Unable to take ownership of `/proc/self/fd/2`

[TuTiuTe]

Support guidelines

• I've read the support guidelines

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

I am unable to start this project's compose example because of an ownership issue, as nginx says:

flarum     | nginx: [emerg] open() "/proc/self/fd/2" failed (13: Permission denied)
flarum     | [21-Dec-2025 23:31:35] ERROR: failed to open error_log (/proc/self/fd/2): Permission denied (13)
flarum     | [21-Dec-2025 23:31:35] ERROR: failed to post process the configuration
flarum     | [21-Dec-2025 23:31:35] ERROR: FPM initialization failed

and is stuck in a bootloop

Expected behaviour

nginx not being stuck in a bootloop and being able to start flarum

Actual behaviour

nginx is stuck in a bootloop and does not allow flarum to start

Steps to reproduce

trying to spin the docker compose file from examples, looking at the logs I see:

flarum     | [cont-init.d] 00-fix-logs.sh: executing... 
flarum     | chown: /proc/self/fd/1: Permission denied
flarum     | chown: /proc/self/fd/2: Permission denied
flarum     | [cont-init.d] 00-fix-logs.sh: exited 0.

which in turn causes nginx to bootloop later in the startup process.

Docker info

Client:
 Version:    29.0.4
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  0.30.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  2.40.3
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 25
  Running: 2
  Paused: 0
  Stopped: 23
 Images: 25
 Server Version: 29.0.4
 Storage Driver: overlay2
  Backing Filesystem: btrfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: /usr/bin/tini-static
 containerd version: 1.fc43
 runc version: 
 init version: 
 Security Options:
  seccomp
   Profile: builtin
  selinux
  cgroupns
 Kernel Version: 6.17.11-300.fc43.x86_64
 Operating System: Fedora Linux 43 (Workstation Edition)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 14.96GiB
 Name: REDACTED
 ID: fb65d7ea-0ceb-42b5-827d-7de0517aaace
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables+firewalld

Docker Compose config

name: flarum
services:
  db:
    command:
      - mysqld
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
    container_name: flarum_db
    environment:
      MARIADB_RANDOM_ROOT_PASSWORD: "yes"
      MYSQL_DATABASE: flarum
      MYSQL_PASSWORD: flarum
      MYSQL_USER: flarum
      TZ: Europe/Paris
    image: mariadb:10
    networks:
      default: null
    volumes:
      - type: bind
        source: /home/REDACTED/Projects/tmp/docker-flarum/examples/compose/db
        target: /var/lib/mysql
        bind:
          selinux: Z
          create_host_path: true
  flarum:
    container_name: flarum
    depends_on:
      db:
        condition: service_started
        required: true
    environment:
      DB_HOST: db
      DB_NAME: flarum
      DB_PASSWORD: flarum
      DB_USER: flarum
      FLARUM_BASE_URL: http://127.0.0.1:8000
      FLARUM_DEBUG: "false"
      LOG_IP_VAR: remote_addr
      MEMORY_LIMIT: 256M
      OPCACHE_MEM_SIZE: "128"
      PGID: "1000"
      PUID: "1000"
      REAL_IP_FROM: 0.0.0.0/32
      REAL_IP_HEADER: X-Forwarded-For
      STARTUP_COMMAND_1: sudo chown docker /proc/self/fd/{1,2}
      TZ: Europe/Paris
      UPLOAD_MAX_SIZE: 16M
    image: crazymax/flarum:latest
    networks:
      default: null
    ports:
      - mode: ingress
        target: 8000
        published: "8000"
        protocol: tcp
    volumes:
      - type: bind
        source: /home/REDACTED/Projects/tmp/docker-flarum/examples/compose/data
        target: /data
        bind:
          selinux: Z
          create_host_path: true
networks:
  default:
    name: flarum_default

Logs

flarum  | [s6-init] making user provided files available at /var/run/s6/etc...exited 0.
flarum  | [s6-init] ensuring user provided files have correct perms...exited 0.
flarum  | [fix-attrs.d] applying ownership & permissions fixes...
flarum  | [fix-attrs.d] done.
flarum  | [cont-init.d] executing container initialization scripts...
flarum  | [cont-init.d] 00-fix-logs.sh: executing... 
flarum  | chown: /proc/self/fd/1: Permission denied
flarum  | chown: /proc/self/fd/2: Permission denied
flarum  | [cont-init.d] 00-fix-logs.sh: exited 0.
flarum  | [cont-init.d] 01-fix-uidgid.sh: executing... 
flarum  | [cont-init.d] 01-fix-uidgid.sh: exited 0.
flarum  | [cont-init.d] 02-fix-perms.sh: executing... 
flarum  | Fixing perms...
flarum  | [cont-init.d] 02-fix-perms.sh: exited 0.
flarum  | [cont-init.d] 03-config.sh: executing... 
flarum  | Setting timezone to Europe/Paris...
flarum  | Setting PHP-FPM configuration...
flarum  | Setting PHP INI configuration...
flarum  | Setting OpCache configuration...
flarum  | Setting Nginx configuration...
flarum  | Initializing files and folders...
flarum  | cp: can't create '/data/assets': File exists
flarum  | cp: can't create '/data/storage': File exists
flarum  | Permissions already fixed in /data/assets
flarum  | Permissions already fixed in /data/extensions
flarum  | Permissions already fixed in /data/storage
flarum  | Permissions already fixed in /opt/flarum/vendor
flarum  | Checking parameters...
flarum  | Checking database connection...
flarum  | Waiting 60s for database to be ready...
flarum  | Database ready!
flarum  | Creating Flarum config file...
flarum  | Migrating Flarum...
flarum  | Nothing to migrate.
flarum  | DONE.
flarum  | Clearing the cache...
flarum  | [cont-init.d] 03-config.sh: exited 0.
flarum  | [cont-init.d] 04-svc-main.sh: executing... 
flarum  | [cont-init.d] 04-svc-main.sh: exited 0.
flarum  | [cont-init.d] ~-socklog: executing... 
flarum  | [cont-init.d] ~-socklog: exited 0.
flarum  | [cont-init.d] done.
flarum  | [services.d] starting services
flarum  | nginx: [emerg] open() "/proc/self/fd/2" failed (13: Permission denied)
flarum  | [services.d] done.
flarum  | [21-Dec-2025 23:54:26] ERROR: failed to open error_log (/proc/self/fd/2): Permission denied (13)
flarum  | [21-Dec-2025 23:54:26] ERROR: failed to post process the configuration
flarum  | [21-Dec-2025 23:54:26] ERROR: FPM initialization failed
flarum  | nginx: [emerg] open() "/proc/self/fd/2" failed (13: Permission denied)
flarum  | [21-Dec-2025 23:54:27] ERROR: failed to open error_log (/proc/self/fd/2): Permission denied (13)
flarum  | [21-Dec-2025 23:54:27] ERROR: failed to post process the configuration
flarum  | [21-Dec-2025 23:54:27] ERROR: FPM initialization failed
flarum  | nginx: [emerg] open() "/proc/self/fd/2" failed (13: Permission denied)
flarum  | [21-Dec-2025 23:54:28] ERROR: failed to open error_log (/proc/self/fd/2): Permission denied (13)
flarum  | [21-Dec-2025 23:54:28] ERROR: failed to post process the configuration
flarum  | [21-Dec-2025 23:54:28] ERROR: FPM initialization failed
flarum  | nginx: [emerg] open() "/proc/self/fd/2" failed (13: Permission denied)
flarum  | [21-Dec-2025 23:54:29] ERROR: failed to open error_log (/proc/self/fd/2): Permission denied (13)
flarum  | [21-Dec-2025 23:54:29] ERROR: failed to post process the configuration
flarum  | [21-Dec-2025 23:54:29] ERROR: FPM initialization failed
flarum  | nginx: [emerg] open() "/proc/self/fd/2" failed (13: Permission denied)
flarum  | [21-Dec-2025 23:54:30] ERROR: failed to open error_log (/proc/self/fd/2): Permission denied (13)
flarum  | [21-Dec-2025 23:54:30] ERROR: failed to post process the configuration
flarum  | [21-Dec-2025 23:54:30] ERROR: FPM initialization failed

Additional info

SELinux was bothersome for the mounts, I had to add the :Z to volumes

[crazy-max]

This seems related to SELinux + non-root services reopening /proc/self/fd/* for logging.

In this image, nginx/php-fpm run as ${PUID}:${PGID} and both are configured to log to /proc/self/fd/2, which can fail with Permission denied on some SELinux policies.

You could try disabling SELinux labeling for flarum service:

security_opt:
  - label=disable