Description of problem: The minimum setup that allows systemd to be run in a container seems to be docker run --rm -ti -e container=docker -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /tmp -v /run fedora:23 /usr/sbin/init It works with docker 1.9 but fails with docker 1.10. Version-Release number of selected component (if applicable): docker-1.10.2-8.git0f5ac89.fc23.x86_64 How reproducible: Deterministic. Steps to Reproduce: 1. Have docker 1.9. 2. Run docker run --rm -ti -e container=docker -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /tmp -v /run fedora:23 /usr/sbin/init 3. Upgrade to docker 1.10. 4. Restart docker daemon. 5. Run the same command. Actual results: [!!!!!!] Failed to mount API filesystems, freezing. Expected results: systemd 222 running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN) Detected virtualization docker. Detected architecture x86-64. Running with unpopulated /etc. Welcome to Fedora 23 (Twenty Three)! Set hostname to <382e25da24c8>. Initializing machine ID from random generator. Populated /etc with preset unit settings. Running in a container, ignoring fstab device entry for /dev/disk/by-uuid/e9c6a283-f8b8-437b-bf5e-9e73b8f44ac8. [ OK ] Reached target Local File Systems. [ OK ] Reached target Swap. [ OK ] Created slice Root Slice. [ OK ] Listening on Journal Socket (/dev/log). [ OK ] Listening on /dev/initctl Compatibility Named Pipe. [ OK ] Listening on Journal Socket. [ OK ] Created slice System Slice. Starting Rebuild Dynamic Linker Cache... [ OK ] Reached target Slices. Starting Rebuild Hardware Database... Starting First Boot Wizard... Starting Load/Save Random Seed... Starting Rebuild Journal Catalog... [ OK ] Reached target Encrypted Volumes. [ OK ] Reached target Remote File Systems. [ OK ] Reached target Paths. Starting Journal Service... [ OK ] Started First Boot Wizard. [ OK ] Started Load/Save Random Seed. Starting Create System Users... [ OK ] Started Rebuild Journal Catalog. [ OK ] Started Rebuild Dynamic Linker Cache. [ OK ] Started Create System Users. [ OK ] Started Journal Service. Starting Flush Journal to Persistent Storage... [ OK ] Started Flush Journal to Persistent Storage. Starting Create Volatile Files and Directories... [ OK ] Started Create Volatile Files and Directories. Starting Update UTMP about System Boot/Shutdown... [ OK ] Started Update UTMP about System Boot/Shutdown. [ OK ] Started Rebuild Hardware Database. Starting Update is Completed... [ OK ] Started Update is Completed. [ OK ] Reached target System Initialization. [ OK ] Reached target Timers. [ OK ] Listening on D-Bus System Message Bus Socket. [ OK ] Reached target Sockets. [ OK ] Reached target Basic System. Starting Permit User Sessions... [ OK ] Reached target Containers. [ OK ] Started D-Bus System Message Bus. Starting D-Bus System Message Bus... [ OK ] Started Permit User Sessions. Starting Cleanup of Temporary Directories... Starting dnf makecache... [ OK ] Reached target Multi-User System. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Cleanup of Temporary Directories. [ OK ] Started Update UTMP about System Runlevel Changes. Additional info: The expected result output is from docker 1.9.
I suspect we fixed this with some patches from Mruanl&Dan here: https://github.com/projectatomic/docker/commits/fedora-1.10.3 I'll try to reproduce
On a remote chance that this is instance of bug 1318547, I've commented out the MountFlags=slave in /usr/lib/systemd/system/docker.service but with no effect.
The problem happens on Permissive as well.
This is caused by the seccomp patches. Try with --security-opt seccomp:unconfined Antonio the patch that we added to add back in the syscalls for docker-1.11 fixes this issue.
Perfect, I got the patch in 1.11 and the patch is in the 1.10.3 branch. So I think we need to rebuild 1.10.3 because the issue is in docker 1.10.2 which clearly doesn't have the seccomp fix patch
I confirm that docker run --security-opt seccomp:unconfined --rm -ti -e container=docker -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /tmp -v /run fedora:23 /usr/sbin/init passes with docker-1.10.2-8.git0f5ac89.fc23.x86_64.
Lokesh can you rebuild docker-1.10.3 with latest patches.
Fixed in docker-1.10
Confirming the command from comment 0 now passes with docker-1.10.3-24.gitf476348.fc23.x86_64.
This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 23 changed to end-of-life (EOL) status on 2016-12-20. Fedora 23 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.