remark42: Login fails until I restart docker

Every few days I have to restart docker with sudo systemctl restart docker, because login with social media (facebook, google, twitter) fails.

Facebook and Google both say exchange failed and twitter says failed to get request token.

This happens on both local and prod servers.

As I mentioned, simply restarting docker fixes the error, but it’s annoying having to check all the time and I can’t detect when the error occurs programmatically.

Any ideas how to fix this?

Here’s the docker log for Facebook when the error occurs:


2020/10/24 05:49:06.712 [DEBUG] {provider/oauth2.go:81 provider.Oauth2Handler.LoginHandler} login with facebook    
   
2020/10/24 05:49:06.713 [DEBUG] {provider/oauth2.go:120 provider.Oauth2Handler.LoginHandler} login url https://www.facebook.com/v3.2/dialog/oauth?client_id=970830303286078&redirect_uri=https%3A%2F%2Fdev.mywebsite.com%2Fcomments%2Fauth%2Ffacebook%2Fcallback&res ponse_type=code&scope=public_profile&state=3a82c46b33763dfe1a0f35fb797f3269d5f0c71c, claims={"aud":"di-dev","exp":1603538346,"jti":"b9bd4d711d8088420763f1b46893b6e4b79a0b87","nbf":1603536486,"handshake":{"state":"3a82c46b33763dfe1a0f35fb797f3269d5f0c71c","from":"h ttps://dev.mywebsite.com/comments/web/iframe.html?selfClose"}}
  
2020/10/24 05:49:06.713 [INFO]  {logger/logger.go:120 logger.(*Middleware).Handler.func1.1} GET - /auth/facebook/login?from=https://dev.mywebsite.com/comments/web/iframe.html?selfClose&site=di-dev - ec6f71fde8a9 - 302 (283) - 645.39µs                 
          
2020/10/24 05:49:07.175 [DEBUG] {provider/oauth2.go:147 provider.Oauth2Handler.AuthHandler} token with state 3a82c46b33763dfe1a0f35fb797f3269d5f0c71c

2020/10/24 05:49:27.180 [INFO]  {rest/httperrors.go:17 rest.SendErrorJSON} exchange failed - Post https://graph.facebook.com/v3.2/oauth/access_token: dial tcp: lookup graph.facebook.com on 127.0.0.11:53: read udp 127.0.0.1:52074->127.0.0.11:53: i/o timeout - 500 -  10.0.0.1 - /auth/facebook/callback?code=AQBZRFlUnj3D-d18EDRzYoptNrsDqA5-4xNwzGUHeKF6E__E1XVTyMW1Na0X010pII6W5VKY76s3ctDGjgupRo1cbw0Ztn0m3I67nSa8a0AGaB_tkqi8yiFIqHKU0AZ1yK9TC_xLQZ1LFUigWUC3zph9j_ReIRNmkqK4_cqN5VrLEuKXuwu-UQbilKxCaR5eJU7h_13YFuYBvyCAVewnCm2hTYkBCGq 4AA_R4B4exQSModp4gQVO5fn7ElFR56CsdOcp2DWY3ZkGXHrMThxbucRR2s53kHFHHn3iRMB5-z719psKBABLJEWT2-zNEVcLtMlIu8uPnwsesRttt4-y8oaE&state=3a82c46b33763dfe1a0f35fb797f3269d5f0c71c [caused by auth/provider/oauth2.go:150 provider.Oauth2Handler.AuthHandler]    

2020/10/24 05:49:27.180 [INFO]  {logger/logger.go:120 logger.(*Middleware).Handler.func1.1} GET - /auth/facebook/callback?code=AQBZRFlUnj3D-d18EDRzYoptNrsDqA5-4xNwzGUHeKF6E__E1XVTyMW1Na0X010pII6W5VKY76s3ctDGjgupRo1cbw0Ztn0m3I67nSa8a0AGaB_tkqi8yiFIqHKU0AZ1yK9TC_xLQ Z1LFUigWUC3zph9j_ReIRNmkqK4_cqN5VrLEuKXuwu-UQbilKxCaR5eJU7h_13YFuYBvyCAVewnCm2hTYkBCGq4AA_R4B4exQSModp4gQVO5fn7ElFR56CsdOcp2DWY3ZkGXHrMThxbucRR2s53kHFHHn3iRMB5-z719psKBABLJEWT2-zNEVcLtMlIu8uPnwsesRttt4-y8oaE&state=3a82c46b33763dfe1a0f35fb797f3269d5f0c71c - ec6f71f de8a9 - 500 (28) - 20.005239679s  
   
2020/10/24 05:49:27.180 [WARN]  {lgr/adaptor.go:16 lgr.(*Writer).Write} http: superfluous response.WriteHeader call from github.com/go-chi/chi/middleware.Timeout.func1.1.1 (timeout.go:40)

About this issue

Original URL
State: closed
Created 4 years ago
Comments: 20

Most upvoted comments

That’s wrong actually. I can restart Docker without having to restart the firewall. Just tried again multiple times. Not sure what happened the first time.

Thanks for the help @paskal 😃

leem32 on Oct 24, 2020

Those instructions didn’t work for me. I found a script that does work though. https://github.com/sensson/puppet-csf/blob/master/templates/csf_docker.sh https://forum.configserver.com/viewtopic.php?t=10284

Problem solved I can restart the firewall now without it breaking Docker/Remark42.

Just out of interest. Why would you not recommend using systemctl restart docker? On firewall restart.

leem32 on Oct 24, 2020

@paskal, I’ve figured it out. It’s caused by the CSF firewall auto-update. If I restart docker to get remark working again and then restart my firewall the problem reoccurs.

https://forum.configserver.com/viewtopic.php?t=8793

I’ve tried to add docker rules back to firewall on restart but I haven’t got it working yet.


To resolve this create the following in /etc/csf/csfpre.sh

iptables -t nat -N DOCKER
iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
iptables -t nat -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE

iptables -t filter -N DOCKER
iptables -t filter -A FORWARD -o docker0 -j DOCKER
iptables -t filter -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
iptables -t filter -A FORWARD -i docker0 -o docker0 -j ACCEPT

leem32 on Oct 24, 2020

No need I changed them by mixing a few of the chars.

leem32 on Oct 24, 2020