# External-check and chroot
**URL:** https://discourse.haproxy.org/t/external-check-and-chroot/2150
**Category:** Help!
**Created:** [February 21, 2018, 1:50pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150 "2018-02-21T13:50:32Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@mr.simonski](https://discourse.haproxy.org/u/mr.simonski)
#### Post date: [February 21, 2018, 1:50pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/1 "2018-02-21T13:50:32Z")
Hey there,
we use haproxy to do load balancing and health check on our APIs. I’m trying to use the external-check feature on haproxy 1.7 with the chroot option. It won’t work and I don’t know why:
> global
> chroot /var/lib/haproxy
> external-check
> user haproxy
> group haproxy
> …
> backend ABC
> option external-check
> external-check command /var/lib/haproxy/check.sh
> …
The /var/lib/haproxy directory looks like:
> .
> ├── bin
> │ └── bash
> ├── check.sh
> ├── dev
> │ └── log
> └── text.txt
The check.sh script does something simple like:
```
#!/bin/bash
echo "Here the args:"
echo $@ >> /text.txt
exit 0
```
When I take this configuration online haproxy is immediately assuming the APIs are offline.
Any ideas why that is so?
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [February 21, 2018, 2:27pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/2 "2018-02-21T14:27:43Z")
Considering that you are already in chroot (`/var/lib/haproxy/`), I assume the check command should just be the script:
`external-check command /check.sh`
---
### Author:  [@mr.simonski](https://discourse.haproxy.org/u/mr.simonski)
#### Post date: [February 21, 2018, 3:01pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/3 "2018-02-21T15:01:15Z")
Thanks for the message!
Yes, I also thought about that and tried it but the result is the same - haproxy does not execute the script and assumes the API is down.
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [February 21, 2018, 3:18pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/4 "2018-02-21T15:18:51Z")
You are also dropping privileges though.
Does the haproxy user have the executable privilege for the script and /var/lib/haproxy/bin/bash?
What does `sudo -u haproxy /var/lib/haproxy/check.sh` say?
If the privileges are also ok, you may want to run haproxy through `strace`.
Or better yet, try `chroot --userspec=haproxy:haproxy /var/lib/haproxy /check.sh`
---
### Author:  [@Easwer](https://discourse.haproxy.org/u/Easwer)
#### Post date: [February 5, 2019, 7:23am UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/5 "2019-02-05T07:23:18Z")
I have the same issue. I have the following configuration:
global
chroot /var/lib/haproxy
external-check
user haproxy
group haproxy
…
backend TCP
mode tcp
option external-check
external-check command /TCPCheck.sh
File TCPCheck.sh is present in /var/lib/haproxy directory.
Running the command
**_sudo -u haproxy /var/lib/haproxy/TCPCheck.sh_** is working properly.
What may be the issue?
Do I need to configure **_external-check path_** configuration?
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [February 5, 2019, 8:20am UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/6 "2019-02-05T08:20:13Z")
Do you have everything you need in chroot?
```
sudo chroot /var/lib/haproxy
./TCPCheck.sh
```
---
### Author:  [@Easwer](https://discourse.haproxy.org/u/Easwer)
#### Post date: [February 5, 2019, 2:41pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/7 "2019-02-05T14:41:10Z")
Yes. I have TCPCheck.sh file in /var/lib/haproxy directory as /var/lib/haproxy/TCPCheck.sh
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [February 5, 2019, 2:43pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/8 "2019-02-05T14:43:48Z")
My question was not whether script is in there, but whether everything you need is in there, that probably includes at least bash or sh. That’s why you should actually try it with the commands above.
---
### Author:  [@Easwer](https://discourse.haproxy.org/u/Easwer)
#### Post date: [February 6, 2019, 9:56am UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/9 "2019-02-06T09:56:53Z")
I have sh on /usr/bin/sh.
Do I need it in /var/lib/haproxy directory?
If yes, I need to provide **_external-check path_**? or can you suggest me any other way?
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [February 7, 2019, 4:52pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/10 "2019-02-07T16:52:01Z")
Test it.
It is impossible for me to know what may or may not be required.
Test it.
---
### Author:  [@Easwer](https://discourse.haproxy.org/u/Easwer)
#### Post date: [February 13, 2019, 10:38am UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/11 "2019-02-13T10:38:04Z")
I have added all the required libs in my chroot directory.
**_sudo chroot jail/ /check.sh_** is running properly. Still I am getting **_External check error, code: 255_**
---
### Author:  [@Easwer](https://discourse.haproxy.org/u/Easwer)
#### Post date: [February 13, 2019, 1:49pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/12 "2019-02-13T13:49:36Z")
My service is running with chroot /var/lib/haproxy. I have confirmed that using **_ls -al /proc/pid/root_**.
Now I have usr/ bin/ lib/ sbin/ lib64/ in chroot.
I have used **_external-check command /bin/true_**. Which is also creating error **_External check error, code: 255_**.
How can /bin/true returning 255?
---
### Author:  [@jlecour](https://discourse.haproxy.org/u/jlecour)
#### Post date: [May 8, 2020, 7:51am UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/13 "2020-05-08T07:51:08Z")
Hi,
I have the same problem and can’t find the correct way to do this.
Did you find a solution to your issue?
Thanks.
---
### Author:  [@jlecour](https://discourse.haproxy.org/u/jlecour)
#### Post date: [May 8, 2020, 8:06am UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/14 "2020-05-08T08:06:17Z")
I have found the solution for me.
The chroot needs to provide all the libraries your command needs.
For example if you use a shell script you need to have the shell itself and all its libraries.
I’ve used this article : [https://www.howtogeek.com/441534/how-to-use-the-chroot-command-on-linux/](https://www.howtogeek.com/441534/how-to-use-the-chroot-command-on-linux/)
Basically, here is what I’ve done :
```
chr=/var/lib/haproxy
mkdir -p $chr/{bin,lib,lib64}
list="$(ldd /bin/bash | egrep -o '/lib.*\.[0-9]')"
for i in $list; do cp -v --parents "$i" "${chr}"; done
cp -v /bin/bash $chr
```
Then you can put your scripts in the bin directory of the chroot.
---
### Author:  [@Mayur](https://discourse.haproxy.org/u/Mayur)
#### Post date: [May 25, 2023, 1:59pm UTC](https://discourse.haproxy.org/t/external-check-and-chroot/2150/15 "2023-05-25T13:59:43Z")
Hi,
is it possible to decide which server to forward based on this script execution?
i mean capture this in an ACL and use it for conditional forwarding?
Best Regards,
Mayur