OTBR Docker - entrypoint configuration issue

[miloit]

Problem

When trying to configure OTBR ports via docker-compose entrypoint, the container crashes in a restart loop.

Expected behavior

The sed commands should modify /etc/default/otbr-web and /etc/default/otbr-agent before services start, allowing binding to 0.0.0.0:80 and 0.0.0.0:8081 instead of 127.0.0.1.

Current behavior

entrypoint: ["/bin/bash", "-c", "sed -i 's/-a 127.0.0.1/-a 0.0.0.0/g' /etc/default/otbr-web; sed -i 's/127.0.0.1/0.0.0.0/g' /etc/default/otbr-agent; exec /app/etc/docker/border-router/setup-host --radio-url 'spinel+hdlc+uart:///dev/serial/by-id/usb-dresden_elektronik_Thread_RCP__ConBee_II__DE2665925-if00?uart-baudrate=115200'"]

Results in:

• sed: can't read /etc/default/otbr-web: No such file or directory
• Setup-host loops infinitely
• Container crashes and restarts

Workaround

Using docker exec after container start works:

docker exec otbr sed -i 's/-a 127.0.0.1/-a 0.0.0.0/g' /etc/default/otbr-web
docker exec otbr service otbr-web restart

Question

Why can't the config be modified via entrypoint before services initialize? Is there a proper way to configure OTBR ports in docker-compose?

[jwhui]

Why this happens

1. The container uses s6-overlay (/init) as its entrypoint:
   The OTBR Docker image relies on s6-overlay as its process supervisor (ENTRYPOINT ["/init"]). Overriding entrypoint with /bin/bash -c ... prevents /init from executing, so the supervisor and background services (otbr-agent, otbr-web, mDNS) are never started.

2. setup-host is meant for the host machine, not container execution:
   The setup-host script is intended to be executed on the Linux host machine prior to launching Docker to configure host kernel parameters (e.g., IPv4/IPv6 packet forwarding and accept_ra). Running it inside the container does not start any OTBR daemons and exits immediately, causing the container restart loop.

3. Docker does not use /etc/default/otbr-*:
   /etc/default/otbr-agent and /etc/default/otbr-web are used in traditional Debian/systemd package installations. In Docker, configuration is passed directly via environment variables to the service definitions in /etc/s6-overlay/s6-rc.d/.

---

The Proper Way: Configure via Environment Variables

The OTBR container scripts natively read the listening addresses, ports, interfaces, and RCP configuration from environment variables. You do not need any custom entrypoint or sed commands.

Relevant Environment Variables

Variable	Description	Default
OT_RCP_DEVICE	Connection string for your RCP radio	spinel+hdlc+uart:///dev/ttyACM0?uart-baudrate=1000000
OT_WEB_LISTEN_ADDR	Bind address for otbr-web	127.0.0.1
OT_WEB_LISTEN_PORT	Port for otbr-web	8080
OT_REST_LISTEN_ADDR	Bind address for otbr-agent REST API	127.0.0.1
OT_REST_LISTEN_PORT	Port for otbr-agent REST API	8081
OT_INFRA_IF	Host infrastructure network interface (e.g., eth0, wlan0)	wlan0
OT_THREAD_IF	Thread network interface inside the container	wpan0
OT_LOG_LEVEL	Log level (0–7)	7

---

Example docker-compose.yml

services:
  otbr:
    image: openthread/border-router:latest
    container_name: otbr
    restart: unless-stopped
    network_mode: host
    privileged: true
    devices:
      - /dev/serial/by-id/usb-dresden_elektronik_Thread_RCP__ConBee_II__DE2665925-if00:/dev/radio
      - /dev/net/tun:/dev/net/tun
    environment:
      - OT_RCP_DEVICE=spinel+hdlc+uart:///dev/radio?uart-baudrate=115200
      - OT_INFRA_IF=eth0               # Change to your host interface (e.g., eth0 or wlan0)
      - OT_THREAD_IF=wpan0
      - OT_WEB_LISTEN_ADDR=0.0.0.0     # Bind Web UI to all interfaces
      - OT_WEB_LISTEN_PORT=80          # Or 8080 (make sure port 80 is free on the host)
      - OT_REST_LISTEN_ADDR=0.0.0.0    # Bind REST API to all interfaces
      - OT_REST_LISTEN_PORT=8081

Note on Host Configuration: Ensure you run setup-host once on your host OS (not inside the container) so the host kernel allows IPv6 forwarding and router advertisements:

curl -sSL https://raw.githubusercontent.com/openthread/ot-br-posix/refs/heads/main/etc/docker/border-router/setup-host | INFRA_IF_NAME=eth0 sudo bash

Hope that helps.