[Bug]: Docker stats data=[]

[tercerapersona]

Description

Hi!

I have a rootless docker setup, but my user (pi) is in the docker group, so I can execute any docker command without sudo. However, I cannot see Docker charts.

Expected Behavior

I should see Docker charts.

Steps to Reproduce

I've installed beszel and beszel-agent with the docker-compose.yml examples from the website. I can succesfully connect to the dashboard and see my agent. However, I cannot see the Docker related charts.

When running the agent with log level debug I see this logs,

beszel-agent  | 2025/03/04 15:52:50 DEBUG Error getting docker stats err="Get \"http://localhost/containers/json\": dial unix /var/run/docker.sock: connect: permission denied"

If I force docker.sock permissions (which not recommend) to 666, I get,

beszel-agent  | 2025/03/04 15:54:16 DEBUG Docker stats data=[]

Furthermore, I tried docker stats and wasn't showing either MEM or CPU, so I've followed the guide mentioned in the docs, added those params to cmdline.txt, rebooted, and memory is now showing, but CPU is still zero for all containers. When running docker info I still get,

WARNING: No cpuset support

OS / Architecture

Linux raspberrypi 6.1.21-v7+ #1642 SMP Mon Apr 3 17:20:52 BST 2023 armv7l GNU/Linux

Beszel version

0.9.1

Installation method

Docker

Configuration

Hub Logs

Agent Logs

beszel-agent  | 2025/03/04 15:53:50 DEBUG Getting stats
beszel-agent  | 2025/03/04 15:53:50 DEBUG Temperature sensors="[{\"sensorKey\":\"cpu_thermal\",\"temperature\":45.464,\"sensorHigh\":0,\"sensorCritical\":110}]"
beszel-agent  | 2025/03/04 15:53:50 DEBUG sysinfo data="{Hostname:raspberrypi KernelVersion:6.1.21-v7+ Cores:4 Threads:4 CpuModel:Cortex-A7 Uptime:1467 Cpu:3.84 MemPct:27.09 DiskPct:23.81 Bandwidth:0 AgentVersion:0.9.1 Podman:false}"
beszel-agent  | 2025/03/04 15:53:50 DEBUG System stats data="{Stats:{Cpu:3.84 MaxCpu:0 Mem:0.9 MemUsed:0.24 MemPct:27.09 MemBuffCache:0.56 MemZfsArc:0 Swap:0.1 SwapUsed:0 DiskTotal:28.14 DiskUsed:6.42 DiskPct:23.81 DiskReadPs:0.01 DiskWritePs:0.01 MaxDiskReadPs:0 MaxDiskWritePs:0 NetworkSent:0 NetworkRecv:0 MaxNetworkSent:0 MaxNetworkRecv:0 Temperatures:map[cpu_thermal:45.46] ExtraFs:map[] GPUData:map[]} Info:{Hostname:raspberrypi KernelVersion:6.1.21-v7+ Cores:4 Threads:4 CpuModel:Cortex-A7 Uptime:1467 Cpu:3.84 MemPct:27.09 DiskPct:23.81 Bandwidth:0 AgentVersion:0.9.1 Podman:false} Containers:[]}"
beszel-agent  | 2025/03/04 15:53:50 DEBUG Error getting docker stats err="Get \"http://localhost/containers/json\": dial unix /var/run/docker.sock: connect: permission denied"
beszel-agent  | 2025/03/04 15:53:50 DEBUG Extra filesystems data=map[]

[tercerapersona]

Ok, I've mounted /etc/group (ro) to the agent and now it isn't failing by permissions. Maybe because docker default GID is 999 and my host setup shows it's 994,

pi@raspberrypi:~/beszel $ cat /etc/group | grep docker
docker:x:994:netdata,pi

I've previously had netdata installed, that's why it is part of the docker group.

However, logs still shows:

beszel-agent  | 2025/03/04 15:54:16 DEBUG Docker stats data=[]

And, docker stats:

CONTAINER ID   NAME                                     CPU %     MEM USAGE / LIMIT   MEM %     NET I/O           BLOCK I/O   PIDS
5632ffecc9be   beszel-agent                             0.00%     3.02MiB / 922MiB    0.33%     0B / 0B           0B / 0B     6
ac2c92bbde5a   beszel                                   0.00%     11.3MiB / 922MiB    1.23%     106kB / 1.02MB    0B / 0B     9

Full docker info output,

pi@raspberrypi:~/beszel $ docker info
Client: Docker Engine - Community
 Version:    27.2.1
 Context:    rootless
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.16.2
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.29.2
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 8
  Running: 5
  Paused: 0
  Stopped: 3
 Images: 16
 Server Version: 27.2.1
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: true
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 7f7fdf5fed64eb6a7caf99b3e12efcf9d60e311c
 runc version: v1.1.14-0-g2c9f560
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  rootless
  cgroupns
 Kernel Version: 6.1.21-v7+
 Operating System: Raspbian GNU/Linux 11 (bullseye)
 OSType: linux
 Architecture: armv7l
 CPUs: 4
 Total Memory: 922MiB
 Name: raspberrypi
 ID: 9a3a5bba-c090-4fbf-aabb-383a3262fae1
 Docker Root Dir: /home/pi/.local/share/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support

And /boot/cmdline.txt,

console=serial0,115200 console=tty1 root=PARTUUID=6ade4ad3-02 rootfstype=ext4 fsck.repair=yes rootwait cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1

[tercerapersona]

Ok! after debugging a while, found out rootless docker's containers are not exposed by default /var/run/socker.sock but /run/user/UID/docker.sock

pi@raspberrypi:~/beszel $ docker context ls
NAME         DESCRIPTION                               DOCKER ENDPOINT                     ERROR
default      Current DOCKER_HOST based configuration   unix:///var/run/docker.sock
rootless *   Rootless mode                             unix:///run/user/1000/docker.sock
pi@raspberrypi:~/beszel $ uvx --with=docker ipython
Python 3.13.2 (main, Feb 12 2025, 14:40:05) [GCC 6.3.0 20170516]
Type 'copyright', 'credits' or 'license' for more information
IPython 9.0.1 -- An enhanced Interactive Python. Type '?' for help.
Tip: The `%timeit` magic has an `-o` flag, which returns the results, making it easy to plot. See `%timeit?`.

In [1]: import docker
docker
In [2]: client = docker.DockerClient(base_url='unix:///run/user/1000/docker.sock')

In [3]: containers = client.containers.list()

In [4]: list(containers)
Out[4]:
[<Container: 5632ffecc9be>,
 <Container: ac2c92bbde5a>,
 <Container: f211a6e657c6>,
 <Container: 88a4450c4fc9>,
 <Container: 695b5d61514b>]

So, updated my docker compose to something like this and worked!

services:
  beszel:
    image: henrygd/beszel:latest
    container_name: beszel
    restart: unless-stopped
    extra_hosts:
      - host.docker.internal:host-gateway
    ports:
      - 8090:8090
    volumes:
      - ./beszel_data:/beszel_data

  beszel-agent:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent
    restart: unless-stopped
    network_mode: host
    volumes:
      - /run/user/1000/docker.sock:/run/user/1000/docker.sock:ro
    environment:
      PORT: 45876
      LOG_LEVEL: debug
      DOCKER_HOST: unix:///run/user/1000/docker.sock
      KEY: 'HUB PUB KEY'

Any tip? or better way to setup beszel in rootless docker setups?

PD: CPU is not showing up. Any guess?

[tercerapersona]

Fixed! Followed this guide: https://rootlesscontaine.rs/getting-started/common/cgroup2/#enabling-cpu-cpuset-and-io-delegation

Might be helpful to include this in the docs, along with the docker socket path.

We can close the issue.

[tercerapersona]

[henrygd]

Thanks a lot for troubleshooting this! 👍

I added it to the common issues page: https://beszel.dev/guide/common-issues#docker-stats-missing-with-rootless-agent

[tercerapersona]

Here's a more generic way to mount user's docker socket using XDG_RUNTIME_DIR env:

  beszel-agent:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent
    restart: unless-stopped
    network_mode: host
    volumes:
      - ${XDG_RUNTIME_DIR}/docker.sock:/var/run/docker.sock:ro
    environment:
      PORT: 45876
      KEY: "HUB PUB KEY"