# Error: "unable to load environment" in docker container inside wsl

**URL:** <https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137>\
**Category:** zrok\
**Created:** [September 13, 2024, 4:32pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137 "2024-09-13T16:32:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jp17711](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/jp17711/32/2455_2.png) [@jp17711](https://openziti.discourse.group/u/jp17711)\
**Post date:** [September 13, 2024, 4:32pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137/1 "2024-09-13T16:32:02Z")

</div>

Hi, I'm running a docker container inside **wsl ubuntu** on windows 10, and I am logged in as root user.  
I have a compose.yaml with 3 services (web, postgres and nginx), I try to integrate zrok inside the container but I get the error **"unable to load environment; did you 'zrok enable'?"**.  
I am following the guide [Getting Started with Docker | Zrok](https://docs.zrok.io/docs/guides/docker-share/#permanent-public-share)  
This is my compose.yaml

 ![compose_capture](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/0/08578757f4a132f493d81fc274a4a54e11411c27.jpeg)

If I run the command

> zrok share reserved "demo" --headless

in a console, it works without errors

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 13, 2024, 5:03pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137/2 "2024-09-13T17:03:35Z")

</div>

Hi @jp17711, welcome to the community and to zrok (and OpenZiti and BrowZer)!

I tried it out real quick on my wsl/ubuntu and can confirm I also get the issue. It looks to me that the problem is going to be with the rootless container and permissions to the zrok folder. I'll give it a whirl on my side and see i can get something working. I'll reply back in a bit.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 13, 2024, 5:43pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137/3 "2024-09-13T17:43:06Z")

</div>

Ok. I see some options.

#### Option 1 - by far the easiest.

I think the easiest thing to do for right now is to run the zrok container as root, if you want... It defeats the purpose of running a rootless container though... but you might not care too much.

```auto
services:
  zrok:
    image: openziti/zrok
    restart: unless-stopped
    user: "root"
    volumes:
      - ${HOME}/.zrok:/root/.zrok
    environment:
      PFXLOG_NO_JSON: "true"
    command: share public 192.168.253.239:9090 --headless

```

#### Option 2 - grant "others" read/execute access to your $HOME/.zrok folder

Doesn't feel like a great answer but it'll work... This let's others read and exec into your directory... The identities in here are 'secrets' so I don't love this approach

```auto
chmod -R 705 $HOME/.zrok

```

#### Option 3 - most complex

Make a new group for zrok, add your user to the group, chown the .zrok home directory to the zrok group

```auto
sudo groupadd -g 2171 zrok_group
sudo useradd -u 2171 -g 2171 -M -s /usr/sbin/nologin zrok
sudo usermod -aG zrok_group $USER
chmod -R g+rx $HOME/.zrok
chgrp -R zrok_group $HOME/.zrok

```

and use user 2171:

```auto
services:
  zrok:
    image: openziti/zrok
    restart: unless-stopped
    user: "2171"
    volumes:
      - ${HOME}/.zrok:/home/ziggy/.zrok
    environment:
      PFXLOG_NO_JSON: "true"
    command: share public 192.168.253.239:9090 --headless

```

* * *

@qrkourier - is this what you had in mind for people? Is there something easier that I'm missing?

---

<div class="post-metadata">

**Author:** ![jp17711](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/jp17711/32/2455_2.png) [@jp17711](https://openziti.discourse.group/u/jp17711)\
**Post date:** [September 13, 2024, 7:03pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137/4 "2024-09-13T19:03:43Z")

</div>

Thank you very much, I am surprised by the speed of response. 😁

I changed **${UID}** to **root** , but now it gives me the error **zrok/endpoints/proxy.newReverseProxy.func2: proxying error: dial tcp [::1]:49152: connect: connection refused**

compose.yaml

 ![compose_capture_1](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/3/367c503633cd0f2a1448e5d96e52b238a7335b11.jpeg)

What I expect is that the container runs the reserved subdomain, as shown in the guide [Getting Started with Docker | Zrok](https://docs.zrok.io/docs/guides/docker-share/#permanent-public-share).

I reserve a subdomain from a wsl console

> zrok reserve public --unique-name "demo" [https://localhost:49152](https://localhost:49152)

and then in the container I run the subdomain, as shown in compose.yaml

> command: share reserved "demo" --headless.

It might be important to say that I installed zrok inside wsl and am running it from there.  
I also have Docker Desktop installed on Windows 10.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 13, 2024, 7:18pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137/5 "2024-09-13T19:18:19Z")

</div>

> **proxying error: dial tcp [::1]:49152: connect: connection refused**

I expect you have created your reserved share with "localhost"? It's easy to forget that the network within docker is different and has different rules. I expect what you actually want was to reference nginx.

Looking back at your ports for `nginx` I can see: `- '49152:80'`... You can't use "localhost" in this situation. Instead, you want to `zrok share` a url that's relative to the zrok container. In your case, I would think you'd want to `zrok reserve share public nginx:80` (not "localhost:49152").

Does that make sense? I'm expecting you're exporting port 49152 so your LOCAL machine can also access nginx but if you wanted to, you could actually turn off that exported port and have no exposed ports into your docker environment... (i think that's pretty darn cool) 🙂

Hopefully that all makes sense.

---

<div class="post-metadata">

**Author:** ![jp17711](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/jp17711/32/2455_2.png) [@jp17711](https://openziti.discourse.group/u/jp17711)\
**Post date:** [September 13, 2024, 7:51pm UTC](https://openziti.discourse.group/t/error-unable-to-load-environment-in-docker-container-inside-wsl/3137/6 "2024-09-13T19:51:20Z")

</div>

Yes, I was going the wrong way. Thank you very much, it works perfectly now.