level":"error","@timestamp":"2024-02-11T16:20:26.106Z","message":"Error retrieving CPU percentages: error fetching PID 54: FillPidMetrics: error fetching IO metrics for pid 54: error fetching IO metrics: open /proc/54/io: permission denied","component":{"binary":"heartbeat","dataset":"elastic_agent.heartbeat","id":"synthetics/browser-b4d4ee1d-8ff3-403b-b82a-4e3ae9b4cc2a","type":"synthetics/browser"},"log":{"source":"synthetics/browser-b4d4ee1d-8ff3-403b-b82a-4e3ae9b4cc2a"},"log.logger":"metrics","log.origin":{"file.line":70,"file.name":"report/report.go","function":"github.com/elastic/elastic-agent-system-metrics/report.InstanceCPUReporter.func1"},"service.name":"heartbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"} ``` Indeed, looking for the permissions of `/proc/54/io`, it shows: ```auto -r-------- 1 root root 0 Feb 11 16:29 io ``` But the process itself runs with rUID = eUID = rGID = eGID = 1000 (elastic-agent): ```auto PID PPID UID GID EUID EGID 54 7 1000 1000 1000 1000 ``` These two facts combined typically mean that a process did `setuid` during its run and thus kernel protected potentially sensitive files in `/proc/$pid` so that they are owned by root. I don't understand why elastic-agent inside a docker container requires SETUID to switch to elastic-agent user? The default user of the docker container is `elastic-agent` and also all the directory hierarchy for elastic-agent is owned by `elastic-agent`. I made an experiment by _not_ specifying `SETUID` capability to the docker container. Elastic Agent works ok, files under `/proc/$pid` are owned by `elastic-agent` and no error messages about permissions. Perhaps it's the time to revisit this requirement? Kind regards, Ivo Raisr