Fulltextsearch with AIO on Synology no longer compatible?

[rendam]

Just updated my AIO containers using the latest branch (Nextcloud 30) and had Imaginary and Fulltextsearch addons enabled through the AIO interface. This setup worked without issues until yesterday and now the fulltextsearch container does not start up due to missing seccomp feature of the Synology DSM kernel.

Is there some way to disable this (Somehow it should be possible to disable this on elasticsearch's end but i could not find a way for the containter to recognize this)?
Or where should i file an issue for that matter, cause the AIO container seems to be something different than https://github.com/nextcloud/fulltextsearch?

The log shows:

2024/12/17 17:11:39	stderr	ERROR: Elasticsearch died while starting up, with exit code 1
2024/12/17 17:11:39	stderr	
2024/12/17 17:11:39	stderr	ERROR: Elasticsearch did not exit normally - check the logs at /usr/share/elasticsearch/logs/nextcloud-aio.log
2024/12/17 17:11:39	stdout	{"@timestamp":"2024-12-17T16:11:39.547Z", "log.level":"ERROR", "message":"fatal exception while booting Elasticsearch", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.bootstrap.Elasticsearch","elasticsearch.node.name":"fe1e99cb4a59","elasticsearch.cluster.name":"nextcloud-aio","error.type":"java.lang.UnsupportedOperationException","error.message":"seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed","error.stack_trace":"java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed\n\tat [email protected]/org.elasticsearch.nativeaccess.LinuxNativeAccess.tryInstallExecSandbox(LinuxNativeAccess.java:255)\n\tat [email protected]/org.elasticsearch.bootstrap.Elasticsearch.initializeNatives(Elasticsearch.java:296)\n\tat [email protected]/org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:169)\n\tat [email protected]/org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:74)\n"}
2024/12/17 17:11:39	stdout	{"@timestamp":"2024-12-17T16:11:39.540Z", "log.level": "INFO", "message":"Using [jdk] native provider and native methods for [Linux]", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.nativeaccess.NativeAccess","elasticsearch.node.name":"fe1e99cb4a59","elasticsearch.cluster.name":"nextcloud-aio"}
2024/12/17 17:11:39	stdout	{"@timestamp":"2024-12-17T16:11:39.474Z", "log.level": "INFO", "message":"Using native vector library; to disable start with -Dorg.elasticsearch.nativeaccess.enableVectorLibrary=false", "ecs.version": "1.2.0","service.name":"ES_ECS","event.dataset":"elasticsearch.server","process.thread.name":"main","log.logger":"org.elasticsearch.nativeaccess.NativeAccess","elasticsearch.node.name":"fe1e99cb4a59","elasticsearch.cluster.name":"nextcloud-aio"}
2024/12/17 17:11:37	stdout	CompileCommand: dontinline java/lang/invoke/MethodHandle.asTypeUncached bool dontinline = true
2024/12/17 17:11:37	stdout	CompileCommand: dontinline java/lang/invoke/MethodHandle.setAsTypeCache bool dontinline = true 

And disabling this should be possible with one of the 2 env vars (bootstrap.system_call_filter) like here

[vmpr]

I have the same problem, did you find a solution?

[rendam]

Sadly not. I had to remove the container for the time being until I find the time to dig deeper into the fulltextsearch container.
What I tried as well was completely deleting the container and data and adding it again through the AIO interface for it to start fresh. Same issue that the container won't start as the seccomp dependency seems mandatory by default.

[felix-berlin]

Have the same issue. I just removed the container for now.

[szaimen]

Hey, so if we set bootstrap.system_call_filter=false, the container will work again? Have you tested and verified this already?

[rendam]

From my testing it did not change anything. From the default env variables of the container I thought maybe i can set it this way, but the container (or more likely elasticsearch itself) seems to ignore this variable/setting and starts up requiring seccomp and then fails in the process.

[szaimen]

https://stackoverflow.com/questions/50314586/elasticsearch-fails-to-start-config-seccomp-and-config-seccomp-filter-are-neede#comment126562331_50314587 🙈

[szaimen]

So looks like elasticsearch is not working without seccomp anymore...

[rendam]

Thanks for looking into this. A real bummer that as it seems won't be possible to use that feature on a Synology in the foreseeable future. And as the fulltextsearch app now only supporting Elasticsearch I need to look into other ways to index my data.

[szaimen]

See #5775 and https://www.elastic.co/guide/en/elasticsearch/reference/8.17/bootstrap-checks-syscall-filter.html