Incus permissions issue on Alpine Linux

Incus
1

Hi I installed Incus on Alpine Linux as host. However incus-admin group wasn’t already created so I added it in:

$ id
uid=1000(ajit) gid=1000(ajit) groups=10(wheel),18(audio),23(input),27(video),28(netdev),1000(ajit),1001(incus-admin)

And added my user to it. However I still don’t have permissions:

$ incus list
Error: You don't have the needed permissions to talk to the incus daemon (socket path: /var/lib/incus/unix.socket)

I guess the incus-admin group id is not right as I manually added it? Thanks.

2

Welcome!

When you add a user into a new group, you need to log out, then log in again.
Or, if you do not want for some reason to re-login yet, you can use newgrp incus-admin. This command will launch a new shell with the new group enabled.

The reason why your non-root account needs to be a member of the incus-admin group, is because the Unix socket to connect to the Incus server, requires that incus-admin group membership.

In the following, the socket is not accessible by Others (---), and accessible by group incus-admin with permissions rw-.

$ ls -l /var/lib/incus/unix.socket
srw-rw---- 1 root incus-admin 0 Μαΐ  16 14:50 /var/lib/incus/unix.socket
$
3

Thanks for your response.

I get the following:

ls -l /var/lib/incus/unix.socket
srw-rw----    1 root     incus            0 May 16 23:47 /var/lib/incus/unix.socket

Does this mean I need to add to group incus instead?

4

Okay great, I added to incus group and the error is now gone. Thanks a lot!

5

According to Authorization - Incus documentation,

When interacting with Incus over the Unix socket, members of the incus-admin group will have full access to the Incus API. Those who are only members of the incus group will instead be restricted to a single project tied to their user.

If you get permission errors with some commands, you may have to switch to the incus-admin group. You can verify with incus project list on whether there are restrictions or not.

6

I see, thanks. However the incus-admin group wasn’t already created…