Bug 1169151 - docker run fails with 'finalize namespace setup user setgid operation not supported'
Summary: docker run fails with 'finalize namespace setup user setgid operation not sup...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: docker-io
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lokesh Mandvekar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: RejectedFreezeException
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-30 19:38 UTC by Lokesh Mandvekar
Modified: 2014-12-15 04:32 UTC (History)
15 users (show)

Fixed In Version: docker-io-1.4.0-1.fc21
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-12-06 02:30:24 UTC
Type: Bug


Attachments (Terms of Use)

Description Lokesh Mandvekar 2014-11-30 19:38:17 UTC
Description of problem:

$ sudo docker run -it fedora bash
Unable to find image 'fedora' locally
fedora:latest: The image you are pulling has been verified
511136ea3c5a: Pull complete 
782cf93a8f16: Pull complete 
7d3f07f8de5f: Pull complete 
Status: Downloaded newer image for fedora:latest
finalize namespace setup user setgid operation not supported2014/11/30 11:34:50 Error response from daemon: Cannot start container 99dd8c91dcb56e19153cf5d4b87f8fed7b5001526fe229d7933c0bf30dc8655f: finalize namespace setup user setgid operation not supported


Version-Release number of selected component (if applicable): 1.3.2-2.fc22


How reproducible: always


Steps to Reproduce:
1. install docker
2. run aforementioned command



Additional info:

This error doesn't seem to occur with upstream commit 353ff40 on master branch (1.3.2-dev)

Comment 1 Fedora Update System 2014-11-30 21:16:54 UTC
docker-io-1.3.2-3.git353ff40.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/docker-io-1.3.2-3.git353ff40.fc21

Comment 2 Fedora Update System 2014-11-30 22:59:34 UTC
docker-io-1.3.2-3.git353ff40.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/docker-io-1.3.2-3.git353ff40.fc20

Comment 3 Fedora Update System 2014-11-30 23:19:35 UTC
docker-io-1.3.2-3.git353ff40.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/docker-io-1.3.2-3.git353ff40.fc21

Comment 4 Fedora Update System 2014-11-30 23:20:15 UTC
docker-io-1.3.2-3.git353ff40.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/docker-io-1.3.2-3.git353ff40.fc20

Comment 5 Fedora Update System 2014-12-01 19:00:40 UTC
Package docker-io-1.3.2-3.git353ff40.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing docker-io-1.3.2-3.git353ff40.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-16006/docker-io-1.3.2-3.git353ff40.fc20
then log in and leave karma (feedback).

Comment 6 Adam Williamson 2014-12-01 23:58:32 UTC
Proposing as a 21 FE on the basis that this bug sounds a lot like 'the Docker package you had us pull into 21 RC1 is completely broken', though I'm not happy that the package simply bumps to a random git checkout instead of cherry-picking the fix for the bug. The specific commit 353ff40 doesn't seem to be the actual fix for the bug, seeing as how it's just a documentation change.

Comment 7 Colin Walters 2014-12-02 00:05:26 UTC
Hmm, actually docker-io-1.3.2-2 seems to work on my F21 Cloud image.

However my rawhide build is broken with this symptom.

Comment 8 Lokesh Mandvekar 2014-12-02 00:18:13 UTC
(In reply to Adam Williamson (Red Hat) from comment #6)
> Proposing as a 21 FE on the basis that this bug sounds a lot like 'the
> Docker package you had us pull into 21 RC1 is completely broken', though I'm
> not happy that the package simply bumps to a random git checkout instead of
> cherry-picking the fix for the bug. The specific commit 353ff40 doesn't seem
> to be the actual fix for the bug, seeing as how it's just a documentation
> change.

Apologies on the hasty decision to get 353ff40 into f21. Actually, there's a similar Bug 1169334 which also needs a fix, though I'm not quite certain it applies to f21.

Also, I'll check out asap if the next version of docker 1.3.3 (1.4?) takes care of these.



(In reply to Colin Walters from comment #7)
> Hmm, actually docker-io-1.3.2-2 seems to work on my F21 Cloud image.
> 
> However my rawhide build is broken with this symptom.

Colin, does everything work well on f21 with 1.3.2-2 (including Bug 1169334)? I could push another build reverting to the state same as in 1.3.2-2 for f21.

Comment 9 Colin Walters 2014-12-02 02:03:55 UTC
(In reply to Lokesh Mandvekar from comment #8)

> Colin, does everything work well on f21 with 1.3.2-2 (including Bug
> 1169334)? I could push another build reverting to the state same as in
> 1.3.2-2 for f21.

I am not seeing bug 1169334 with docker-io-1.3.2-2 on F21.

Comment 10 Fedora Update System 2014-12-02 04:42:59 UTC
docker-io-1.3.2-4.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/docker-io-1.3.2-4.fc21

Comment 11 Adam Williamson 2014-12-02 06:49:58 UTC
so, to be clear here, docker-io-1.3.2-4.fc21 is effectively identical to docker-io-1.3.2-2.fc21, and it has been tested to work in f21?

Comment 12 Lokesh Mandvekar 2014-12-02 17:18:51 UTC
(In reply to Adam Williamson (Red Hat) from comment #11)
> so, to be clear here, docker-io-1.3.2-4.fc21 is effectively identical to
> docker-io-1.3.2-2.fc21, and it has been tested to work in f21?

Yup, -4 is the same as -2 and not affected by these bugs (rawhide branch is fixed by another -4.git%{shortcommit} but that's another story)

Comment 13 Adam Williamson 2014-12-02 19:24:12 UTC
I diffed them and -4 is clearly not the same as -2, there's a significant diff with various bits of the spec, particularly the Go stuff. I have zero idea what any of it means, but on the basic principle that only accepted blocker/FE fixes are taken after freeze, we kept -2 in Final RC2. It would be useful if someone can test Final RC2 Server DVD with docker-io -2 and confirm, for sure, whether it actually works; if not we'll have to document in CommonBugs that you should install the 0-day update ASAP (and make sure the update goes in the 0-day set).

Comment 14 Lokesh Mandvekar 2014-12-02 19:52:05 UTC
well Re: spec, -2 was using the vendored-in dependencies, while -4 depends on the rpms for those deps as much as possible (except libcontainer which is still being used from vendor/ dir). But that should make 0 difference to anybody who is only concerned with installing/using docker.

Comment 15 Adam Williamson 2014-12-03 06:42:36 UTC
there's a guy on my team who calls 'should' "the 's' word" ;)

Comment 16 Matthew Miller 2014-12-03 17:45:13 UTC
lsm5 tells me that this affects the rawhide package, but _not_ the f21 version. So we should be okay here.

Comment 17 Mike Ruckman 2014-12-03 18:48:25 UTC
Discussed in 2014-12-03 blocker review meeting. Rejected as an FE: Based on the information we have on hand this looks like it can be fixed with an update. No need for an exception to freeze.

Comment 18 Fedora Update System 2014-12-03 19:10:20 UTC
docker-io-1.3.2-4.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/docker-io-1.3.2-4.fc20

Comment 19 Adam Williamson 2014-12-05 21:33:44 UTC
OK. So for the record, F21 Final ships with 1.3.2-2.fc21 included. You're free to do what you like (under the policy) as regards updates, it's up to you if you want to stick with the 1.3.2-4.fc21 update or do something different. The 0-day update set will probably be pushed today, if I understand correctly from releng.

Comment 20 Fedora Update System 2014-12-06 02:30:24 UTC
docker-io-1.3.2-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 21 Fedora Update System 2014-12-12 05:15:56 UTC
docker-io-1.4.0-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/docker-io-1.4.0-1.fc21

Comment 22 Fedora Update System 2014-12-15 04:32:39 UTC
docker-io-1.4.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.