Bug 1216153

Summary: Docker daemon runs in shared mount namespace
Product: [Fedora] Fedora EPEL Reporter: MikeW <michaeljameswells+redhatbugzilla>
Component: docker-ioAssignee: Ivan Chavero <ichavero>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: el6CC: adimania, admiller, dave.mcneill, dwalsh, golang-updates, hushan.jia, ichavero, jchaloup, jperrin, lsm5, mattdm, mgoldman, miminar, s, thrcka, vbatts
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-06-03 12:12:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description MikeW 2015-04-28 15:41:52 UTC
Description of problem:
The docker daemon is run in a shared mount namespace, causing problems when restarting the docker service. This prevents starting up containers where mounts remain in place.

Version-Release number of selected component (if applicable):
1.5.0-1.el6

How reproducible:
Always

Steps to Reproduce:
1. docker run -d --name test centos sleep infinity
2. service docker restart
3. docker start test

Actual results:
Error response from daemon: Cannot start container test: Error getting container 0412d5cce356ff269bd85b2096eb8bc0b2cc58a67096c6c6587a85f7e82f0b77 from driver devicemapper: Error mounting '/dev/mapper/docker-253:0-2097716-0412d5cce356ff269bd85b2096eb8bc0b2cc58a67096c6c6587a85f7e82f0b77' on '/var/lib/docker/devicemapper/mnt/0412d5cce356ff269bd85b2096eb8bc0b2cc58a67096c6c6587a85f7e82f0b77': device or resource busy
FATA[0000] Error: failed to start one or more containers

Expected results:
Container to start.

Additional info:
A merged pull request containing updated sysvinit script is found here: https://github.com/docker/docker/pull/10225

It was merged prior to the 1.5.0 release and involves running "unshare -m" when starting the docker daemon to place it into its own mount namespace.

Comment 1 Daniel Walsh 2015-06-03 12:12:36 UTC
Should be fixed in docker-1.6