Cannot use SMB/NFS shares on folder used in apps/docker !!! Serious ???

[Janus0006]

After trying to resolve an issue I had after upgrading to Bluefin, I read on this forum we cannot share the mount/path used in docker/app anymore ???

Seriously ???

Example: How i'm going to insert media in my Plex folder ?
Create a share somewhere else
connect in cli (knowing CLI is not very appreciated by iXsystem, clearly mentionned when you connect)
move my file to my media folder used by Plex

No, it's impossible this is by design

 

[NugentS]

 

[NugentS]

or redesign the way you share folders.

 

[Janus0006]

Thanks for sharing this "solution"

But when you say "redesign the way I share my folder" I the case I explained, what do you suggest ?

 

[NugentS]

The issue is that a share is shared via both NFS & SMB - which is not "not allowed"
Figure out a way of nesting folders / datasets so that you share one level with NFS and perhaps more specific levels with NFS or vice versa. I am assuming this would work but have reacted with such horror to doing so that I haven't even tried

 

[Daisuke]

or redesign the way you share folders.

That’s the proper way. People complain, instead of fixing the issue early, paving the proper road for future upgrades.

 

[Daisuke]

But when you say "redesign the way I share my folder" I the case I explained, what do you suggest ?

This community is based on mutual respect, look at your OP and how to propagate your attitude. No wonder nobody is answering to you. Instead of explaining the problem, sharing your server specs and asking for guidance, you throw a fit, without understanding the root cause or even reading the iX Systems release notes, prior upgrade. Please learn how to communicate on these forums, by updating your thread title and OP content, accordingly.

That being said, please read the SMB Shares section from this thread.

 

[Matt K]

I just encountered this issue and I honestly can't think how I could redesign my share structure to follow the advice in your linked SMB Shares section... so I suppose I'll need to start a new thread and try to understand this.
Basically I have three apps that acces a given dataset.
/mnt/tank/smb - dataset that is shared by smb
/mnt/tank/smb/Movies - ro - accessed by plex/jellyfin and the like
/mnt/tank/smb/Movies - rw - accessed by Radarr.

Given that radarr needs to have write access in order to put the data in the share and smb is needed for me to manually make changes I'm not sure what I can be expected to do here...

 

[Matt K]

I just encountered this issue and I honestly can't think how I could redesign my share structure to follow the advice in your linked SMB Shares section... so I suppose I'll need to start a new thread and try to understand this.
Basically I have three apps that acces a given dataset.
/mnt/tank/smb - dataset that is shared by smb
/mnt/tank/smb/Movies - ro - accessed by plex/jellyfin and the like
/mnt/tank/smb/Movies - rw - accessed by Radarr.

Given that radarr needs to have write access in order to put the data in the share and smb is needed for me to manually make changes I'm not sure what I can be expected to do here...

Also I tend to copy my media to my laptop to prepare for trips and such which is another reason I share it via SMB. This seems like an awful lot of "hassle" for what worked just fine for me lol... but I'm sure it was a bugger for someone else.

 

[Xero7650]

This community is based on mutual respect, look at your OP and how to propagate your attitude. No wonder nobody is answering to you. Instead of explaining the problem, sharing your server specs and asking for guidance, you throw a fit, without understanding the root cause or even reading the iX Systems release notes, prior upgrade. Please learn how to communicate on these forums, by updating your thread title and OP content, accordingly.

That being said, please read the SMB Shares section from this thread.

Respectfully - I think you're being a bit scathing and condescending, its ironic that your lead off into the conversation is about mutual respect.

 

[morganL]

Respectfully - I think you're being a bit scathing and condescending, its ironic that your lead off into the conversation is about mutual respect.

There's a fine line between constructive criticism and disrespect. I don't think it was crossed.

We ask all users to provide info on the systems, read the release notes and follow the forum rules.

In this case, there is an annoying technical issue that involves data protection. No-one wants the issue to exist, but it doesn't deserve an emotional response. The forums are here to present stories of success or problems and get advice. iX is also looking for suggestions from technical experts.

What iX doesn't want to do, is hide technical issues to avoid annoying users at risk to their data.

Over use of exclamation marks is often interpreted as "shouting"... it will get responses from some people. If used, please have a thick skin.

Lets keep our dialog as positive and collaborative as we can.

 

[Matt K]

I've given some consideration to the underlying issue and I can move my media folders off of the cifs share for the most part without issue. Possibly I could even offer it as a read only cifs share to avoid the permissions issue all together. Would this be safe? I don't see why not.

However.... one of these is a movie folder that I leave for my roommate to put his art into. He's non technical and smb has been how I had him upload his movies into. Windows isn't the best at nfs share access. Do you all have any suggestions on what would be an easy way to allow a normie to put files on a share that plex/jellyfin would then have access to? I'm thinking FTP, though I am not a fan.

 

[morganL]

I've given some consideration to the underlying issue and I can move my media folders off of the cifs share for the most part without issue. Possibly I could even offer it as a read only cifs share to avoid the permissions issue all together. Would this be safe? I don't see why not.

However.... one of these is a movie folder that I leave for my roommate to put his art into. He's non technical and smb has been how I had him upload his movies into. Windows isn't the best at nfs share access. Do you all have any suggestions on what would be an easy way to allow a normie to put files on a share that plex/jellyfin would then have access to? I'm thinking FTP, though I am not a fan.

We're reviewing the risks and situation. We might change our policy since it has been annoying to many of you.

In this situation, the normie is safe. The question is whether Jellyfin (the App) can be trusted to honor the permissions/ACLs. Its probably Ok, but we have no way of validating.

If the data is not valuable and irreplaceable, and the App is well behaved, then the risk is very low. If this is the only copy of the normie's artwork and he is missing an ear (VG) or otherwise brilliant, then you might want to be careful.

We tend to set TrueNAS defaults for business/enterprise users to be safe.... its probably an overkill for homelabs. Clicking to remove Host Path safety check is not that high risk. More expert discussion will be coming soon.

 

[Matt K]

Thank you for the explanation morgan. I'm going to move everything back then. There is basically no risk to me as plex and jellyfin only have read-only access and the *arr apps only have write access to their specific categry of files as they are mounted directly to the Movies or Anime folders.

Too bad I had to get rid of the snapshot in order to make room for the copy. *sigh*

For anyone else in my same situation this is what I am using to do the copy:
sudo rsync -avr --remove-source-files /mnt/Wolverine/Media/ /mnt/Wolverine/colossus-smb
where /mnt/Wolverine/Media/ is the dataset containing all of the folders/files I want to move and /mnt/Wolverine/colossus-smb is the datashare I want them to be moved to

the remove source files is to preserve as much free space as I can while I am copying

 

[MightyMouse_616]

hi my name is jez and i am from Tasmania, i did have the same problem until i accidentally found a very slow temp bypass...... all i do is go to my SMB shear and temporary disable my SMB for that one shear while plex and syncthing come active, once they are active i go back to shear and re-enable them plex runs fine until i need to reboot trueNAS scale (i move my house around a lot) as long as i do not shutdown or reboot nas all runs fine ( yes i have apps in my ACL settings to read/wright/execute this temp solution works for me for now until real fix is found

 

[MightyMouse_616]

and no i don't use NFS shear

 

[morganL]

See this post on the Host path Validation issue.

Understanding the TrueNAS SCALE "hostPathValidation" setting

What is the “hostPathValidation” setting? With the recent release of TrueNAS SCALE "Bluefin" 22.12.1, there have been a number of reports of issues with the Kubernetes "hostPathValidation" configuration setting, and requests for clarification regarding this security measure. The...

www.truenas.com

 

[MightyMouse_616]

See this post on the Host path Validation issue.

Understanding the TrueNAS SCALE "hostPathValidation" setting

What is the “hostPathValidation” setting? With the recent release of TrueNAS SCALE "Bluefin" 22.12.1, there have been a number of reports of issues with the Kubernetes "hostPathValidation" configuration setting, and requests for clarification regarding this security measure. The...

www.truenas.com

Thank you you're completely understand now I was used to trueNAS core and had no such issue so thank you for verifying. I have read the post thank you again

 

[WI_Hedgehog]

hostPathValidation is a brilliant solution. Maybe a bit more usage documentation is needed in the GUI (the name is "kind of" cryptic, a more simplistic name might also help), however the functionality and attention to security is excellent, thank you.

People watching YouTuber entertainment videos aren't much for using Search, which is their failing, not iXsystems. Mind you I want them to succeed as do others here, but they do need to recognise their shortcoming in order to overcome it. I realize they're sensitve and tempermental and immature, but that's not my fault, and it's not at all professional on their part nor does it help them succeed in industry.

With that said, how do we help them succeed? We do want their systems to work, even if they're for hosting Steam games or Minecraft data. To that end I think the online documentation could be more accessable and stand out (it is somewhat easy to miss at the top of the page, maybe change the color of that header), and the in-GUI features causing new users grief could uses expanded help sections (though I have to give iXsystems credit again for the help system--they've done a great job).

Our goal is to help them, but they also have to put in some effort in helping themselves.

 

[morganL]

hostPathValidation is a brilliant solution. Maybe a bit more usage documentation is needed in the GUI (the name is "kind of" cryptic, a more simplistic name might also help), however the functionality and attention to security is excellent, thank you.

People watching YouTuber entertainment videos aren't much for using Search, which is their failing, not iXsystems. Mind you I want them to succeed as do others here, but they do need to recognise their shortcoming in order to overcome it. I realize they're sensitve and tempermental and immature, but that's not my fault, and it's not at all professional on their part nor does it help them succeed in industry.

With that said, how do we help them succeed? We do want their systems to work, even if they're for hosting Steam games or Minecraft data. To that end I think the online documentation could be more accessable and stand out (it is somewhat easy to miss at the top of the page, maybe change the color of that header), and the in-GUI features causing new users grief could uses expanded help sections (though I have to give iXsystems credit again for the help system--they've done a great job).

Our goal is to help them, but they also have to put in some effort in helping themselves.

We tend to play catch-up with documentation...... its not a plan, but we tend to focus on the needs of experienced users/testers for initial releases. We can get better, but this forum invaluable for correcting out shortcomings.