Bug 2011523

Description of problem:

docker build fails, and containers started with docker run fail to fork child processes.  Both are probably caused by the use of the clone3 syscall from the container being blocked by the seccomp mechanism.

Upstream moby (looking at https://github.com/moby/moby) has added bits to allow clone3, that I don't see in the moby-engine package in fedora 35.  So it may just be a matter of updating to a more recent version of upstream.

This is similar and related to a few other bugs (1990469, 1992708), but in this case both the host and container image are fedora 35.

When using "docker run", this can be worked around by either running unconfined (seccomp=unconfined), or by using a custom profile, such as the one that's provided by containers-common (/usr/share/containers/seccomp.json) which allows clone3.  But I'm not sure how this can be worked around when using "docker build".


Version-Release number of selected component (if applicable):

moby-engine-20.10.8-1.fc35.x86_64


How reproducible:

Consistently reproduces.


Steps to Reproduce:

1. Have a DockerFile with contents like:

FROM	fedora:35
RUN dnf install -y perl perl-Test-Simple gcc krb5-devel make fuse fuse-devel gdb

2. Try to build and tag an image:

docker build . --tag=fs

Actual results:

Sending build context to Docker daemon  61.44kB
Step 1/2 : FROM	fedora:35
 ---> 2b7eaa324f9f
Step 2/2 : RUN dnf install -y perl perl-Test-Simple gcc krb5-devel make fuse fuse-devel gdb
 ---> Running in 6bcc7d4c7478
Fedora 35 - x86_64                              0.0  B/s |   0  B     00:00    
Errors during downloading metadata for repository 'fedora':
  - Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=x86_64&countme=1 [getaddrinfo() thread failed to start]
  - Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=x86_64 [getaddrinfo() thread failed to start]
Error: Failed to download metadata for repo 'fedora': Cannot prepare internal mirrorlist: Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=fedora-35&arch=x86_64 [getaddrinfo() thread failed to start]
The command '/bin/sh -c dnf install -y perl perl-Test-Simple gcc krb5-devel make fuse fuse-devel gdb' returned a non-zero code: 1


Expected results:

New image is built and tagged.

Additional info: