Container unhealthy

[zkvvoob]

Hello,

I can see that the container has the following healthcheck configured:

HEALTHCHECK --interval=5s --timeout=2s --start-period=5s \
    CMD if [ $(curl http://localhost:3000 -s --write-out "%{http_code}") = "401" ]; then exit 0; else exit 1; fi

My /adguard-sync/etc/config.yaml looks like this:

# cron expression to run in daemon mode. (default; "" = runs only once)
cron: "*/10 * * * *"
runOnStart: true
continueOnError: false

origin:
  # url of the origin instance
  url: http://adguard:3000
  username: adguard-master
  password: password

# replicas instances (optional, if more than one)
replicas:
  - url: http://192.168.1.202:3000
    username: adguard-sync
    password: adguard-sync

# Configure the sync API server, disabled if api port is 0
api:
  port: 3000
  username: admin
  password: adguard
  darkMode: true
  metrics:
    enabled: true
    scrapeInterval: 10s
    queryLogLimit: 10000

features:
  generalSettings: true
  queryLogConfig: true
  statsConfig: true
  clientSettings: true
  services: true
  filters: true
  dhcp:
    serverConfig: true
    staticLeases: true
  dns:
    serverConfig: true
    accessLists: true
    rewrites: true

and this is the compose.yaml:

name: adguard
services:
  adguard:
    image: "quay.io/11notes/adguard:0"
    read_only: true
    container_name: "adguard"
    restart: "always"
    volumes:
      - "/mnt/apps/adguard/workingdir:/adguard/var"
      - "/mnt/apps/adguard/config:/adguard/etc"
    environment:
      TZ: "Europe/Berlin"
    tmpfs:
      # tmpfs volume because of read_only: true
      - "/adguard/run:uid=1000,gid=1000"
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "3000:3000/tcp"
    networks:
      my_network:
    sysctls:
      # allow rootless container to access ports < 1024
      net.ipv4.ip_unprivileged_port_start: 53

  adguard-sync:
    image: "quay.io/11notes/adguard-sync:0"
    container_name: adguard-sync
    read_only: true
    environment:
      TZ: "Europe/Sofia"
    volumes:
      - "/mnt/apps/adguard/sync:/adguard-sync/etc"
    ports:
      - "8082:3000/tcp"
    restart: "always"
    depends_on:
      adguard:
        condition: "service_healthy"
        restart: true
    networks:
      my_network:

networks:
  my_network:

As far as I can see, I haven't deviated significantly from your instructions – and yet, the Adguard Sync container appears as unhealthy.

Could you help me figure out what's causing this, please?

[11notes]

Use the latest version of the image, I've added a custom health check in 7ded7c9 check with an upstream PR.

[zkvvoob]

Thank you for taking the time to look into this problem, @11notes !

I just recreated the whole stack, but the Adguard Sync container still appears as Unhealth:

To be sure, I tried pulling by tag (0, as well as 0.7.6) and by digest (image: "quay.io/11notes/adguard-sync@sha256:14365a1b101a13076d4905b71551cd0dbc0d15f1eb830fbec7c7c88f686f3ea3" – this is the image being used for the screenshot above). Am I missing anything?

[11notes]

If the status with the latest image is unhealthy, that means your adguard-sync can’t sync. You can check the logs for error messages. Access the adguard-sync web UI, in your case on port 8082.

[zkvvoob]

Thank you, @11notes! There are no more warnings in the logs...

2025-07-09T07:49:34.898+0300	INFO	sync	sync/sync.go:44	AdGuardHome sync	{"version": "0.7.6", "build": "11notes/adguard-sync", "os": "linux", "arch": "amd64"}
2025-07-09T07:49:34.898+0300	INFO	sync	sync/sync.go:69	Setup cronjob	{"cron": "*/10 * * * *", "next-execution": "2025-07-09T07:50:00.000+0300"}
2025-07-09T07:49:34.898+0300	INFO	sync	sync/http.go:100	Starting API server	{"port": 3000}
2025-07-09T07:49:34.898+0300	INFO	sync	sync/sync.go:91	Running sync on startup
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "avg_processing_time"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "num_dns_queries"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "num_blocked_filtering"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "num_replaced_parental"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "num_replaced_safebrowsing"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "num_replaced_safesearch"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "top_queried_domains"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "top_blocked_domains"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "top_clients"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "query_types"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "running"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "protection_enabled"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "sync_duration_seconds"}
2025-07-09T07:49:34.898+0300	INFO	metrics	metrics/metrics.go:175	New Prometheus metric registered	{"name": "sync_successful"}
2025-07-09T07:49:34.898+0300	INFO	sync	sync/scrape.go:21	setup metrics	{"scrape-interval": "10s", "query-log-limit": 10000}
2025-07-09T07:49:34.948+0300	INFO	sync	sync/sync.go:202	Connected to origin	{"from": "adguard:3000", "version": "0.107.63"}
2025-07-09T07:49:35.824+0300	INFO	sync	sync/sync.go:295	Start sync	{"from": "adguard:3000", "to": "10.0.0.88:3000"}
2025-07-09T07:49:35.843+0300	INFO	sync	sync/sync.go:319	Connected to replica	{"from": "adguard:3000", "to": "10.0.0.88:3000", "version": "0.107.63"}
2025-07-09T07:49:36.095+0300	INFO	sync	sync/sync.go:305	Sync done	{"from": "adguard:3000", "to": "10.0.0.88:3000", "duration": "3.7e-07s"}
2025-07-09T07:50:00.051+0300	INFO	sync	sync/sync.go:202	Connected to origin	{"from": "adguard:3000", "version": "0.107.63"}
2025-07-09T07:50:00.766+0300	INFO	sync	sync/sync.go:295	Start sync	{"from": "adguard:3000", "to": "10.0.0.88:3000"}
2025-07-09T07:50:00.785+0300	INFO	sync	sync/sync.go:319	Connected to replica	{"from": "adguard:3000", "to": "10.0.0.88:3000", "version": "0.107.63"}
2025-07-09T07:50:01.013+0300	INFO	sync	sync/sync.go:305	Sync done	{"from": "adguard:3000", "to": "10.0.0.88:3000", "duration": "1.31e-07s"}

but the container is still listed as unhealth. 😢

[11notes]

When you access curl -kILs --fail http://adguard-sync:8082/healthz what HTTP status do you get? You can also check http://adguard:3000/api/v1/status, which shows the status of the sync, and it should read "success" everywhere, does it show that?

[11notes]

My bad, the health check was too agressive and the custom health provider did not respond to HEAD, only GET. Fixed now in latest vesrion https://github.com/11notes/docker-adguard-sync/releases/tag/v1.3.2.

[zkvvoob]

Thank you so much, @11notes ! The container appears as healthy now.

[11notes]

Thank you for highlighting the issue.