Synology on Margrop Blog

Docker Pulls Keep Timing Out? How to Choose, Configure, and Verify Chinese Registry Mirrors

Wed, 15 Jul 2026 19:30:00 +0800

The short answer When Docker image pulls fail on a mainland China network, the image is not necessarily missing and DNS is not always the culprit. More often, the public registry path is congested, a mirror is temporarily unavailable, or the configuration was edited but Docker was never restarted. My practical recommendation is simple: open status.anye.xyz first and treat it as a “weather report” for Docker mirrors; select a recently healthy HTTPS endpoint; edit the correct daemon configuration for your operating system; validate the JSON; restart Docker; and finally verify with a real pull of a small image.

RAID Is Not Backup: How to Choose the Right NAS Layout for Synology, fnOS, and Unraid

Sat, 11 Jul 2026 12:00:00 +0800

The short answer

RAID primarily keeps a NAS available when one or more drives fail. Backup restores data after deletion, ransomware, filesystem damage, theft, fire, or a failed NAS. You normally need both.

On Synology, SHR-1 is the practical default for many homes, while larger and more critical arrays deserve SHR-2 consideration. On fnOS, choose the filesystem, storage mode, drive count, and backup destination as one design. On Unraid, understand that the classic Array is not a conventional striped RAID: data disks keep independent filesystems while one or two parity disks provide failure recovery.

A useful starting rule is: mirror two-drive systems; use single-drive redundancy when capacity matters and a separate backup exists; seriously consider dual-drive redundancy as drive count and individual drive capacity grow. Anything irreplaceable still needs an offline or off-site copy.

The Password Was Right—So Why Did Synology Reject It? Rebuilding DSM’s RSA + AES WebAPI Login

Sat, 11 Jul 2026 08:30:00 +0800

The short version

Some Synology WebAPI clients do more than post account and passwd to auth.cgi. The implementation preserved in OpenStack Cinder first calls SYNO.API.Encryption.getinfo, receives an RSA public modulus, server time, and two dynamic field names, then generates a one-use passphrase. RSA PKCS#1 v1.5 encrypts that passphrase; an OpenSSL-compatible AES-256-CBC envelope encrypts the URL-encoded login parameters; both Base64 values are finally placed inside the server-provided cipherkey field.

This is an authorized WebAPI compatibility technique—not a password bypass. A SID for session=DSM is also not automatically the same thing as a complete browser UI login state. Parameter encryption does not replace HTTPS, because TLS still authenticates the server and protects integrity against an active intermediary.

Stop Fighting Over the Remote: Use DSM Scheduled Tasks to Lock a Kids' Video Folder Automatically

Sun, 05 Jul 2026 06:50:00 +0800

Short version

This is not an account lockout guide. The goal is narrower and cleaner: lock one kids’ video folder on a Synology DSM 7.2.1 NAS during selected hours, while leaving the account, password, homework folders, photo folders, and other shares alone. The script inserts one temporary deny ACL entry with synoacltool, removes that entry during open windows, backs up the ACL before each change, and verifies the result after each operation.

Synology locked root behind three doors — I spent twenty minutes teaching it how to let me back in

Thu, 18 Jun 2026 16:30:00 +0800

TL;DR

Synology DSM, by design, ships with SSH disabled and root login prohibited — both sensible defaults. This guide walks you through “doing it the right way”:

Control Panel → Terminal & SNMP → Enable SSH (open the gate)

Log in as a normal user, then sudo -i to become root (borrow the landlord’s key first)

Edit /etc/ssh/sshd_config and set PermitRootLogin yes (tell the bouncer “root is family”)

synouser --setpw root xxx to set a root password, and append your public key to ~/.ssh/authorized_keys (hand back a key that can never be lost)

Total time: about twenty minutes. I’ll explain why every step exists using a “key and lock” metaphor, give you a 3-second vi crash course, list the error messages you’ll see, and answer the seven most common questions.

Moving Bedtime Out of the Living Room: Letting macOS launchd Disable Your Kids' Synology Accounts at 22:00 and Quietly Re-enable Them at 08:00

Sun, 14 Jun 2026 08:20:00 +0800

Short version

Synology DSM has a “disable this account” checkbox in the Control Panel, but it does not run on a schedule. With macOS’s built-in launchd and a 50-line bash script, you can flip the expired flag on two local accounts at 22:00 every night and flip it back at 08:00. The script does a before-query, a change, an after-query, and exit 1 the moment the after state does not match expectations. launchd writes stdout and stderr to dedicated log files. The interesting part is that the word “parent” quietly leaves the conversation: you no longer have to remind anyone to go to bed, the machine does it for you, on time, every day.

This post is not a comprehensive “family NAS management” guide. It is about one specific thing: turning a manual button click that depends on human memory into a system-level event that just happens on time.

If you only want the picture, the overview diagram in Section 2 is the whole article in one frame.

PhotoPrism Stuck for 5 Minutes on First Boot? A Postmortem on PHOTOPRISM_INIT=intel

Sat, 13 Jun 2026 08:30:00 +0800

TL;DR (The Short Version)

The PHOTOPRISM_INIT: "intel" line in PhotoPrism’s Plus Docker image is not just a flag to enable Intel hardware acceleration at runtime — it’s a one-shot system-level installer that runs apt-get dist-upgrade against archive.ubuntu.com and then installs 8 Intel/VA-API packages before the main process is allowed to start. On a fresh container this takes 5–10 minutes (sometimes more), during which nothing inside the container listens on port 2342.

Meanwhile: docker ps says Up, Portainer is green, ss -ltn on the host shows :2342 LISTEN — but your browser gets ERR_CONNECTION_RESET / Connection reset by peer. Because host-side docker-proxy accepts the connection and then tries to forward to a port inside the container that has no listener, the kernel sends back an RST.

Fix: just remove or empty that one line. If you already pass /dev/dri/renderD128 via devices:, the host’s drivers and userland libraries are perfectly usable from the container — there’s nothing to “install” in there.

Integrating Synology Operations as an OpenClaw / HermesAgent Skill: From One Sentence to Auditable NAS Automation

Tue, 05 May 2026 12:20:00 +0800

I have already written two Synology CLI references on this blog:

Those posts answer the question: “What commands can a human run on a Synology NAS?” This article answers a different question: if I already use OpenClaw / HermesAgent, how can I turn those commands into an operations Skill so that I can ask the agent, in one sentence, to inspect the NAS, summarize evidence, prepare a maintenance plan, and execute approved commands only when the risk is acceptable?

The short answer is: yes, but the Skill must not become an unrestricted root shell. The right design is:

Make Synology SSH access controlled, testable, and revocable.
Put common Synology CLI operations into a Skill, together with command categories, risk levels, and output rules.
Allow read-only diagnostics by default.
Require explicit approval for service restarts, permission changes, user changes, network changes, deletion, and storage operations.
Preserve commands, output, and reasoning so each operation remains auditable.

If you only want the big picture, the diagram below summarizes the whole article.

[Transfer] Synology NAS CLI Administration Guide

Thu, 30 Apr 2026 18:20:04 +0800

This guide contains command tools that allow your applications to make use of the resources on Synology DiskStation and also includes a list of Synology Error Numbers for reference.

[Transfer] Synology DiskStation Administration CLI Guide: Reading Notes and Command Cheatsheet

Thu, 30 Apr 2026 18:14:05 +0800

Short version

Synology’s official CLI administration guide is not a beginner manual for the DSM web interface. It is a compact reference for scripting, automation, and system integration. The useful parts cover local users, local groups, shared folders, network configuration, service management, Windows workgroup or ADS domain settings, and DSM error numbers.

This post is an English reading note and command cheatsheet based on Synology’s official PDF, CLI Administrator Guide for Synology NAS. Because the original PDF is a copyrighted Synology document, this post does not reproduce or translate the full document verbatim. Instead, it reorganizes the material into a bilingual blog-friendly guide for quick reading and daily operations. For exact wording, parameter definitions, version-specific behavior, and legal notices, use the official PDF linked at the end.

[Translation] Synology SSH Commands Cheatsheet

Thu, 30 Apr 2026 10:00:00 +0800

Warning: Running these SSH commands may damage your system/hard drive. Do not execute them if you don’t understand what they do!

When Docker Networks Collide with the Home LAN: Moving Auto-Allocated Subnets Back to 172

Mon, 13 Apr 2026 08:00:00 +0800

This post records a very practical Docker networking failure: the number of containers kept growing, Docker’s auto-assigned user-defined bridge networks eventually started landing in 192.168.x.x, and those networks began colliding with the real home LAN. The symptoms were not dramatic at first. Nothing looked “broken” in the usual sense. Containers were still running, the host was still alive, and the dashboard still looked normal. But parts of the home network became unreliable, and once I dug into it on my NAS, the root cause turned out to be the Docker network allocation strategy rather than any single bad container.

The fix was straightforward in principle, but important in practice: I moved Docker’s automatic network pool to 172.16.0.0/12, migrated the existing 192.168.* networks onto the 172 private range, and made sure future networks created through Portainer, Dockhand, or plain docker compose would follow the same rule.

Synology Chat download and installation address

Mon, 07 Jun 2021 08:31:39 +0800

Due to well-known reasons, Chat has now disappeared However, the international version of the Synology site can still be downloaded and used normally. Use and cherish DS3617xsInternational Version Download Center Chat Kit download address Chat Android version download address *Chat Apple users must find an overseas iCloud account to install it. The above Chat package and APK have been backed up to the download center of this site

【Transfer】The latest method of half-washing Synology

Tue, 19 Jan 2021 18:10:53 +0800

I recently built a new NAS. After installing it, I found that the semi-whitewashing solution provided before no longer worked. Previous Posthttp://blog.lixx.vip/黑群晖（synology）nas-6-22-折腾记-半洗白/ Mainly because Synology’s new version of Docker 18.09.0-0506 has closed the installation of DDSM Download old version of Docker *Old version of Docker download address (Docker-x64-17.05.0-0401.spk): DDSM’s PAT download address (DSM_VirtualDSM_15284.pat): It can also be downloaded at 我的网盘 You need to uninstall the newly installed Docker in the package center, and then install the downloaded old version

How to Run N2N on Synology (DSM) - Compilation Guide

Fri, 15 Jan 2021 13:18:07 +0800

Synology (abbreviated as DSM below) is currently the most famous NAS system, bar none. How to run N2N directly on DSM? Of course, cross-compilation is needed again 😂. The following cross-compilation operations require a basic understanding of Linux and proficiency in vim operations.