[ZBX-26350] fping not working in Alpine Zabbix server container images Created: 2025 Apr 23  Updated: 2025 Apr 29  Resolved: 2025 Apr 28

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Packages (C)
Affects Version/s: None
Fix Version/s: None

Type: Problem report Priority: Trivial
Reporter: Blake Basom Assignee: Marks Sunins (Inactive)
Resolution: Fixed Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: PNG File image-2025-04-28-11-57-23-439.png     JPEG File screenshot1.jpg    
Team: Team I
Sprint: Sprint candidates
Story Points: 0.5

 Description   

First, let me say that I think this is similar to ZBX-26004, which has been closed, but I don't think the issue was addressed.

The issue is that fping doesn't have the suid bit set in the Alpine Zabbix server container, so ping attempts (using the standard "icmpping" Item) fail with an error like the following:

/usr/sbin/fping: can't create socket (must run as root?)

We are currently using this container: docker.io/zabbix/zabbix-server-mysql:alpine-7.0.10

But the issue appears to be with all recent Alpine server or proxy containers. And it appears that it is due to a change that was introduced in the alpine 3.16 release. Prior to that, the suid bit was set for the fping binary. In the attached file (screenshot1.jpg), you can see the difference between alpine 3.15 and 3.16.

We are able to get around this issue by setting the permissions on the fping binary (see the bottom of the issue reported here for an example), but we were thinking that this might be something that you can fix in the alpine Zabbix server and proxy containers.

 Comments   
Comment by Alexander Vladishev [ 2025 Apr 27 ]

Thank you for reporting it! I confirm this issue.

Comment by Marks Sunins (Inactive) [ 2025 Apr 28 ]

Fixes present:

Proposed solution (recommended): update used container image to latest minor version.

Related GitHub issue: 1084.

Details: By default, Linux networking subsystem has ping_group_range parameter set to allow ICMP for privileged users only. Docker will inherit sys.net parameters from the host system if none specific configuration provided. In terms of the issue, it means that default zabbix user is not capable of creating a fping socket. As mentioned in a related issue, there are numbers of workarounds, if a user can not upgrade running container image.

Workaround:

  • Type 0: Set sysctl net.ipv4.ping_group_range using /etc/sysctl.conf. Group range in which service user is allocated MUST be included. Docker documentation reference.
  • Type 1: Set sysctl net.ipv4.ping_group_range using flagged parameter. Related documentation reference.
docker run --sysctl net.ipv4.ping_group_range="<GROUP_ID_MIN> <GROUP_ID_MAX>" docker.io/zabbix/zabbix-server-mysql:alpine-7.0.10 ...
  • To allow all users run with --sysctl net.ipv4.ping_group_range flag:
docker run --sysctl net.ipv4.ping_group_range="0 2147483647" docker.io/zabbix/zabbix-server-mysql:alpine-7.0.10 ...
Generated at Sun Apr 26 18:41:29 EEST 2026 using Jira 10.3.18#10030018-sha1:5642e4ad348b6c2a83ebdba689d04763a2393cab.