[GH-ISSUE #2994] [macOS][Self-hosted] Dockerfile gets mode 3001 when recreating a container or adding a protocol #1372

New issue

Open

opened 2026-10-13 20:41:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:41:07 +00:00

Owner

Originally created by @AlexCawl on GitHub (Aug 16, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2994

Describe the bug
When managing a self-hosted server through a supported non-root SSH user with passwordless sudo, a subsequent container operation fails with error 202. This occurs while recreating an existing container or installing an additional protocol after another protocol is already installed.

The uploaded Dockerfile has mode 3001 and cannot be read normally. Retrying the operation recreates it with the same mode. The issue was observed with AmneziaWG and XRay container operations.

To Reproduce

Create an SSH user named amnezia, add it to the sudo group, and allow passwordless sudo.
Confirm that sudo -n true succeeds.
Add the server to AmneziaVPN using that username and password.
Install an initial protocol container.
Later recreate a container or install a second protocol.
Observe error 202 and no newly created target container.
Check the uploaded Dockerfile. For example, with AWG2:

$ stat -c "%A %a %U:%G %n" /opt/amnezia/amnezia-awg2/Dockerfile
------S--t 3001 amnezia:amnezia /opt/amnezia/amnezia-awg2/Dockerfile

Changing the mode to 644 makes a manual build succeed:

$ sudo chmod 644 /opt/amnezia/amnezia-awg2/Dockerfile
$ sudo docker build --no-cache -t amnezia-awg2-debug /opt/amnezia/amnezia-awg2
Successfully built 556a2301824e

After another attempt in AmneziaVPN, the Dockerfile is recreated with mode 3001 and error 202 returns.

Expected behavior
Recreating containers and installing additional protocols should work with a non-root SSH user that has passwordless sudo. Uploaded Dockerfiles should have readable permissions such as 0644.

Log files
Not attached.

Screenshots
Not applicable.

Desktop:

OS: macOS 15.7.7, arm64
Version: AmneziaVPN 5.0.0.5

Smartphone:

Not tested

Server:

OS: Ubuntu 24.04.4 LTS
Docker: 29.1.3

Additional context
The initial container installation may succeed; the failure was observed during later server configuration. The AWG2 Dockerfile content is valid because its manual build succeeds after changing only the permissions. The same operations succeed when the server connection uses root.

Originally created by @AlexCawl on GitHub (Aug 16, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2994 **Describe the bug** When managing a self-hosted server through a supported non-root SSH user with passwordless sudo, a subsequent container operation fails with error 202. This occurs while recreating an existing container or installing an additional protocol after another protocol is already installed. The uploaded Dockerfile has mode `3001` and cannot be read normally. Retrying the operation recreates it with the same mode. The issue was observed with AmneziaWG and XRay container operations. **To Reproduce** 1. Create an SSH user named `amnezia`, add it to the `sudo` group, and allow passwordless sudo. 2. Confirm that `sudo -n true` succeeds. 3. Add the server to AmneziaVPN using that username and password. 4. Install an initial protocol container. 5. Later recreate a container or install a second protocol. 6. Observe error 202 and no newly created target container. 7. Check the uploaded Dockerfile. For example, with AWG2: ```console $ stat -c "%A %a %U:%G %n" /opt/amnezia/amnezia-awg2/Dockerfile ------S--t 3001 amnezia:amnezia /opt/amnezia/amnezia-awg2/Dockerfile ``` Changing the mode to `644` makes a manual build succeed: ```console $ sudo chmod 644 /opt/amnezia/amnezia-awg2/Dockerfile $ sudo docker build --no-cache -t amnezia-awg2-debug /opt/amnezia/amnezia-awg2 Successfully built 556a2301824e ``` After another attempt in AmneziaVPN, the Dockerfile is recreated with mode `3001` and error 202 returns. **Expected behavior** Recreating containers and installing additional protocols should work with a non-root SSH user that has passwordless sudo. Uploaded Dockerfiles should have readable permissions such as `0644`. **Log files** Not attached. **Screenshots** Not applicable. **Desktop:** - OS: macOS 15.7.7, arm64 - Version: AmneziaVPN 5.0.0.5 **Smartphone:** - Not tested **Server:** - OS: Ubuntu 24.04.4 LTS - Docker: 29.1.3 **Additional context** The initial container installation may succeed; the failure was observed during later server configuration. The AWG2 Dockerfile content is valid because its manual build succeeds after changing only the permissions. The same operations succeed when the server connection uses `root`.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1372

No description provided.

Rows
Columns