DescriptionLokesh Mandvekar
2020-10-02 15:58:49 UTC
+++ This bug was initially created as a clone of Bug #1880094 +++
Description of problem:
running toolbox under fc33 get fail
[martin@localhost ~]$ toolbox rm --force
Error: failed to get the Podman version
Version-Release number of selected component (if applicable):
How reproducible:
always
Steps to Reproduce:
1.toolbox create
2.toolbox enter
3.get fail
Actual results:
Error: failed to start container fedora-toolbox-33
Additional info:
--- Additional comment from Walter Francis on 2020-10-01 06:55:47 EDT ---
$ toolbox create
Created container: fedora-toolbox-33
Enter with: toolbox enter
$ toolbox enter
Error: failed to start container fedora-toolbox-33
Attaching log of debug output.
--- Additional comment from Walter Francis on 2020-10-01 06:56:23 EDT ---
Note; this is a freshly installed Fedora 33 beta, updated to the latest packages with dnf update.
--- Additional comment from Debarshi Ray on 2020-10-01 14:16:08 EDT ---
Could you please try:
$ podman start --attach fedora-toolbox-33
--- Additional comment from Walter Francis on 2020-10-01 15:22:52 EDT ---
$ podman start --attach fedora-toolbox-33
Error: unable to start container 8f5c99debf5591fe5763659bae0ca930b2cd52702678cebf6cd6c82f98212858: open /proc/sys/net/ipv4/ping_group_range: Permission denied: OCI runtime permission denied error
--- Additional comment from Jens Petersen on 2020-10-02 04:58:20 EDT ---
I see the same with fresh F33+ WS installs.
Also with toolbox-0.0.96-1.fc34
--- Additional comment from Martin on 2020-10-02 11:40:20 EDT ---
[martin@localhost ~]$ podman start --attach fedora-toolbox-33
Error: unable to start container e087d5cf66c87ec67772821db7a5ef2af13e3b415879085a8492bf0010c9d70c: open /proc/sys/net/ipv4/ping_group_range: Permission denied: OCI runtime permission denied error
--- Additional comment from Walter Francis on 2020-10-02 11:51:22 EDT ---
Looking at the ping_group_range in context, I found something specific to that here: https://github.com/containers/podman/blob/master/troubleshooting.md
But even after fiddling about with some various values, nothing seemed to help. It did seem to have very sane values to begin with but I tried anyway. I might be missing something, or toolbox might have some independent settings somehow, I am not very familiar with toolbox, I've always used podman directly.
The issue here is in containers.conf from containers-common, IE Skopeo package.
I have just released an update for a different problem, but this includes the ping_group_range setting.
https://bodhi.fedoraproject.org/updates/FEDORA-2020-15e7ef1dcc
Look in /usr/share/containers/containers.conf for the ping_group_range setting.
It should only be being set for a range of 1 GID.
@Dan, yes, that's what I see as well: "net.ipv4.ping_group_range=0 1"
But I see this issue when I use `podman run --net=host`. I'm not sure if that's deprecated, in the manpage I see `--network` but no `--net`.