so-docker-prune causing tail end of SOUP to fail.

[brutal-dismount]

I haven't had any problems running soup in the past. With "souping" to the latest version 2.4.141 the tail end of errors out with

Salt Master does not need unlocked.
Soup failed with error 1: Unhandled error
Unhandled error occured, please check /root/soup.log for details.

Looking at the soup.log, the last command run is so-docker-prune

ID: prune_images
    Function: cmd.run
        Name: so-docker-prune
      Result: False
     Comment: Command "so-docker-prune" run
     Started: 14:20:55.999342
    Duration: 2139.148 ms
     Changes:   
              ----------
              pid:
                  4062023
              retcode:
                  1
              stderr:
                  Traceback (most recent call last):
                    File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 633, in send
                      conn = self.get_connection_with_tls_context(
                    File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 489, in get_connection_with_tls_context
                      conn = self.poolmanager.connection_from_host(
                    File "/usr/lib/python3.9/site-packages/urllib3/poolmanager.py", line 246, in connection_from_host
                      return self.connection_from_context(request_context)
                    File "/usr/lib/python3.9/site-packages/urllib3/poolmanager.py", line 258, in connection_from_context
                      raise URLSchemeUnknown(scheme)
                  urllib3.exceptions.URLSchemeUnknown: Not supported URL scheme http+docker
                  
                  During handling of the above exception, another exception occurred:
                  
                  Traceback (most recent call last):
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 214, in _retrieve_server_version
                      return self.version(api_version=False)["ApiVersion"]
                    File "/usr/lib/python3.9/site-packages/docker/api/daemon.py", line 181, in version
                      return self._result(self._get(url), json=True)
                    File "/usr/lib/python3.9/site-packages/docker/utils/decorators.py", line 46, in inner
                      return f(self, *args, **kwargs)
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 237, in _get
                      return self.get(url, **self._set_request_timeout(kwargs))
                    File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 602, in get
                      return self.request("GET", url, **kwargs)
                    File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 589, in request
                      resp = self.send(prep, **send_kwargs)
                    File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 703, in send
                      r = adapter.send(request, **kwargs)
                    File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 637, in send
                      raise InvalidURL(e, request=request)
                  requests.exceptions.InvalidURL: Not supported URL scheme http+docker
                  
                  During handling of the above exception, another exception occurred:
                  
                  Traceback (most recent call last):
                    File "/sbin/so-docker-prune", line 94, in <module>
                      main(args.quiet)
                    File "/sbin/so-docker-prune", line 40, in main
                      client = docker.from_env()
                    File "/usr/lib/python3.9/site-packages/docker/client.py", line 96, in from_env
                      return cls(
                    File "/usr/lib/python3.9/site-packages/docker/client.py", line 45, in __init__
                      self.api = APIClient(*args, **kwargs)
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 197, in __init__
                      self._version = self._retrieve_server_version()
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 221, in _retrieve_server_version
                      raise DockerException(
                  docker.errors.DockerException: Error while fetching server API version: Not supported URL scheme http+docker
              stdout:

Running so-docker-prune outside of soup gets me the same error message. Any ideas on where I could start to look for the issue here?

[rh-ops]

Try running so-docker-refresh, then so-checkin, and then try to soup it again.

[brutal-dismount]

so-docker-refresh runs without issue
so-checkin runs for about a few minutes then errors out on the same message as above.

Anything else I can try to resolve the issue?

ID: prune_images
    Function: cmd.run
        Name: so-docker-prune
      Result: False
     Comment: Command "so-docker-prune" run
     Started: 14:40:16.439492
    Duration: 459.906 ms
     Changes:   
              ----------
              pid:
                  499849
              retcode:
                  1
              stderr:
                  Traceback (most recent call last):
                    File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 633, in send
                      conn = self.get_connection_with_tls_context(
                    File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 489, in get_connection_with_tls_context
                      conn = self.poolmanager.connection_from_host(
                    File "/usr/lib/python3.9/site-packages/urllib3/poolmanager.py", line 246, in connection_from_host
                      return self.connection_from_context(request_context)
                    File "/usr/lib/python3.9/site-packages/urllib3/poolmanager.py", line 258, in connection_from_context
                      raise URLSchemeUnknown(scheme)
                  urllib3.exceptions.URLSchemeUnknown: Not supported URL scheme http+docker
                  
                  During handling of the above exception, another exception occurred:
                  
                  Traceback (most recent call last):
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 214, in _retrieve_server_version
                      return self.version(api_version=False)["ApiVersion"]
                    File "/usr/lib/python3.9/site-packages/docker/api/daemon.py", line 181, in version
                      return self._result(self._get(url), json=True)
                    File "/usr/lib/python3.9/site-packages/docker/utils/decorators.py", line 46, in inner
                      return f(self, *args, **kwargs)
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 237, in _get
                      return self.get(url, **self._set_request_timeout(kwargs))
                    File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 602, in get
                      return self.request("GET", url, **kwargs)
                    File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 589, in request
                      resp = self.send(prep, **send_kwargs)
                    File "/usr/local/lib/python3.9/site-packages/requests/sessions.py", line 703, in send
                      r = adapter.send(request, **kwargs)
                    File "/usr/local/lib/python3.9/site-packages/requests/adapters.py", line 637, in send
                      raise InvalidURL(e, request=request)
                  requests.exceptions.InvalidURL: Not supported URL scheme http+docker
                  
                  During handling of the above exception, another exception occurred:
                  
                  Traceback (most recent call last):
                    File "/sbin/so-docker-prune", line 94, in <module>
                      main(args.quiet)
                    File "/sbin/so-docker-prune", line 40, in main
                      client = docker.from_env()
                    File "/usr/lib/python3.9/site-packages/docker/client.py", line 96, in from_env
                      return cls(
                    File "/usr/lib/python3.9/site-packages/docker/client.py", line 45, in __init__
                      self.api = APIClient(*args, **kwargs)
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 197, in __init__
                      self._version = self._retrieve_server_version()
                    File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 221, in _retrieve_server_version
                      raise DockerException(
                  docker.errors.DockerException: Error while fetching server API version: Not supported URL scheme http+docker
              stdout:

[reyesj2]

Is this a network install? What OS are you running on?

cat /etc/os-release

[brutal-dismount]

This is a standard installation from the 2.4 iso.

[so-admin@so-mgr ~]$ cat /etc/os-release
NAME="Oracle Linux Server"
VERSION="9.5"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="9.5"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Oracle Linux Server 9.5"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:9:5:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://github.com/oracle/oracle-linux"

ORACLE_BUGZILLA_PRODUCT="Oracle Linux 9"
ORACLE_BUGZILLA_PRODUCT_VERSION=9.5
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=9.5

[reyesj2]

It looks like you might have an old python version?

type -a python
type -a python3

python --version
python3 --version

[reyesj2]

Can you also show what your /nsm/repo permissions are?

ls -l /nsm/

should be socore:socore

[brutal-dismount]

It's an older version, but not terribly old.
permissions on /nsm/repo check out as well.

[root@so-mgr so-admin]# type -a python
python is /bin/python
python is /usr/bin/python
[root@so-mgr so-admin]# type -a python3
python3 is /bin/python3
python3 is /usr/bin/python3
[root@so-mgr so-admin]# python --version
Python 3.9.21
[root@so-mgr so-admin]# python3 --version
Python 3.9.21

[root@so-mgr nsm]# ls -l /nsm/
total 184
drwx------. 4 root          root     4096 Apr 24 00:01 backup
drwxr-xr-x. 2 elastic-fleet socore      6 Mar 12 16:40 custom-mappings
drwxr-xr-x. 3 root          root       20 Jul  5  2024 docker-registry
drwxr-xr-x. 3 root          root       23 Jul  5  2024 elastic-fleet
drwxr-xr-x. 6 elasticsearch socore     99 Apr 24 19:31 elasticsearch
drwxr-xr-x. 2 logstash      socore      6 Jul  5  2024 import
drwx------. 3 so-admin      root       62 Jul  5  2024 influxdb
drwx------. 3 kratos        kratos     16 Jul  5  2024 kratos
drwxr-xr-x. 5 logstash      socore     80 Jul  5  2024 logstash
drwxr-xr-x. 2 root          root        6 Jul  5  2024 pcap
drwxr-xr-x. 2 root          root        6 Jul  5  2024 pcapout
drwxr-xr-x. 3 socore        socore     18 Jul  5  2024 redis
drwxr-xr-x. 3 socore        socore 139264 Apr 24 03:54 repo
drwxr-xr-x. 8 socore        socore    122 Mar 12 16:12 rules
drwxr-xr-x. 5 root          root       87 Oct 15  2024 securityonion-resources
drwxr-xr-x. 4 socore        socore     33 Jul  5  2024 soc
drwxr-xr-x. 2 root          root        6 Jul  5  2024 suripcap

[Lighar]

Hi,
Any update on the issue ? I have the exact same one on my side with a classic install on VMWare ESXi.
I have the same answer that @brutal-dismount have when trying so-docker-refresh and so-checkin.

Here are my os and python version :

[aa@securityonion ~]$ cat /etc/os-release
NAME="Oracle Linux Server"
VERSION="9.6"
ID="ol"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="9.6"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Oracle Linux Server 9.6"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:oracle:linux:9:6:server"
HOME_URL="https://linux.oracle.com/"
BUG_REPORT_URL="https://github.com/oracle/oracle-linux"

ORACLE_BUGZILLA_PRODUCT="Oracle Linux 9"
ORACLE_BUGZILLA_PRODUCT_VERSION=9.6
ORACLE_SUPPORT_PRODUCT="Oracle Linux"
ORACLE_SUPPORT_PRODUCT_VERSION=9.6
[aa@securityonion ~]$ type -a python
type -a python3

python --version
python3 --version
python is /usr/bin/python
python3 is /usr/bin/python3
Python 3.9.21
Python 3.9.21

Thanks

[TOoSmOotH]

We have identified the issue and are planning on a hotfix to address. Issue is here: #14647

[Lighar]

Thanks for the reply, I will wait for the hotfix then.

[vaschthestampede]

Just for information I have the same error installing from scratch, both with 2.4.150 and 2.4.141.

[dougburks]

Security Onion 2.4.150 Hotfix 20250522 now available!
https://blog.securityonion.net/2025/05/security-onion-24150-hotfix-20250522.html

[brutal-dismount]

Fantastic. I will give the hotfix a try this evening.

[Lighar]

Thanks for the hotfix !

I tried to update with sudo soup and I am now up to date :

Found that Security Onion 2.4.150 is currently installed.

Cloning Security Onion github repo into /tmp/sogh/securityonion.
Removing previous upgrade sources.
Cloning the Security Onion Repo.
Cloning into 'securityonion'...
remote: Enumerating objects: 99113, done.
remote: Counting objects: 100% (527/527), done.
remote: Compressing objects: 100% (124/124), done.
remote: Total 99113 (delta 473), reused 414 (delta 403), pack-reused 98586 (from 4)
Receiving objects: 100% (99113/99113), 56.09 MiB | 11.02 MiB/s, done.
Resolving deltas: 100% (66524/66524), done.
Verifying we have the latest soup script.
This version of the soup script is up to date. Proceeding.
Let's see if we need to update Security Onion.
Checking to see if there are hotfixes needed
You are already running the latest version of Security Onion. 

But it seems that I still have the same error :

[ERROR   ] Command 'so-docker-prune' failed with return code: 1
[ERROR   ] stderr: Traceback (most recent call last):
[ERROR   ] retcode: 1
[ERROR   ] {'pid': 72888, 'retcode': 1, 'stdout': '', 'stderr': 'Traceback (most recent call last):\n  File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 583, in send\n    conn = self.get_connection_with_tls_context(\n  File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 456, in get_connection_with_tls_context\n    conn = self.poolmanager.connection_from_host(\n  File "/usr/lib/python3.9/site-packages/urllib3/poolmanager.py", line 246, in connection_from_host\n    return self.connection_from_context(request_context)\n  File "/usr/lib/python3.9/site-packages/urllib3/poolmanager.py", line 258, in connection_from_context\n    raise URLSchemeUnknown(scheme)\nurllib3.exceptions.URLSchemeUnknown: Not supported URL scheme http+docker\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 214, in _retrieve_server_version\n    return self.version(api_version=False)["ApiVersion"]\n  File "/usr/lib/python3.9/site-packages/docker/api/daemon.py", line 181, in version\n    return self._result(self._get(url), json=True)\n  File "/usr/lib/python3.9/site-packages/docker/utils/decorators.py", line 46, in inner\n    return f(self, *args, **kwargs)\n  File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 237, in _get\n    return self.get(url, **self._set_request_timeout(kwargs))\n  File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 557, in get\n    return self.request(\'GET\', url, **kwargs)\n  File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 544, in request\n    resp = self.send(prep, **send_kwargs)\n  File "/usr/lib/python3.9/site-packages/requests/sessions.py", line 657, in send\n    r = adapter.send(request, **kwargs)\n  File "/usr/lib/python3.9/site-packages/requests/adapters.py", line 587, in send\n    raise InvalidURL(e, request=request)\nrequests.exceptions.InvalidURL: Not supported URL scheme http+docker\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File "/sbin/so-docker-prune", line 94, in <module>\n    main(args.quiet)\n  File "/sbin/so-docker-prune", line 40, in main\n    client = docker.from_env()\n  File "/usr/lib/python3.9/site-packages/docker/client.py", line 96, in from_env\n    return cls(\n  File "/usr/lib/python3.9/site-packages/docker/client.py", line 45, in __init__\n    self.api = APIClient(*args, **kwargs)\n  File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 197, in __init__\n    self._version = self._retrieve_server_version()\n  File "/usr/lib/python3.9/site-packages/docker/api/client.py", line 221, in _retrieve_server_version\n    raise DockerException(\ndocker.errors.DockerException: Error while fetching server API version: Not supported URL scheme http+docker'}
      Result: False

Should I update by downloading the iso again ?
Thanks

[dougburks]

@Lighar What is the output of the following commands?

cat /etc/soversion

cat /etc/sohotfix

md5sum /usr/sbin/so-docker-prune

[Lighar]

Here is the output :

[aa@securityonion ~]$ cat /etc/soversion
2.4.150
[aa@securityonion ~]$ cat /etc/sohotfix
20250522
[aa@securityonion ~]$ md5sum /usr/sbin/so-docker-prune
c7ccfe0ea77e1b3347173a431501cd68  /usr/sbin/so-docker-prune