| Summary: | docker run -v /sys/fs/cgroup:/sys/fs/cgroup:ro fails with --userns-remap set | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jan Pazdziora <jpazdziora> |
| Component: | podman | Assignee: | Lokesh Mandvekar <lsm5> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 31 | CC: | adimania, admiller, amurdaca, bbaude, dwalsh, ebiederm, ichavero, jcajka, jchaloup, jnovy, jpazdziora, lsm5, marianne, mheon, miminar, mpatel, nalin, riek, santiago |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-09-15 14:38:38 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Jan Pazdziora
2016-12-06 12:39:09 UTC
If you remove the OCI-systemd-hook can you get it to work mounting the devices on the Commandline --tmpfs /run --tmpfs /tmp -v /sys/fs/cgroup:/sys/fs/cgroup ... I think the mount command inside of oci-systemd-hook for the cgroups is failing. Right, manually mounting is what I tried to do but I hit bug 1401537 comment 13. While $ docker run -v /sys/fs/cgroup:/sys/fs/cgroup:ro --rm -ti fedora:24 bash fails, $ docker run -v /sys/fs/cgroup:/sys/fs/cgroup --rm -ti fedora:24 bash without the :ro passes. So I tried removing /usr/libexec/oci/hooks.d/oci-systemd-hook and I run $ docker run --rm -ti -e container=docker -v /sys/fs/cgroup:/sys/fs/cgroup --tmpfs /run --tmpfs /tmp fedora:24 /usr/sbin/init and I get systemd 229 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN) Detected virtualization docker. Detected architecture x86-64. Running with unpopulated /etc. Welcome to Fedora 24 (Twenty Four)! Set hostname to <650c8735a344>. Initializing machine ID from random generator. Failed to read AF_UNIX datagram queue length, ignoring: No such file or directory Failed to populate /etc with preset unit settings, ignoring: No such file or directory Failed to create /system.slice/docker-650c8735a34469088aa207dab473783f53d7eeb879485c548119bd8091851d52.scope/init.scope control group: Permission denied Failed to allocate manager object: Permission denied [!!!!!!] Failed to allocate manager object, freezing. Freezing execution. Error response from daemon: No such container: 650c8735a34469088aa207dab473783f53d7eeb879485c548119bd8091851d52 Error response from daemon: devmapper: Unknown device e861345cb11388039769492dde3218b1a709c87ec503974c5fba1634116c42e6 I think we need to keep these bugzillas separate. Lets handle mounting of /sys/fs/cgroup:/sys/fs/cgroup:ro inside of a user namespace here. The systemd one needs to be handled separately. Alright. So the steps to reproduce would be: With --userns-remap set for the docker daemon $ docker run -v /sys/fs/cgroup:/sys/fs/cgroup:ro --rm -ti fedora:24 bash fails, while $ docker run -v /sys/fs/cgroup:/sys/fs/cgroup --rm -ti fedora:24 bash without the :ro passes. I now spun off the systemd issue with /sys/fs/cgroup mounted without that :ro to bug 1402264. This message is a reminder that Fedora 25 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 25. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '25'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 25 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. This issue as clarified in comment 6 still fails on Fedora 26 with docker-1.13.1-40.git877b6df.fc26.x86_64 selinux-policy-3.13.1-260.14.fc26.noarch container-selinux-2.28-1.fc26.noarch oci-systemd-hook-0.1.13-1.gitafe4b4a.fc26.x86_64 with the -v /sys/fs/cgroup:/sys/fs/cgroup:ro and with OPTIONS='--selinux-enabled --log-driver=journald --userns-remap=default' and setsebool -P container_manage_cgroup 1 This message is a reminder that Fedora 26 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '26'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 26 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. With docker-1.13.1-44.git584d391.fc26.x86_64 selinux-policy-3.13.1-260.20.fc26.noarch container-selinux-2.40-1.fc26.noarch oci-systemd-hook-0.1.15-1.git2d0b8a3.fc26.x86_64 running just docker run --rm fedora:26 /usr/sbin/init passes, with docker configured as OPTIONS='--selinux-enabled --log-driver=journald --userns-remap=default' and with setsebool -P container_manage_cgroup 1 On the other hand, docker run -v /sys/fs/cgroup:/sys/fs/cgroup:ro --rm -ti fedora:26 bash with the :ro still fails with /usr/bin/docker-current: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:364: container init caused \"rootfs_linux.go:54: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/var/lib/docker/165536.165536/devicemapper/mnt/7d24eeecce023fd6c7c7c53e28a2e77431c37a814e10ca8d0725eec01dc995cf/rootfs\\\" at \\\"/var/lib/docker/165536.165536/devicemapper/mnt/7d24eeecce023fd6c7c7c53e28a2e77431c37a814e10ca8d0725eec01dc995cf/rootfs/sys/fs/cgroup\\\" caused \\\"operation not permitted\\\"\"". while docker run -v /sys/fs/cgroup:/sys/fs/cgroup --rm -ti fedora:26 bash passes. On Fedora 27 with docker-1.13.1-51.git4032bd5.fc27.x86_64 selinux-policy-3.13.1-283.34.fc27.noarch container-selinux-2.55-1.fc27.noarch oci-systemd-hook-0.1.15-1.git2d0b8a3.fc27.x86_64 the results are the same, so moving the version to 27. Since https://github.com/opencontainers/runc/issues/1229 mentions the docker run -v /sys/fs/cgroup:/sys/fs/cgroup:ro --rm -ti fedora:26 bash failure might be a kernel issue, also noting that on Fedora 27 the kernel is kernel-4.16.6-202.fc27.x86_64 and on Fedora 28 where it fails as well, the version is kernel-4.16.7-300.fc28.x86_64. This message is a reminder that Fedora 27 is nearing its end of life. On 2018-Nov-30 Fedora will stop maintaining and issuing updates for Fedora 27. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '27'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 27 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Jan is this still and issue in F29? Yes: docker run -v /sys/fs/cgroup:/sys/fs/cgroup:ro --rm -i fedora:29 id container_linux.go:247: starting container process caused "process_linux.go:364: container init caused \"rootfs_linux.go:54: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/var/lib/docker/808080.808080/overlay2/7f4c1245c4b69fc347bbee00f6a99975c8d58e808c0fe4dc3d9510d485064d65/merged\\\" at \\\"/var/lib/docker/808080.808080/overlay2/7f4c1245c4b69fc347bbee00f6a99975c8d58e808c0fe4dc3d9510d485064d65/merged/sys/fs/cgroup\\\" caused \\\"operation not permitted\\\"\"" /usr/bin/docker-current: Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:364: container init caused \"rootfs_linux.go:54: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/var/lib/docker/808080.808080/overlay2/7f4c1245c4b69fc347bbee00f6a99975c8d58e808c0fe4dc3d9510d485064d65/merged\\\" at \\\"/var/lib/docker/808080.808080/overlay2/7f4c1245c4b69fc347bbee00f6a99975c8d58e808c0fe4dc3d9510d485064d65/merged/sys/fs/cgroup\\\" caused \\\"operation not This message is a reminder that Fedora 29 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora 29 on 2019-11-26. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '29'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 29 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The issue still seems present on Fedora 30. I think we should be concentrating on cgroup V2 here perhaps on Fedora 31. We are never going to fix this on Docker, so switched to Podman. Feel free to close this bugzilla as WONTFIX for docker. For podman, I'm not sure what the equivalent of adding -userns-remap=default to OPTIONS in /etc/sysconfig/docker would be. With podman-1.6.2-2.fc30.x86_64 I've tried podman run -v /sys/fs/cgroup:/sys/fs/cgroup --rm -i --subuidname=dockremap --subgidname=dockremap registry.fedoraproject.org/fedora:30 id but I get Error: container_linux.go:346: starting container process caused "process_linux.go:449: container init caused \"rootfs_linux.go:58: mounting \\\"/sys/fs/cgroup\\\" to rootfs \\\"/var/lib/containers/storage/overlay/0864d3e223ad7849fd38a076e2c7960db0fdaf3d365cf305cd3c65f524d79cfc/merged\\\" at \\\"/var/lib/containers/storage/overlay/0864d3e223ad7849fd38a076e2c7960db0fdaf3d365cf305cd3c65f524d79cfc/merged/sys/fs/cgroup\\\" caused \\\"operation not permitted\\\"\"": OCI runtime permission denied error OTOH, podman run --systemd=always --rm -i --subuidname=dockremap --subgidname=dockremap registry.fedoraproject.org/fedora:30 sleep 60 runs fine. Volume mounting in /sys/fs/cgroup would not be writable from a user namespace, Perhaps since we are mounting the cgroup from inside of podman, it gets different permissions. Is this still an issue, we are not working on it. Things look good with podman-2.0.6-1.fc32.x86_64. |