Getting Data In

Docker Config option for Splunk web.conf error

jjesudass
Engager

I am using Splunk/splunk:latest version(7.0.0) and docker compose version (3.4) .
Also deploying an nginx proxy with context root as /splunk to forward to splunk web at 8000.

The web.conf is added to the container as a docker config at /opt/splunk/etc/system/local/web.conf as root user, and also starting the container as root user.
The splunk container fails to start with error: chown: changing ownership of ‘/opt/splunk/etc/system/local/web.conf’: Read-only file system

web.conf:

[settings]

root_endpoint=/splunk

Docker-Compose:

version: "3.4"
services:
enterprise:
image: splunk/splunk
environment:
SPLUNK_START_ARGS: --accept-license
SPLUNK_USER: root
ports:
- "8000"
- "8088"
configs:
- source: web.conf
target: /opt/splunk/etc/system/local/web.conf
uid: '0'
gid: '0'
mode: 0440
deploy:
replicas: 1
restart_policy:
condition: on-failure
configs:
web.conf:
file: web.conf

ggudgin
Explorer

I am running the latest docker image and have a similar issue. Running 7.0.2 on Docker CE with Portainer.
The user and group defined by the default variables are splunk splunk
However when I check the files in the /etc volume they are all owned by docker with the exception of modified files which become owned by root.

The container stops with error 13 access denied web.conf

Running the container with environment variables set to root, allows the container to start.

Something is a miss with the ownership when this container makes changes to the file system. For now I'm just running it as root:root

0 Karma

ggudgin
Explorer

I am running the latest docker image and have a similar issue. Running 7.0.2 on Docker CE with Portainer.
The user and group defined by the default variables are splunk splunk
However when I check the files in the /etc volume they are all owned by docker with the exception of modified files which become owned by root.

The container stops with error 13 access denied web.conf

Running the container with environment variables set to root, allows the container to start.

Something is a miss with the ownership when this container makes changes to the file system. For now I'm just running it as root:root

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...