From e299b37b0ca50883b8c9a9a8560568823e64992a Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 11 Aug 2026 17:04:15 +0000 Subject: [PATCH] Add apparmor:unconfined to Beszel Docker agents - dbus mount alone isn't enough The systemd/dbus mounts added last commit aren't sufficient by themselves on an AppArmor-enabled host (Ubuntu/Debian by default): the dbus "Hello" handshake fails with "An AppArmor policy prevents this sender from sending this message to this recipient", since the container has no AppArmor label the host's dbus-daemon profile recognizes. Only visible at LOG_LEVEL=debug - silent otherwise, which is why the mounts alone looked like they should have worked but didn't. Confirmed live against a real box hitting exactly this error. security_opt: apparmor:unconfined is Beszel's own documented fix (beszel.dev/guide/systemd#apparmor-error) for this exact error string. Added to both Docker-based agent compose generators (install_beszel's combined hub+agent, and install_beszel-agent's remote-only variant). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn --- services/beszel.sh | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/services/beszel.sh b/services/beszel.sh index 7637913..4de189a 100644 --- a/services/beszel.sh +++ b/services/beszel.sh @@ -220,6 +220,7 @@ install_beszel() { echo "[DRY-RUN] Port 8090 published for the hub (auto-scanned for a free host port)" echo "[DRY-RUN] Agent connects to the hub over a shared unix socket, not a TCP port" echo "[DRY-RUN] Would mount host systemd/dbus sockets + sensor paths read-only (Services/Temp columns)" + echo "[DRY-RUN] Would set security_opt: apparmor:unconfined on the agent (needed for dbus to work at all on an AppArmor host)" echo "[DRY-RUN] Would pause for you to log into the hub and provide its key + universal token to finish the agent" return 0 fi @@ -295,6 +296,15 @@ networks: # running as a normal host process, which is what first surfaced this # gap — a Docker-deployed agent sitting right next to it showed nothing # in either column until these were added. + # + # The mounts alone aren't enough on an AppArmor-enabled host (Ubuntu/ + # Debian by default): the dbus connection attempt fails with "An + # AppArmor policy prevents this sender from sending this message to + # this recipient" (visible only at LOG_LEVEL=debug — silent otherwise), + # since the container has no AppArmor label the host's dbus-daemon + # profile recognizes. security_opt: apparmor:unconfined below is + # Beszel's own documented fix (beszel.dev/guide/systemd#apparmor-error) + # — confirmed live, this exact error on a real box. cat > docker-compose.yml << BESZEL_COMPOSE name: beszel @@ -316,6 +326,8 @@ ${_CADDY_NET_BLOCK} container_name: beszel-agent restart: unless-stopped network_mode: host + security_opt: + - apparmor:unconfined env_file: .env environment: - LISTEN=/beszel_socket/beszel.sock @@ -375,10 +387,13 @@ report every currently-running container automatically — nothing to configure per-service; install or remove a container on this box and the agent's next poll just reflects it. -Also mounts the host's systemd/dbus sockets and sensor paths (read-only) so +Also mounts the host's systemd/dbus sockets and sensor paths (read-only), +plus `security_opt: apparmor:unconfined` (required on Ubuntu/Debian for the +dbus connection to work at all — otherwise AppArmor silently blocks it), so the hub's **Services** (systemd units) and **Temp** (hardware sensors) -columns work for this box — without them a Docker-deployed agent silently -shows both empty, no error anywhere pointing at why. +columns work for this box — without both, a Docker-deployed agent silently +shows both empty, no error anywhere pointing at why (visible only at +`LOG_LEVEL=debug`). ## First login @@ -454,6 +469,7 @@ install_beszel-agent() { echo "[DRY-RUN] Would deploy henrygd/beszel-agent only (no hub, no web UI on this box)" echo "[DRY-RUN] network_mode: host, /var/run/docker.sock mounted read-only" echo "[DRY-RUN] plus host systemd/dbus sockets + sensor paths read-only (Services/Temp columns)" + echo "[DRY-RUN] plus security_opt: apparmor:unconfined (needed for dbus to work at all on an AppArmor host)" echo "[DRY-RUN] Would prompt for the hub's public URL, then its key + universal token" echo "[DRY-RUN] (same paste flow as the hub-side installer)" echo "[DRY-RUN] No inbound port opened — the agent connects OUTBOUND to the hub, so no" @@ -515,6 +531,8 @@ services: container_name: beszel-agent restart: unless-stopped network_mode: host + security_opt: + - apparmor:unconfined env_file: .env environment: - HUB_URL=\${HUB_URL} @@ -544,10 +562,13 @@ Reports this box's host resources and Docker container stats to a Beszel HUB running elsewhere — no hub, no web UI, nothing web-facing on this box at all. -Also mounts the host's systemd/dbus sockets and sensor paths (read-only) so +Also mounts the host's systemd/dbus sockets and sensor paths (read-only), +plus \`security_opt: apparmor:unconfined\` (required on Ubuntu/Debian for the +dbus connection to work at all — otherwise AppArmor silently blocks it), so the hub's **Services** (systemd units) and **Temp** (hardware sensors) -columns work for this box too — without them a Docker-deployed agent -silently shows both empty, no error anywhere pointing at why. +columns work for this box too — without both, a Docker-deployed agent +silently shows both empty, no error anywhere pointing at why (visible only +at \`LOG_LEVEL=debug\`). ## Connecting (if you skipped it during install)