Need help with hardened docker setup

[bfg100k]

Hi all, I'm new to NextPVR and is trying to set it up using the docker amd64 image. With the below docker config, everything works fine
d
services:
  nextpvr: #Digital Video Recorder
    image: nextpvr/nextpvr_amd64:7.1.1.260616
    devices:
      - /dev/dvb/
      - /dev/dri/
    volumes:
      - /app/nextpvr:/config:rw
      - /TVRecordings:/recordings:rw

However I usually lock down my containers with the following:

    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges
    user: 1000:1000

These settings appear to cause nextpvr to break. The container starts ok and the web UI responds. However when I try to play a live tv channel (DVB), it fails. Any ideas?
Both DVB tuners are world accessible

Code:

admin@SVR-DS918:/app/nextpvr$ ls -la /dev/dvb total 0 drwxr-xr-x  4 root root    80 Aug 22 17:56 . drwxr-xr-x 15 root root 14460 Aug 23 03:01 .. drwxr-xr-x  2 root root  100 Aug 22 17:56 adapter0 drwxr-xr-x  2 root root  100 Aug 22 17:56 adapter1 admin@SVR-DS918:/app/nextpvr$ ls -la /dev/dvb/adapter0 total 0 drwxr-xr-x 2 root root    100 Aug 22 17:56 . drwxr-xr-x 4 root root      80 Aug 22 17:56 .. crw-rw-rw- 1 root users 212, 0 Aug 22 17:56 demux0 crw-rw-rw- 1 root users 212, 1 Aug 22 17:56 dvr0 crw-rw-rw- 1 root users 212, 2 Aug 22 17:56 frontend0

In the host system dmesg, I get 

Code:

[209477.786294] DeviceHostLinux[20973]: segfault at 20 ip 000055bfc3c0b581 sp 00007ffef0133e40 error 4 in DeviceHostLinux[55bfc3bd4000+45000]

In the docker log, I get

Code:

nextpvr-1  | [3] Got request [127.0.0.1]: /live nextpvr-1  | [3] /live?channeloid=7149&transcoder=9bf85919-c114-4647-ba37-52a1b8234318&sid=459e555f-41eb-43fa-b0a6-d89e2bbe0906&client=459e555f-41eb-43fa-b0a6-d89e2bbe0906 nextpvr-1  | [3]  - channeloid: 7149 nextpvr-1  | [3]  - transcoder: 9bf85919-c114-4647-ba37-52a1b8234318 nextpvr-1  | [3]  - sid: 459e555f-41eb-43fa-b0a6-d89e2bbe0906 nextpvr-1  | [3]  - client: 459e555f-41eb-43fa-b0a6-d89e2bbe0906 nextpvr-1  | [3] range: bytes=0- nextpvr-1  | [3] StreamNative@1.. nextpvr-1  | [3] StreamNative@2 nextpvr-1  | [3] StreamNative@3 nextpvr-1  | [3] StreamNative@4 nextpvr-1  | [3] StreamNative@5 nextpvr-1  | [3] StreamNative@6 nextpvr-1  | [3] StreamNative@7... nextpvr-1  | [3] StreamNative@8 (/buffer/live-10 comedy-1-1.ts) nextpvr-1  | [3] about to start stream... nextpvr-1  | [3] StartStream(7149:10 comedy) nextpvr-1  | [3] looking for capture source (in reverse priority order) nextpvr-1  | [3] checking: IPTV (http://...) nextpvr-1  | [3] checking: adapter1/frontend0 (Realtek RTL2832 (DVB-T)) nextpvr-1  | [3] enabled and present nextpvr-1  | [3] has channel nextpvr-1  | [3] live tv is possible nextpvr-1  | [3] OSArchitecture: X64 nextpvr-1  | [3] Is64BitProcess: True nextpvr-1  | [3] Starting device host: nextpvr-1  | [3] "/app/DeviceHost/x64/DeviceHostLinux" -listen:35396 -type:DVB-T -device:"adapter1/frontend0" -instance:1 -parent:1 nextpvr-1  | [3] With environment: LD_LIBRARY_PATH=/app/DeviceHost/x64: nextpvr-1  | [3] http://localhost:35396/stream/start?slipseconds=900&target=LIVE%26%2Fbuffer%2Flive-10%20comedy-1-1.ts nextpvr-1  | [3] body: nextpvr-1  | <tuning> nextpvr-1  |  <type>DVB-T</type> nextpvr-1  |  <name>10 comedy</name> nextpvr-1  |  <locator> nextpvr-1  |    <conf>219500000OFF</conf> nextpvr-1  |    <lnb>0</lnb> nextpvr-1  |  </locator> nextpvr-1  |  <service_id>1576</service_id> nextpvr-1  |  <tsid>1538</tsid> nextpvr-1  |  <onid>4116</onid> nextpvr-1  |  <service_type>25</service_type> nextpvr-1  | </tuning> nextpvr-1  | nextpvr-1  | [3] Unexpected error on LocalRecorder.StartStream(): System.Net.WebException: Connection refused [::ffff:127.0.0.1]:35396 (localhost:35396) nextpvr-1  |  ---> System.Net.Http.HttpRequestException: Connection refused [::ffff:127.0.0.1]:35396 (localhost:35396) nextpvr-1  |  ---> System.Net.Sockets.SocketException (111): Connection refused [::ffff:127.0.0.1]:35396 nextpvr-1  |    at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress) nextpvr-1  |    at System.Net.Sockets.Socket.Connect(EndPoint remoteEP) nextpvr-1  |    at System.Net.Sockets.Socket.Connect(IPAddress[] addresses, Int32 port) nextpvr-1  | --- End of stack trace from previous location --- nextpvr-1  |    at System.Net.Sockets.Socket.Connect(IPAddress[] addresses, Int32 port) nextpvr-1  |    at System.Net.Sockets.Socket.Connect(String host, Int32 port) nextpvr-1  |    at System.Net.Sockets.Socket.Connect(EndPoint remoteEP) nextpvr-1  |    at System.Net.HttpWebRequest.<>c__DisplayClass219_0.<<CreateHttpClient>b__1>d.MoveNext() nextpvr-1  | --- End of stack trace from previous location --- nextpvr-1  |    at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    --- End of inner exception stack trace --- nextpvr-1  |    at System.Net.Http.HttpConnectionPool.ConnectToTcpHostAsync(String host, Int32 port, HttpRequestMessage initialRequest, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpConnectionPool.AddHttp11ConnectionAsync(QueueItem queueItem) nextpvr-1  |    at System.Threading.Tasks.TaskCompletionSourceWithCancellation`1.WaitWithCancellation(CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.Metrics.MetricsHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.SocketsHttpHandler.Send(HttpRequestMessage request, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.Http.HttpClient.Send(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationToken cancellationToken) nextpvr-1  |    at System.Net.HttpWebRequest.SendRequest(Boolean async) nextpvr-1  |    at System.Net.HttpWebRequest.GetResponse() nextpvr-1  |    --- End of inner exception stack trace --- nextpvr-1  |    at System.Net.HttpWebRequest.GetResponse() nextpvr-1  |    at System.Net.WebClient.GetWebResponse(WebRequest request) nextpvr-1  |    at System.Net.WebClient.DownloadBits(WebRequest request, Stream writeStream) nextpvr-1  |    at System.Net.WebClient.UploadBits(WebRequest request, FileStream readStream, Byte[] buffer, Int32 chunkSize, Byte[] header, Byte[] footer) nextpvr-1  |    at System.Net.WebClient.UploadDataInternal(Uri address, String method, Byte[] data, WebRequest& request) nextpvr-1  |    at System.Net.WebClient.UploadString(Uri address, String method, String data) nextpvr-1  |    at NShared.LocalRecorder.StartStream(ChannelMapping channelMapping, String target, String& reason) nextpvr-1  | [3] Unable to StartStream(): Connection refused [::ffff:127.0.0.1]:35396 (localhost:35396)

[mvallevand]

Sadly you provided a lot of information but you missed the zipped logs that would have included the most import log from DeviceHostlinux

Did you define the buffer volume that is where LiveTV writes with permission 777?

If recordings work I expect it is that. If not try the settings one by one.

Martin