Bug 1986339

Summary: podman: Cannot run Fedora 35/RHEL 9 Beta images due to clone3 incompatibility
Product: Red Hat Enterprise Linux 9 Reporter: Florian Weimer <fweimer>
Component: skopeoAssignee: Tom Sweeney <tsweeney>
Status: CLOSED CURRENTRELEASE QA Contact: Yuhui Jiang <yujiang>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 9.0CC: ajia, bbaude, dwalsh, jligon, jnovy, lsm5, mheon, pthomas, tsweeney, umohnani, ypu
Target Milestone: beta   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: skopeo-1.3.1-3.el9 or newer Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1985499 Environment:
Last Closed: 2021-12-07 21:44:43 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Florian Weimer 2021-07-27 10:10:43 UTC 
This issue also occurs with RHEL-9.0.0-20210725.d.3. Package versions tested:

containers-common-1.3.1-1.el9.x86_64
libseccomp-2.5.0-5.el9.x86_64
podman-3.3.0-0.6.el9.x86_64


+++ This bug was initially created as a clone of Bug #1985499 +++

Fedora 35 and RHEL 9 Beta will first attempt to use the clone3 system call for thread creation.

$ podman run fedora:rawhide rpm -q glibc
glibc-2.33.9000-50.fc35.x86_64
$ podman run fedora:rawhide python3 -c 'import threading; threading.Thread(None, lambda: 0).start()'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/lib64/python3.10/threading.py", line 928, in start
    _start_new_thread(self._bootstrap, ())
RuntimeError: can't start new thread

strace from outside the container shows the problematic EPERM error:

2667529 clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7fd5c687f910, parent_tid=0x7fd5c687f910, exit_signal=0, stack=0x7fd5c607f000, stack_size=0x7fff00, tls=0x7fd5c687f640}, 88) = -1 EPERM (Operation not permitted)
Comment 6 Alex Jia 2021-08-18 05:43:45 UTC 
This bug has been verified on containers-common-1.4.0-8.module+el9beta+12229+194de70a.

[root@kvm-08-guest28 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.0 Beta (Plow)

[root@kvm-08-guest28 ~]# rpm -q containers-common libseccomp podman
containers-common-1.4.0-8.module+el9beta+12229+194de70a.x86_64
libseccomp-2.5.0-5.el9.x86_64
podman-3.3.0-0.19.module+el9beta+12229+194de70a.x86_64
[root@kvm-08-guest28 ~]# podman run fedora:rawhide python3 -c 'import threading; threading.Thread(None, lambda: 0).start()'
[root@kvm-08-guest28 ~]# echo $?
0
[root@kvm-08-guest28 ~]# podman ps -a
CONTAINER ID  IMAGE                                      COMMAND               CREATED         STATUS                     PORTS       NAMES
4b86b9497e60  registry.fedoraproject.org/fedora:rawhide  python3 -c import...  15 seconds ago  Exited (0) 15 seconds ago              nifty_fermat

[root@kvm-08-guest28 ~]# podman run fedora:rawhide python3 -c "import os; os.system('ls')"
bin
boot
dev
etc
home
lib
lib64
lost+found
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var