Frank
065a6911f9
Three stacked lessons, each proved live 2026-10-21:
- the image's ENTRYPOINT is /bin/blackbox_exporter, so Exec= repeating the
binary made it a positional arg: 'unexpected /bin/blackbox_exporter'.
- the podman gateway 169.254.1.2 is NOT bindable from the host netns - it
exists only inside each rootless netns: 'bind: cannot assign requested
address'. The scrape path does not need it bound: a bridge container
dialing the gateway lands on the host LOOPBACK (proved 200 from the
prometheus container), so the exporter binds 127.0.0.1 + LAN.
- HealthCmd shell form ('/bin/sh -c "..."') is passed as one quoted token
and quadlet folds the following --health-interval/--health-retries (and
the image) into the command string; the plain exec form the sibling units
use is correct.
Prometheus.md bind law corrected (gateway is a forward-to-loopback, not a
bind address); deploy-remote gate stays loopback, which is now honest.
57 lines
2.8 KiB
INI
57 lines
2.8 KiB
INI
# Quadlet unit: blackbox exporter (rootless, host network, boot-persistent).
|
|
#
|
|
# Install path on dankclaw:
|
|
# ~/.config/containers/systemd/blackbox-exporter.container
|
|
#
|
|
# WHY Network=host. The probes it runs are (a) the host's own LAN IP
|
|
# (192.168.0.143:8081 SearXNG, :3005 OpenWebUI — host-process/portmap binds a
|
|
# bridge container cannot reach; netavark DNATs published ports only, see
|
|
# Container Host Reachability in the vault) and (b) ComfyUI's published port
|
|
# via 127.0.0.1 (rootless --network=host shares the real host netns, so the
|
|
# 0.0.0.0:8188 publish answers on loopback). A bridge-networked prober could
|
|
# reach neither class reliably.
|
|
#
|
|
# WHY the listener binds 127.0.0.1 + LAN. A bridge container CANNOT dial
|
|
# its own host's LAN IP (netavark hairpin gap, measured 2026-10-21), but a
|
|
# bridge container dialing the podman gateway 169.254.1.2 lands on the host
|
|
# LOOPBACK — that is the scrape path, and it needs this exporter to be
|
|
# LISTENING ON LOOPBACK (proved: 200 from the prometheus container to
|
|
# http://169.254.1.2:9115/-/healthy with a loopback bind). The gateway
|
|
# address itself is NOT bindable from the host netns — it exists only
|
|
# inside each rootless netns; binding it dies "bind: cannot assign
|
|
# requested address" (live 2026-10-21). The LAN bind stays for diagnostics.
|
|
# No public DNS name, no guard chain: internal net only, per the exposure
|
|
# policy. The listen flag is --web.listen-address and it is REPEATABLE, one
|
|
# flag per bind; plain --listen-address does not exist and the exporter
|
|
# exits in 100 ms with "unknown long flag" (live 2026-10-21).
|
|
|
|
[Unit]
|
|
Description=Blackbox exporter (HTTP probe prober)
|
|
After=network-online.target
|
|
|
|
[Container]
|
|
Image=docker.io/prom/blackbox-exporter@sha256:ea1c7aa3ef3f307cd03e85f34abb604478ccb90b567fc690da0cd9776da76b13
|
|
ContainerName=blackbox-exporter
|
|
Network=host
|
|
# The image's ENTRYPOINT is /bin/blackbox_exporter itself (proved live
|
|
# 2026-10-21: `podman run IMAGE sh` dies "unexpected sh"), so Exec= carries
|
|
# FLAGS ONLY — repeating the binary makes it a positional arg and kingpin
|
|
# exits "unexpected /bin/blackbox_exporter".
|
|
Exec=--config.file=/etc/blackbox_exporter/config.yml --web.listen-address=127.0.0.1:9115 --web.listen-address=192.168.0.143:9115
|
|
Volume=/opt/blackbox/blackbox.yml:/etc/blackbox_exporter/config.yml:ro
|
|
# Plain exec form like every sibling unit. Shell form (`/bin/sh -c "…"`)
|
|
# is passed as one quoted token and quadlet then folds the following
|
|
# --health-interval/--health-retries (and the image name) into the command
|
|
# string — unit died twice that way, live 2026-10-21. wget only; this
|
|
# busybox variant has no curl, and host-network wget answers on loopback.
|
|
HealthCmd=wget -q -O /dev/null http://127.0.0.1:9115/-/healthy
|
|
HealthInterval=30s
|
|
HealthRetries=3
|
|
|
|
[Service]
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=default.target
|