From 600cde75869bec3e115a19d7d2a78fabea38fefd Mon Sep 17 00:00:00 2001 From: Anso Date: Fri, 21 Aug 2026 19:27:25 -0400 Subject: [PATCH] docs: document LinuxServer socket-proxy ALLOW_LOGS (#1848) LinuxServer socket-proxy gates container logs behind ALLOW_LOGS. Document those extras on top of every profile that includes log viewing, keep archive/changes/export/top disabled, and point Editor and Global Logs troubleshooting at the self-hosting section. --- docs/features/editor.mdx | 3 +++ docs/features/global-observability.mdx | 3 +++ docs/operations/self-hosting.mdx | 24 ++++++++++++++++++++++-- 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/features/editor.mdx b/docs/features/editor.mdx index 3767991e..6986ffe0 100644 --- a/docs/features/editor.mdx +++ b/docs/features/editor.mdx @@ -231,6 +231,9 @@ Sencho tries `/bin/bash` first and transparently falls back to `/bin/sh` if bash The stack has no env file to edit. Add an `env_file:` entry to a service in `compose.yaml` and save, or create a `.env` file in the stack directory through the **Files** tab. + + The container list can still load while log viewing fails. The **View logs** stream can show `[Sencho] Error fetching logs:` followed by an HTTP 403 and `Request forbidden by administrative rules`. A Docker socket proxy is blocking `/containers/{id}/logs`. On `linuxserver/socket-proxy`, set `ALLOW_LOGS=1` in addition to `CONTAINERS=1`. Tecnativa-style profiles include logs under `CONTAINERS`. See [Self-Hosting: Docker socket proxy](/operations/self-hosting#linuxserver-socket-proxy-extras). + Open the **Compose** segment in the stack detail and tap **Edit compose**. If that affordance is missing, your role lacks the `stack:edit` permission; ask an admin to grant it. The phone editor is intended for small corrections; for large compose rewrites, open the stack on a desktop. diff --git a/docs/features/global-observability.mdx b/docs/features/global-observability.mdx index 52c8a01f..ffa1d1b0 100644 --- a/docs/features/global-observability.mdx +++ b/docs/features/global-observability.mdx @@ -160,6 +160,9 @@ The page is built from several independent loops so the masthead and the sparkli The polling fallback got an HTTP error when it tried to read `/api/logs/global`. Check that the host's Docker daemon is reachable on the socket Sencho is configured to use. The page retries the request every five seconds; once it succeeds, the banner clears on its own. + + The page can stay connected (Streaming or Idle, no Offline masthead, no Failed to fetch logs banner) while the feed shows **Awaiting events** and container lines never arrive. A Docker socket proxy is allowing list and inspect but blocking `/containers/{id}/logs`. On `linuxserver/socket-proxy`, set `ALLOW_LOGS=1` in addition to `CONTAINERS=1`. See [Self-Hosting: Docker socket proxy](/operations/self-hosting#linuxserver-socket-proxy-extras). + `Idle` only checks whether an event has arrived in the last ten seconds. If your fleet is genuinely quiet (a maintenance window, a single low-traffic container), the rail rests gray and the band headers in the feed roll up to `2M AGO`, `5M AGO`, and so on. The next event flips the rail back to a shimmering brand cyan and the state word back to `Streaming` on the next one-second tick. diff --git a/docs/operations/self-hosting.mdx b/docs/operations/self-hosting.mdx index f406ccc5..ed200102 100644 --- a/docs/operations/self-hosting.mdx +++ b/docs/operations/self-hosting.mdx @@ -79,7 +79,7 @@ The second option matters because Sencho talks to Docker through two paths, and The last row is the exception to everything above. See [Self-update behind a proxy](#self-update-behind-a-proxy). -The profiles below use `tecnativa/docker-socket-proxy` style flags as a worked example. Other proxies (for example `linuxserver/socket-proxy`) expose similar API-group flags, and the exact lifecycle allow flags vary by implementation, so check the flag names against the proxy image and version you run. Profile values are the literal strings `1` and `0`. +The profiles below use `tecnativa/docker-socket-proxy` style flags as a worked example. Other proxies (for example `linuxserver/socket-proxy`) expose similar API-group flags; check the names against the image and version you run. Profile values are the literal strings `1` and `0`. If you run `linuxserver/socket-proxy`, add the [LinuxServer socket-proxy extras](#linuxserver-socket-proxy-extras) on top of any profile. Log viewing on that image requires `ALLOW_LOGS=1` in addition to `CONTAINERS=1`. Compose Doctor classifies socket-proxy topologies in-app and flags risky configurations such as a proxy that allows mutating API access, publishes a host port, or joins a non-internal network. See [Compose Doctor](/features/compose-doctor). @@ -154,6 +154,26 @@ GRPC=1 This profile supports the full Sencho surface: the interactive shell, build-backed stacks, helper containers, cleanup actions, and self-update where a usable host Docker socket path is available to helpers (see the caveat below). +### LinuxServer socket-proxy extras + +When the proxy image is `linuxserver/socket-proxy` (or `lscr.io/linuxserver/socket-proxy`), add these flags on top of **any** profile above. All three profiles include log viewing. + +```env +ALLOW_LOGS=1 +ALLOW_ARCHIVE=0 +ALLOW_CHANGES=0 +ALLOW_EXPORT=0 +ALLOW_TOP=0 +``` + +On this image, `CONTAINERS=1` lists and inspects containers; it does not open `/containers/{id}/logs`. Sencho log viewing (the Editor **View logs** modal, stack log streams, and the hub Logs tab) requires `ALLOW_LOGS=1`. Enabling `POST` does not grant log access. + +If inventory still works but log viewing does not, the proxy is blocking that endpoint. A typical denial body is `403 Forbidden` with `Request forbidden by administrative rules`. + +Keep the other four flags at `0`. Sencho does not use the container archive, filesystem-diff, export, or `top` Engine endpoints. + +Tecnativa profiles do not use these keys. On `tecnativa/docker-socket-proxy`, logs stay under `CONTAINERS`. + ### Keep these disabled Sencho does not use these API groups today. Keep them disabled unless a future feature adds a direct dependency: @@ -175,7 +195,7 @@ DISTRIBUTION=0 | Capability | What the proxy must allow | |------------|---------------------------| -| Dashboard inventory, topology, logs, stats | CONTAINERS (list, inspect, logs, stats), IMAGES, NETWORKS, VOLUMES, INFO, SYSTEM (disk usage), EVENTS, PING, VERSION | +| Dashboard inventory, topology, logs, stats | CONTAINERS (list, inspect, logs, stats), IMAGES, NETWORKS, VOLUMES, INFO, SYSTEM (disk usage), EVENTS, PING, VERSION. On `linuxserver/socket-proxy`, add `ALLOW_LOGS=1`. | | Container start, stop, restart, auto-heal | CONTAINERS plus POST plus the lifecycle allow flags | | Compose deploy, update, down, pull | POST plus the CONTAINERS, IMAGES, NETWORKS, and VOLUMES groups the Compose Engine uses through the same endpoint | | Build-backed stacks | BUILD plus SESSION and GRPC as the BuildKit path requires |