Bug 2165004

Summary:	Failed to fork: Operation not permitted in container
Product:	[Fedora] Fedora	Reporter:	Jan Pazdziora (Red Hat) <jpazdziora>
Component:	systemd	Assignee:	systemd-maint
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	38	CC:	dtardon, dustymabe, fedoraproject, filbranden, jpazdziora, lnykryn, msekleta, ryncsn, systemd-maint, yuwatana, zbyszek
Target Milestone:	---	Keywords:	Regression, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	systemd-253-3.fc39 systemd-253-6.fc38	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-02-21 15:58:32 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Pazdziora (Red Hat) 2023-01-27 10:46:57 UTC

Description of problem:

Affempts to run systemd-based container started to fail with systemd-253~rc1-1.fc38.

Version-Release number of selected component (if applicable):

systemd-253~rc1-1.fc38 in the container.
podman-4.3.1-1.fc37 on the host.

How reproducible:

Deterministic.

Steps to Reproduce:
1. Create Dockerfile with

FROM registry.fedoraproject.org/fedora:rawhide
RUN dnf install -y /usr/sbin/init

2. Build container image:
   podman build -t systemd-rawhide .
3. Run the systemd in the container:
   podman run --rm -ti systemd-rawhide /usr/sbin/init

Actual results:

systemd 253~rc1-1.fc38 running in system mode (+PAM +AUDIT +SELINUX -APPARMOR +IMA +SMACK +SECCOMP -GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN -IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
Detected virtualization podman.
Detected architecture x86-64.

Welcome to Fedora Linux 38 (Container Image Prerelease)!

Failed to open libbpf, cgroup BPF features disabled: Operation not supported
Failed to fork: Operation not permitted
[!!!!!!] Failed to start up manager.
Exiting PID 1...

Expected results:

No error.

Additional info:

This is a regression against Fedora 37 and systemd-252.4-4.fc38.

Comment 1 Jan Pazdziora (Red Hat) 2023-01-27 10:53:03 UTC

I see the same results with both rootless and rootful containers.

I see the same result with moby-engine-20.10.22-1.fc37 as well, running the container as
docker run --rm -ti --tmpfs /run systemd-rawhide /usr/sbin/init

Comment 2 Ben Cotton 2023-02-07 15:06:42 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 38 development cycle.
Changing version to 38.

Comment 3 Jan Pazdziora (Red Hat) 2023-02-14 09:55:50 UTC

The issue is still present with systemd-253~rc2-3.fc38.

Comment 4 Yu Watanabe 2023-02-18 19:08:31 UTC

Fix is waiting in https://github.com/systemd/systemd/pull/26478.

Comment 5 Fedora Update System 2023-02-21 11:11:29 UTC

FEDORA-2023-9e6007f165 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9e6007f165

Comment 6 Fedora Update System 2023-02-21 11:14:01 UTC

FEDORA-2023-73fea9469f has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-73fea9469f

Comment 7 Fedora Update System 2023-02-21 15:58:32 UTC

FEDORA-2023-9e6007f165 has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2023-03-14 02:20:06 UTC

FEDORA-2023-5690f5f379 has been pushed to the Fedora 38 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-5690f5f379

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2023-03-15 00:17:58 UTC

FEDORA-2023-5690f5f379 has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.