{"id":13446617,"url":"https://github.com/moonbuggy/docker-dnsmasq-updater","last_synced_at":"2025-03-21T06:31:33.318Z","repository":{"id":42650839,"uuid":"220926468","full_name":"moonbuggy/docker-dnsmasq-updater","owner":"moonbuggy","description":"Automatically update a local or remote hosts file with Docker container hostnames","archived":false,"fork":false,"pushed_at":"2024-12-04T06:42:19.000Z","size":283,"stargazers_count":30,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-12-04T07:20:26.726Z","etag":null,"topics":["dns","dnsmasq","docker","docker-swarm","hosts","hostsfile"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/moonbuggy.png","metadata":{"files":{"readme":"README.docker.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-11-11T07:36:56.000Z","updated_at":"2024-12-04T06:42:22.000Z","dependencies_parsed_at":"2024-08-24T09:42:56.387Z","dependency_job_id":null,"html_url":"https://github.com/moonbuggy/docker-dnsmasq-updater","commit_stats":null,"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moonbuggy%2Fdocker-dnsmasq-updater","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moonbuggy%2Fdocker-dnsmasq-updater/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moonbuggy%2Fdocker-dnsmasq-updater/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/moonbuggy%2Fdocker-dnsmasq-updater/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/moonbuggy","download_url":"https://codeload.github.com/moonbuggy/docker-dnsmasq-updater/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244750876,"owners_count":20504161,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dns","dnsmasq","docker","docker-swarm","hosts","hostsfile"],"created_at":"2024-07-31T05:00:55.070Z","updated_at":"2025-03-21T06:31:33.308Z","avatar_url":"https://github.com/moonbuggy.png","language":"Python","funding_links":[],"categories":["Container Operations","Python","Networking \u0026 Proxies"],"sub_categories":["Reverse Proxy"],"readme":"\u003c!--lint disable no-undefined-references no-shortcut-reference-link--\u003e\n\n# Docker Dnsmasq Updater\nAutomatically update a local or remote hosts file with Docker container hostnames.\n\n*   [Rationale](#rationale)\n*   [What It Does](#what-it-does)\n*   [Setup](#setup)\n    *   [Installation of Docker container(s)](#installation-of-docker-containers)\n        *   [Image Tags](#image-tags)\n        *   [Standalone deployment](#standalone-deployment)\n        *   [Standalone DNS Server deployment](#standalone-dns-server-deployment)\n        *   [Swarm deployment](#swarm-deployment)\n    *   [Setup on dnsmasq server](#setup-on-dnsmasq-server)\n    *   [Setup for other Docker containers](#setup-for-other-docker-containers)\n    *   [Use with Traefik](#use-with-traefik)\n*   [Known Issues](#known-issues)\n*   [Links](#links)\n\n## Rationale\nIf you have a LAN with your router using _dnsmasq_ for local DNS you may find\nyourself frequently updating a hosts file as you add or remove Docker containers.\nThe currently available options for automating this typically require you to put\nDocker containers in a subdomain (e.g. \\*.docker.local) and/or, if you want to\nkeep the containers in the top level domain (e.g. \\*.local), installing a\nfull-fledged name server on the router and syncing it with the same in a\ncontainer on the Docker host.\n\nDocker Dnsmasq Updater allows hostnames to be added or removed automatically\nwithout added complexity or resource demands on the router. It can be run as a\nstandalone script or in a container, it only needs access to the Docker socket\nand SSH access to the router (or any device providing local DNS with a hosts\nfile).\n\nThis script has been built with an [AsusWRT-Merlin][]/[Entware][] router in\nmind, but should work with any device running _dnsmasq_ or using a hosts file.\n\n## What It Does\n-   Runs on the Docker host OR in a container OR anywhere (in manager mode)\n-   On load, scans all running containers for a `dnsmasq.updater.enable` label\n-   Optionally, on load, scans a specified Docker network for running containers\n-   After loading, monitors the Docker socket for containers starting/stopping\n    and optionally connecting/disconnecting to a specified Docker network\n-   Finds any hostnames for containers meeting criteria\n-   Writes a hosts file\n-   Restarts a _dnsmasq_ daemon\n\n## Setup\n### Installation of Docker container(s)\n#### Image Tags\n\n| image | tags |\n| :--- | :--- |\n| standalone/manager | script, latest, \\\u003cversion\\\u003e, \\\u003cversion\\\u003e-script |\n| agent | agent, \\\u003cversion\\\u003e-agent |\n| standalone/manager with dnsmasq | server, \\\u003cversion\\\u003e-server |\n\nThe default `latest` tag and the `script` tag point to the standalone/manager\nscript. Agent images will be tagged `agent`.\n\nThe `server` tag provides the standalone/manager script with _dnsmasq_\ninstalled and configured in the container, ready to serve DNS requests for\nDocker hostnames directly.\n\nTags may be prefixed with `\u003cversion\u003e-` to get a specific version, or just use a\nversion number by itself to get `\u003cversion\u003e-script`.\n\n\u003e [!NOTE]\n\u003e After upgrading the Nuitka version, binary builds are currently larger than the\n\u003e un-compiled images. There's also an issue building gunicorn (which is used as\n\u003e the API backend in the manager image) that I've not bothered investigating.\n\u003e\n\u003e As a result, for the time being at least, I've discontinued the `binary` builds.\n\u003e The build system remains capable of building them, and I may begin doing so\n\u003e again at some point. But not today.\n\n##### Architectures\nThe main `latest`, `\u003cversion\u003e`, `script`, `agent`, and `server` tags should\nautomatically provide images compatible with `amd64`, `arm`/`armv7`,\n`armhf`/`armv6`, `arm64`, `386`,`ppc64le` and `s390x` platforms. Tags for\nspecific single-architecture images are no longer being pushed to Docker Hub.\n\n\u003e [!NOTE]\n\u003e I'm only able to test on `amd64`, `armv7` and `arm64`. The images currently\n\u003e work on these architectures. I assume they work on other architectures as\n\u003e well, but can't guarantee it..\n\n#### Standalone deployment\n```sh\ndocker run -d \\\n  --name dnsmasq-updater \\\n  -v /var/run/docker.sock:/var/run/docker.sock \\\n  moonbuggy2000/dnsmasq-updater\n```\n\nIf you're using a config file instead of environment variables (see\n[below](#docker-dnsmasq-updater-environment)) you'll need to persist it with `-v\n\u003chost path\u003e:/app/conf/dnsmasq_updater.conf`. If you're using an SSH key for\nauthentication you can persist and use the _/app/keys/_ folder.\n\n#### Standalone DNS Server deployment\nImages tagged with `server` have _dnsmasq_ installed and Docker Dnsmasq\nUpdater configured to update it. These provide a working DNS server out of the\nbox, populated with hostnames of Docker containers that match the Updater's\nconfigured criteria.\n\nThe `server` images contain the standalone/manager version of Docker Dnsmasq\nUpdater and inherit its configuration options, with some\n[additional options](#docker-dnsmasq-updater-dns-server-environment)\nfor _dnsmasq_. A minimal configuration looks like this:\n```yaml\nversion: '3.7'\n\nservices:\n  dmu-server:\n    image: moonbuggy2000/dnsmasq-updater:server\n    hostname: dmu-dns-server\n    environment:\n      - DMU_DOMAIN=docker  # optional, this is the default\n      - DMU_IP=\u003cfrontend_IP\u003e\n      - DMU_NETWORK=traefik  # optional\n      - DMU_LABELS_FROM=traefik  # optional\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n    ports:\n      - 53:53/tcp\n      - 53:53/udp\n    networks:  # optional\n      - traefik\n\nnetworks:  # optional\n  traefik:\n    external: true\n```\nThis compose file assumes there's a pre-existing Traefik network, but any\nnetwork can be used. If using container labels to select which containers get\nhostnames updated, `DMU_NETWORK` and the network configuration can be omitted\nentirely.\n\nTo customize _dnsmasq's_ configuration, persist and use _/etc/dnsmasq.d/_ for\nextra _*.conf_ files. Don't edit _/etc/dnsmasq.conf_ directly, the init system\nwrites to it during startup, so changes may be overwritten.\n\n#### Swarm deployment\n##### docker-compose.yml\n```yaml\nversion: '3.7'\n\nservices:\n  dnsmasq-updater:\n    image: moonbuggy2000/dnsmasq-updater:script\n    hostname: dmu\n    deploy:\n      mode: replicated\n      replicas: 1\n      placement:\n        constraints:\n          # use a label to choose a specific Swarm node for the manager\n          # this ensures the volume for /app/keys will be present\n          - node.labels.dnsmasq-updater.manager == true\n    environment:\n      - DMU_DEBUG=false\n      - DMU_MODE=manager\n      - DMU_DOMAIN=swarm\n      - DMU_IP=\u003cfrontend_IP\u003e\n      - DMU_KEY=/app/keys/id_rsa\n      - DMU_LOGIN=\u003clogin\u003e\n      - DMU_PREPEND_WWW=true  # optional\n      - DMU_HOSTS_FILE=/opt/etc/hosts.swarm\n      - DMU_SERVER=\u003cdnsmasq_server_IP\u003e\n      - DMU_API_PORT=8080\n      - DMU_API_KEY=\u003capi_key\u003e\n    volumes:\n      - dnsmasq-updater_keys:/app/keys\n    networks:\n      - traefik\n\n  dnsmasq-updater-agent:\n    image: moonbuggy2000/dnsmasq-updater:agent\n    deploy:\n      mode: global\n    environment:\n      - DMU_DEBUG=false  # optional\n      - DMU_NETWORK=traefik  # optional\n      - DMU_API_SERVER=dmu\n      - DMU_API_PORT=8080\n      - DMU_API_KEY=\u003capi_key\u003e\n      - DMU_LABELS_FROM=traefik  # optional\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n    networks:\n      - traefik\n\n  # test a single indirectly exposed container behind a traefik frontend\n  whoami-frontend:\n    image: traefik/whoami:latest\n    hostname: whoami-frontend\n    deploy:\n      mode: replicated\n      replicas: 1\n      labels:\n        - traefik.enable=true\n        - traefik.http.routers.whoami-frontend.rule=Host(`whoami-frontend.swarm`)\n        - traefik.http.routers.whoami-frontend.entryPoints=http,https\n        - traefik.http.services.whoami-frontend.loadbalancer.server.port=80\n    labels:\n      - dnsmasq.updater.enable=true # can be omitted, we're on DMU_NETWORK\n      - dnsmasq.updater.host=whoami-frontend.swarm # can be omitted, set by 'hostname' and traefik\n      - dnsmasq.updater.ip=\u003cfrontend_IP\u003e # can be omitted, it's the DMU_IP default\n    networks:\n      - traefik\n\n  # assuming nothing at the dnsmasq end precludes it, test round-robin DNS for\n  # a globally deployed and directly exposed service\n  whoami-global:\n    image: traefik/whoami:latest\n    hostname: whoami-global\n    deploy:\n      mode: global\n    ports:\n      - 8888:80\n    labels:\n      - dnsmasq.updater.enable=true\n      - dnsmasq.updater.host=whoami-global.swarm # can be omitted, set by 'hostname'\n      - dnsmasq.updater.ip=host # override the default with node's IP\n\nvolumes:\n  dnsmasq-updater_keys:\n    name: dnsmasq-updater_keys\n\nnetworks:\n  traefik:\n    external: true\n```\nThis compose file assumes there's a pre-existing Traefik service and network,\nbut only the _whoami-frontend_ test service has Traefik-specific configuration.\nThis service should be modified as necessary if testing behind other frontends.\n\nDocker Dnsmasq Updater itself isn't dependant on Traefik (or any particular\nfrontend) to run, but it's assumed there will be an ingress controller of some\nsort in a Swarm environment, to route traffic on the default IP to indirectly\nexposed services on individual nodes.\n\nSince, in this case, the Agents are all connecting to the _traefik_ network\nto monitor it for activity, it's convenient to stick the manager on this network\nas well and use it for API communication.\n\nThe manager's `DMU_IP` default IP should point to a frontend/reverse proxy,\nTraefik or otherwise. It's possible to override the default IP on a per-service\nbasis with with a `dnsmasq.updater.ip` label on individual services.\n\nTo meet the manager's constraints, the `dnsmasq-updater.manager` label will need\nto be applied to the chosen node:\n\u003ccode\u003edocker node update --label-add dnsmasq-updater.manager=true \\\u003cnode\\\u003e\u003c/code\u003e\n\nSee below for a detailed description of available\n[environment variables](#docker-environment-variables).\n\nThe Agent should be allowed to restart freely since, by design, it will exit\nupon encountering a variety of otherwise non-fatal errors. This is a simple way\nto trigger a fresh initialisation and ensure the manager has the full picture if\nit's restarted or communications are interrupted for whatever reason.\n\n#### Docker environment variables\nAlmost all the command line parameters (see [Usage](#usage)) can be set with\nenvironment variables.\n\n##### Docker Dnsmasq Updater environment\n*   `DMU_MODE`           - operation mode (accepts: _standalone_, _manager_; default: _standalone_)\n*   `DMU_HOSTS_LOCATION` - location of hosts file (accepts: _local_, _remote_; default: _remote_)\n*   `DMU_IP`             - default IP for the DNS records\n*   `DMU_DOMAIN`         - domain/zone for the DNS records (default: _docker_)\n*   `DMU_DOCKER_SOCKET`  - path to the docker socket (default: _unix://var/run/docker.sock_)\n*   `DMU_NETWORK`        - Docker network to monitor, defaults to none/disabled\n*   `DMU_SERVER`         - _dnsmasq_ server address\n*   `DMU_PORT`           - _dnsmasq_ server SSH port (default: _22_)\n*   `DMU_LOGIN`          - _dnsmasq_ server login name\n*   `DMU_PASSWORD`       - password for the login name or, if a key is specified, decryption of the key\n*   `DMU_KEY`            - full path to SSH key file\n*   `DMU_HOSTS_FILE`     - full path to the hosts file to update on the _dnsmasq_ server\n*   `DMU_RESTART_CMD`    - command to execute to restart/update dnsmasq (default _service restart_dnsmasq_)\n*   `DMU_DELAY`          - delay (in seconds) before writing remote hosts file (default: _10_)\n*   `DMU_API_ADDRESS`    - address for API to listen on (default: _0.0.0.0_)\n*   `DMU_API_PORT`       - port for API to listen on (default: _8080_)\n*   `DMU_API_KEY`        - API access key\n*   `DMU_LABELS_FROM`    - add hostnames from labels set by other services (standalone only, accepts: _traefik_, _none_; default: _traefik_)\n*   `DMU_PREPEND_WWW`    - add _www_ subdomains to all hostnames (default: _False_)\n*   `DMU_DEBUG`          - set _True_ to enable debug log output\n*   `TZ`\t\t             - set timezone\n\n##### Docker Dnsmasq Updater Agent environment\n*   `DMU_DOCKER_SOCKET`  - path to the docker socket (default: _unix://var/run/docker.sock_)\n*   `DMU_NETWORK`        - Docker network to monitor (default: none/disabled)\n*   `DMU_API_SERVER`     - API server address\n*   `DMU_API_PORT`       - port the API is listening on (default: _8080_)\n*   `DMU_API_KEY`        - API access key\n*   `DMU_API_RETRY`      - delay (in seconds) before retrying failed connection (default: _10_)\n*   `DMU_API_CHECK`      - delay (in seconds) between checking the API server status (default: _60_)\n*   `DMU_CLEAN_ON_EXIT`  - delete this device's hosts from the API when the Agent shuts down (default: _True_)\n*   `DMU_LABELS_FROM`    - add hostnames from labels set by other services (accepts: _traefik_, _none_; default: _traefik_)\n*   `DMU_DEBUG`          - set _True_ to enable debug log output\n*   `TZ`\t\t             - set timezone\n\n##### Docker Dnsmasq Updater DNS Server environment\nAs well as inheriting the environment variables from the Standalone/Manager image\n(see above), there's some extra for _dnsmasq_:\n*   `DNS_SERVERS`        - a space separated list of upstream DNS servers (default: _1.1.1.1 8.8.8.8_)\n*   `DNS_LOG_QUERIES`    - set _True_ to enable DNS query log output\n*   `DNS_DEBUG`          - set _True_ to enable _dnsmasq_ debug log output\n\nSome environment variables are pre-configured in the DNS Server image and\nshouldn't be set or changed: `DMU_HOSTS_LOCATION`, `DMU_HOSTS_FILE`,\n`DMU_RESTART_CMD`\n\nThe `TZ` parameter is only used to set timestamps on log messages.\n\n### Setup on dnsmasq server\nDocker Dnsmasq Updater won't track changes other software (i.e _dnsmasq_) might\nmake to the hosts file. Thus, to avoid conflicts, it's best to give Docker\nDnsmasq Updater it's own hosts file to use and either specify it as an\nadditional hosts file to _dnsmasq_ (with the `-addn-hosts \u003cfile\u003e` argument, or\nin _dnsmasq.conf_), or merge it into the main hosts file by some other mechanism.\n\nIf your _dnsmasq_ server is a router with external storage attached it makes\nsense to keep the hosts file the updater generates there, to minimize writes to\nthe router's onboard storage.\n\nIf you're using a key instead of a password you'll need to add the appropriate\npublic key to _~/.ssh/authorized_keys_ on the router (possibly via the router's\nwebUI rather than the shell).\n\n#### AsusWRT-Merlin/Entware example\nAs an example, if you're using AsusWRT-Merlin/Entware, you can easily configure\nthe router to include this external file by writing to _/opt/etc/hosts.docker_\nand adding the following to _/jffs/scripts/hosts.postconf_:\n\n```sh\n# for remote hosts updates\nif [ -f /opt/etc/hosts.docker ]; then\n  cat \"/opt/etc/hosts.docker\" \u003e\u003e \"$CONFIG\"\nfi\n```\n\nThis will add the host definitions in _hosts.docker_ to _/etc/hosts_, which is\nconvenient if we want all host definitions in a single file for easy reference.\n\nAlternatively, the `addn-hosts` method can be implemented through\n_/jffs/configs/dnsmasq.conf.add_:\n\n```sh\naddn-hosts=/opt/etc/hosts.docker\n```\n\nThis will result in _dnsmasq_ reading the _hosts.docker_ file directly.\n\nIn either case, as _dnsmasq_ may start before _/opt_ is mounted, _dnsmasq_\nshould be restarted in _/jffs/scripts/post-mount_, to ensure container name\nresolution functions after a router reboot:\n\n```sh\nif [ -d \"$1/entware\" ] ; then\n  ln -nsf $1/entware /tmp/opt\n  service restart_dnsmasq\nfi\n```\n\nRelevant configuration parameters for Docker Dnsmasq Updater in this scenario\nwould be `--remote_file /opt/etc/hosts.docker --restart_cmd 'service restart_dnsmasq'`.\n\n#### Restart command\nIf _pkill_ is available on the _dnsmasq_ server, it may be better to send a\nSIGHUP to trigger _dnsamsq_ to clear the cache and re-read the hosts file(s)\nwithout restarting. In this scenario the default restart command would be\noverridden with `--restart_cmd 'pkill -HUP dnsmasq'`.\n\nHowever, if you're incorporating the _hosts.docker_ file through an init system\n(as in the _hosts.postconf_ method in the example above), sending a SIGHUP to\n_dnsmasq_ will bypass that init system and thus won't incorporate changes in the\nfile. A restart through the init system (i.e.\n`--restart_cmd 'service restart_dnsmasq`) is required in this case.\n\nA SIGHUP would be viable if using `addn-hosts` to let _dnsmasq_ read the file\ndirectly.\n\n### Setup for other Docker containers\nTo configure Docker Dnsmasq Updater for an individual container there are three\nlabels that can be set:\n\n*   `dnsmasq.updater.enable` - set this to \"true\"\n*   `dnsmasq.updater.host`   - set this to the hostname(s) you want to use\n*   `dnsmasq.updater.ip`     - override the default IP setting (Agent only)\n\n`dnsmasq.updater.host` can be a single hostname or a space-separated list.\n\nThe updater will also add `hostname` and any `extra_hosts` attributes set for a\ncontainer, so `dnsmasq.updater.host` isn't strictly necessary if hostnames are\nset as you want them for a container elsewhere.\n\nIf you choose to monitor a user-defined Docker network then\n`dnsmasq.updater.enable` isn't strictly necessary either. The updater assumes\nany container connecting to the monitored network is a container that you want\nworking DNS for.\n\n`dnsmasq.updater.ip` can be an IP address or the string `host`. Setting this to\n`host` allows for directly exposed containers, using the Swarm node's IP address\n(based on the device's hostname, as seen in the output from `docker info` under\n`Name`, which must must be resolvable). Leave `dnsmasq.updater.ip` unset to use\nthe manager's default IP.\n\nAny defined `extra_hosts` will be given the IP from that definition.\n\n### Use with Traefik\nIf `DMU_LABELS_FROM=traefik` is set, Docker Dnsmasq Updater will pull Traefik\nhostnames set on containers via the ``traefik.http.routers.\u003crouter\u003e.rule=Host(`\u003chostname\u003e`)``\nlabel, including multiple hostnames specified in the\n``Host(`\u003chostname1\u003e`) || Host(`\u003chostname2\u003e`)`` form.\n\nFor the time being, this is enabled by default in images (but not in the script).\nAt some future point this will be disabled by default in both cases.\n\nAs all containers joining a monitored network are considered valid, if you\nmonitor a user-defined network that Traefik uses you don't need to set any\n`dnsmasq.updater.*` labels at all, it gets what it needs from the network and\nTraefik labels.\n\nThis scenario provides the easiest/laziest configuration route, with no specific\nDocker Dnsmasq Updater configuration required on containers.\n\n#### Redirecting 'www' subdomains\nThe `--prepend_www` functionality was added primarily for robustness. Sometimes\npeople add `www.` to URLs for no good reason, then don't know what to make of\nthe ensuing DNS lookup error messages in their browser.\n\nTo resolve this without having to add `www.*` hostnames to every container\nmanually, we can create the DNS records globally with `--prepend_www` and then\nredirect to the _non-www_ domain in a reverse proxy.\n\nIn Traefik this can be done with a router and a middleware added to the dynamic\nconfiguration:\n```yaml\nhttp:\n  routers:\n    redirect-www:\n      # match any host starting with 'www.'\n      rule: \"HostRegexp(`{host:www.+}`)\"\n      # use a low priority to allow overrides on specific containers\n      priority: 1\n      entryPoints:\n        - web\n        - websecure\n      middlewares: strip-www@file\n      service: noop@internal\n\n  middlewares:\n    strip-www:\n      redirectRegex:\n        regex: \"^(https?)://www\\\\.(.*)\"\n        replacement: \"$1://$2\"\n        permanent: true\n```\n\n## Known Issues\n#### pyinit_main: can't initialize time\nThe container may fail to start on some ARM devices with this error:\n\n```\nFatal Python error: pyinit_main: can't initialize time\nPython runtime state: core initialized\nPermissionError: [Errno 1] Operation not permitted\n```\n\nThis is caused by [a bug in libseccomp](https://github.com/moby/moby/issues/40734)\nand can be resolved by either updating libseccomp on the Docker _host_ (to at\nleast 2.4.x) or running the container with `--security-opt seccomp=unconfined`\nset in the `docker run` command.\n\nOn a Debian-based host (e.g. Armbian) it may be necessary to add the backports\nrepo for apt to find the newest version.\n\n## Links\nGitHub: \u003chttps://github.com/moonbuggy/docker-dnsmasq-updater\u003e\n\nDocker Hub: \u003chttps://hub.docker.com/r/moonbuggy2000/dnsmasq-updater\u003e\n\n### Resources\nPre-built Python musl wheels: \u003chttps://github.com/moonbuggy/docker-python-musl-wheels\u003e\n\n[AsusWRT-Merlin]: https://www.asuswrt-merlin.net/\n[Entware]: https://entware.net/about.html\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoonbuggy%2Fdocker-dnsmasq-updater","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmoonbuggy%2Fdocker-dnsmasq-updater","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmoonbuggy%2Fdocker-dnsmasq-updater/lists"}