failed to start: container mailcowdockerized-unbound-mailcow-1 is unhealthy

Ballistic

Hi,

Did a clean install today on Debian 12.2 using these steps starting from the “Mailserver” part; https://gist.github.com/opentaq/2ce85108bee528700477c6db89610968

Unfortunately cannot seem to get it to start fully:
root@mail-mailcow:/opt/mailcow-dockerized# docker-compose up -d
[+] Running 13/13
✔ Container mailcowdockerized-dockerapi-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-memcached-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-redis-mailcow-1 Started 0.0s
✘ Container mailcowdockerized-unbound-mailcow-1 Error 0.0s
✔ Container mailcowdockerized-olefy-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-solr-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-sogo-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-mysql-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-php-fpm-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-nginx-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-dovecot-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-ofelia-mailcow-1 Started 0.0s
✔ Container mailcowdockerized-rspamd-mailcow-1 Started 0.0s
dependency failed to start: container mailcowdockerized-unbound-mailcow-1 is unhealthy

root@mail-mailcow:/opt/mailcow-dockerized# docker logs mailcowdockerized-unbound-mailcow-1
Setting console permissions…
Receiving anchor key…
Receiving root hints…
######################################################################## 100.0%
setup in directory /etc/unbound
Certificate request self-signature ok
subject=CN = unbound-control
removing artifacts
Setup success. Certificates created. Enable in unbound.conf file to use
[1701098292] unbound[1:0] notice: init module 0: validator
[1701098292] unbound[1:0] notice: init module 1: iterator
[1701098292] unbound[1:0] info: start of service (unbound 1.17.1).
[1701098354] unbound[1:0] info: service stopped (unbound 1.17.1).
[1701098354] unbound[1:0] info: server stats for thread 0: 16 queries, 0 answers from cache, 16 recursions, 0 prefetch, 0 rejected by ip ratelimiting
[1701098354] unbound[1:0] info: server stats for thread 0: requestlist max 8 avg 4.6875 exceeded 0 jostled 0
[1701098354] unbound[1:0] info: average recursion processing time 11.704130 sec
[1701098354] unbound[1:0] info: histogram of recursion processing times
[1701098354] unbound[1:0] info: [25%]=9 median[50%]=12 [75%]=15
[1701098354] unbound[1:0] info: lower(secs) upper(secs) recursions
[1701098354] unbound[1:0] info: 4.000000 8.000000 2
[1701098354] unbound[1:0] info: 8.000000 16.000000 8
[1701098354] unbound[1:0] info: 16.000000 32.000000 2
Setting console permissions…
Receiving anchor key…
Receiving root hints…
######################################################################## 100.0%
setup in directory /etc/unbound
removing artifacts
Setup success. Certificates created. Enable in unbound.conf file to use
[1701098432] unbound[1:0] notice: init module 0: validator
[1701098432] unbound[1:0] notice: init module 1: iterator
[1701098432] unbound[1:0] info: start of service (unbound 1.17.1).

It’s a clean install. Did an ./update anyway which went all fine. But problem remains.

Do you guys have any ideas?

Thanks!

Tried again with this howto:
https://www.bennetrichter.de/en/tutorials/mailcow-dockerized/

Same problem.

I think it might have to do with the “Preparations” section from the howto.
I run this server in an isolated environment. DNS records are not matching etc. So i will try to setup a “real” environment to try again.

nso

you should take a look at the official up to date documentation
https://docs.mailcow.email/i_u_m/i_u_m_install/

lipunis

nso With all due respect, the link is invalid. Can you update? It’s found everywhere, but it’s empty. This is very important to me.

Ballistic

Tried again with this howto:
https://www.bennetrichter.de/en/tutorials/mailcow-dockerized/

Same problem.

DocFraggle

DId you try disabling the local firewall on your Debian host? I would start looking there

Ballistic

DocFraggle

Thanks for thinking with me on this issue.
Debian 12.2 does not have a firewall by defaultnor did I install one. I have a seperate dedicated firewall.

DocFraggle

Here’s the part where it seems to stop/fail:

mailcow/mailcow-dockerized/blob/master/data/Dockerfiles/unbound/docker-entrypoint.sh#L8-L9

echo "Receiving root hints..."
curl -#o /etc/unbound/root.hints https://www.internic.net/domain/named.cache

Maybe try the curl command from inside the unbound container wit -v and have a look at the output

Ballistic

DocFraggle

Command is performed as expected. Data downloaded and written to /etc/unbound/root.hints

Ballistic

Ok issue found.
Had my firewall setup to only allow udp/53 to my own DNS resolver.
Noticed in logs that the mailserver wanted to resolve from a whole bunch of different addresses. Allowed that and it runs!

mlcwuser

lipunis We could probably help you more if you told us why this link is important to you, but if I had to guess, I’d say it probably linked to a predecessor of this page. And please read also this and this.

And no, in case you were wondering, port 53 doesn’t need to be allowed for incoming connections, it needs to be allowed for outgoing connections, which shouldn’t normally be a problem, but can be if you are trying to install Mailcow in a restricted environment where DNS requests on port 53 are not allowed out to the Internet.

lipunis

Oh gods, I must be somewhere close:

I tried to set it up almost a year ago, and it crashed. For some reason, I thought that since 2017 they have already figured out how to solve these problems. But I have now done as it is written: https://unrouted.io/2017/08/15/docker-firewall / and this screenshot shows that the problem with the ports remains (I overloaded the ubuntu-server after all the changes)