Failed to create UnixStream

[asciideer]

Subject of the issue

Crash on startup

Deployment environment

• vaultwarden version:
  latest docker (sha256:c2849f8189e4d425a9d80db0380566cc38577b289b9e6c88330e190e19af5a30)

• Install method:
  docker

• Other relevant details:
  debian 12 bookworm

Steps to reproduce

# docker run --name vaultwarden -v /vw-data/:/data/ -p 3001:3001 --security-opt seccomp=unconfined -e "RUST_BACKTRACE=full" -e "LOG_LEVEL=debug" -it vaultwarden/server:latest
# docker logs vaultwarden

Expected behaviour

plain start up, no issues

Actual behaviour + troubleshooting data

thread 'main' panicked at 'failed to create UnixStream: Os { code: 13, kind: PermissionDenied, message: "Permission denied" }', /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/tokio-1.29.1/src/signal/unix.rs:58:53
stack backtrace:                                                                                                                                                                                                                                                                  
   0:     0x7f1d667f16ad - <std::sys_common::backtrace::_print::DisplayBacktrace as core::fmt::Display>::fmt::he12b586f68e91b77                                                                                                                                                   
   1:     0x7f1d6627b3af - core::fmt::write::hc9b09f10c793ddf8                                                                                                                                                                                                                    
   2:     0x7f1d667ee7e5 - std::io::Write::write_fmt::h2c6ee5e4a01225f0                                                                  
   3:     0x7f1d667f1485 - std::sys_common::backtrace::print::h75b2579ae28505d3                                                                                                                                                                                                   
   4:     0x7f1d667f2cae - std::panicking::default_hook::{{closure}}::h6770bc0e6b92c297                                                  
   5:     0x7f1d667f2a8e - std::panicking::default_hook::h10d80c7c91e6d7f6                                                                                                                                                                                                        
   6:     0x7f1d667f317b - std::panicking::rust_panic_with_hook::hef54f15d36ba505a                                                       
   7:     0x7f1d667f3086 - std::panicking::begin_panic_handler::{{closure}}::h68f165a2c696be7f                                                                                                                                                                                    
   8:     0x7f1d667f1ac6 - std::sys_common::backtrace::__rust_end_short_backtrace::h40e1d7ae5c92331e                                                                                                                                                                              
   9:     0x7f1d667f2e22 - rust_begin_unwind                                                                                                                                                                                                                                      
  10:     0x7f1d661d3833 - core::panicking::panic_fmt::hbf443f24a3a55022                                                                                                                                                                                                          
  11:     0x7f1d661d3ce3 - core::result::unwrap_failed::hdaa067f32f4c1fb6                                                                                                                                                                                                         
  12:     0x7f1d668463c8 - tokio::signal::registry::globals_init::h0f760ec183410a04                                                      
  13:     0x7f1d661f9431 - std::sys_common::once::futex::Once::call::hd025a5a0327a2513                                                                                                                                                                                            
  14:     0x7f1d661fa44b - tokio::util::once_cell::OnceCell<T>::do_init::h5b7691c3ab675b8a                                                                                                                                                                                        
  15:     0x7f1d66845ab6 - tokio::runtime::signal::Driver::new::hdb3712b83297a65c                                                                                                                                                                                                 
  16:     0x7f1d66851875 - tokio::runtime::driver::Driver::new::h354a7f5207f5bf15                                                                                                                                                                                                 
  17:     0x7f1d6683e939 - tokio::runtime::builder::Builder::build::hd8e27604c9a1a916                                                                                                                                                                                             
  18:     0x7f1d66b0899f - rocket::async_main::he9135f0d133b4f08                                                                         
  19:     0x7f1d66ee61c8 - vaultwarden::main::hffa2edb030583fdd                                                                                                                                                                                                                   
  20:     0x7f1d67100da6 - std::sys_common::backtrace::__rust_begin_short_backtrace::h244cdd2e29239602                                                                                                                                                                            
  21:     0x7f1d66c02f28 - std::rt::lang_start::{{closure}}::h275889856aa720e0                                                                                                                                                                                                    
  22:     0x7f1d667e761a - std::rt::lang_start_internal::hebd4e8d348b0ef95                                                               
  23:     0x7f1d66ee6205 - main                                                                                                                                                                                                                                                   ```

[BlackDex]

There has been a discussion like this on Matrix already, and crossed several scenarios, it must be something on the host.

I just tested the exact same command you are using, and it works just fine for me.
Please supply some more information on your host and docker.

Stuff like:

#Kernel/Host info:
uname -a

# CPU Info:
cat /proc/cpuinfo | grep -m1 -i "model name"

#Docker info:
docker info

# Storage space:
df -h

[BlackDex]

It could be that your VPS is blocking something, or uses some security features that prevents the working of the container some way.

[BlackDex]

It really must be a permission issue on either Docker or the volume you mount.

Try to remove the -v volume option and run it with -e I_REALLY_WANT_VOLATILE_STORAGE=true.

[asciideer]

Tried this; didn't work. Tried changing /vw-data/ to /root/vw-data/ with no success either.

[rudiservo]

I know this is an old thread, but I am having this situation on LXD with a Debian 12.
I already have
security.idmap.isolated: "true"
security.nesting: "true"

any tips?

[rudiservo]

Found the issue, debian 12 docker package adds a default apparmor docker-default that prevents creating a socket so it seems.

apparmor="DENIED" operation="create" class="net" info="failed type and protocol match" error=-13 namespace="root//lxd-vaultwarden_<var-snap-lxd-common-lxd>" profile="docker-default" pid=625329 comm="vaultwarden" family="unix" sock_type="stream" protocol=0 requested_mask="create" denied_mask="create" addr=none

Adding security_opt: - apparmor:unconfined seems to solve the problem.
Does vaultwarden realy needs that socket?