Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
In a swarm mode cluster using docker 1.13 in fedora atomic 26,
it's impossible to create a service with a secret mounted in
its containers. The service is created but the containers are
crashing.
Version-Release number of selected component (if applicable):
1.13.1-53.git774336d.el7
How reproducible: 100%
Steps to Reproduce:
1. Login to the host with docker installed and switch to the root user
2.
# docker swarm init
Swarm initialized: current node (yxoss27y1h5d87mrtgfij4q3d) is now a manager.
To add a worker to this swarm, run the following command:
docker swarm join \
--token SWMTKN-1-0sg2bj4onjvyaygcmcsftvx5z48f2r0oq6abg4izaflch9d8r8-dva3kq1zw7vrzjg8sav3e5mcs \
xxx.xxx.xxx.xxx:2377
To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.
3.
# docker service ls
ID NAME MODE REPLICAS IMAGE
4.
# echo "This is a secret" | docker secret create my_secret_data -
2ab8kotd9e9q9wcpe387tryez
5.
# docker service create --name="httpd" --secret="my_secret_data" docker.io/httpd
ri4wtno7wu93yfczzb93l6s8s
Actual results:
# docker service ps httpd --no-trunc
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
p6jrn0kybq8vjx69avb3xdcxc httpd.1 docker.io/httpd:latest@sha256:fc9b21c3faf2e1aa4cbe91d60df40a0d30ff151d8a5f5228d77fe5e0a18fa3c2 strigazi-fa26-swarm-mode-04.cern.ch Ready Ready 2 seconds ago
yx2mquqmna77u8uxo7exgxc6m \_ httpd.1 docker.io/httpd:latest@sha256:fc9b21c3faf2e1aa4cbe91d60df40a0d30ff151d8a5f5228d77fe5e0a18fa3c2 strigazi-fa26-swarm-mode-04.cern.ch Shutdown Failed 2 seconds ago "starting container failed: RemoveSecretsPath failed: remove /var/lib/docker/containers/115332b56220016b062dcdd69f128775736f86605219d3081af848d5b4ca6a15/secrets/my_secret_data: read-only file system"
Expected results:
The service running, something like:
# docker service ps redis
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
bkna6bpn8r1a redis.1 redis:alpine ip-172-31-46-109 Running Running 8 seconds ago
I guess this is a duplicate of 1511230, but I can not be sure, as this is a private bug and I have no permission to view. But https://access.redhat.com/solutions/3242551 points in that direction.
Hi,
I have encountered this issue on RHEL 7.5 when I was trying to deploy a docker registry server using secrets. Is there a temporary work around to the issue?
Thanks.
Description of problem: In a swarm mode cluster using docker 1.13 in fedora atomic 26, it's impossible to create a service with a secret mounted in its containers. The service is created but the containers are crashing. Version-Release number of selected component (if applicable): 1.13.1-53.git774336d.el7 How reproducible: 100% Steps to Reproduce: 1. Login to the host with docker installed and switch to the root user 2. # docker swarm init Swarm initialized: current node (yxoss27y1h5d87mrtgfij4q3d) is now a manager. To add a worker to this swarm, run the following command: docker swarm join \ --token SWMTKN-1-0sg2bj4onjvyaygcmcsftvx5z48f2r0oq6abg4izaflch9d8r8-dva3kq1zw7vrzjg8sav3e5mcs \ xxx.xxx.xxx.xxx:2377 To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions. 3. # docker service ls ID NAME MODE REPLICAS IMAGE 4. # echo "This is a secret" | docker secret create my_secret_data - 2ab8kotd9e9q9wcpe387tryez 5. # docker service create --name="httpd" --secret="my_secret_data" docker.io/httpd ri4wtno7wu93yfczzb93l6s8s Actual results: # docker service ps httpd --no-trunc ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS p6jrn0kybq8vjx69avb3xdcxc httpd.1 docker.io/httpd:latest@sha256:fc9b21c3faf2e1aa4cbe91d60df40a0d30ff151d8a5f5228d77fe5e0a18fa3c2 strigazi-fa26-swarm-mode-04.cern.ch Ready Ready 2 seconds ago yx2mquqmna77u8uxo7exgxc6m \_ httpd.1 docker.io/httpd:latest@sha256:fc9b21c3faf2e1aa4cbe91d60df40a0d30ff151d8a5f5228d77fe5e0a18fa3c2 strigazi-fa26-swarm-mode-04.cern.ch Shutdown Failed 2 seconds ago "starting container failed: RemoveSecretsPath failed: remove /var/lib/docker/containers/115332b56220016b062dcdd69f128775736f86605219d3081af848d5b4ca6a15/secrets/my_secret_data: read-only file system" Expected results: The service running, something like: # docker service ps redis ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS bkna6bpn8r1a redis.1 redis:alpine ip-172-31-46-109 Running Running 8 seconds ago