Bug 1655214 - docker exec does not work with registry.access.redhat.com/rhel7:7.3
Summary: docker exec does not work with registry.access.redhat.com/rhel7:7.3
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: docker   
(Show other bugs)
Version: 7.6
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: rc
: ---
Assignee: Frantisek Kluknavsky
QA Contact: atomic-bugs@redhat.com
URL:
Whiteboard:
Keywords: Extras, Regression
: 1655971 1655975 1656119 (view as bug list)
Depends On:
Blocks: 1186913 1636853
TreeView+ depends on / blocked
 
Reported: 2018-12-01 09:44 UTC by Jan Pazdziora
Modified: 2019-03-06 00:58 UTC (History)
41 users (show)

Fixed In Version: docker-1.13.1-88.git07f3374.el7_6
Doc Type: Bug Fix
Doc Text:
Cause: The docker-runc binary used by docker shipped in 7.6.1 Extras was built with an older version of golang which had a bug leading to a crash in certain FIPS modes. Consequence: docker didn't work with some images. Fix: a new docker package with docker-runc has been built with an updated golang dependency to take care of FIPS compliance. Result: docker works as expected.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-12-06 19:57:30 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3796 None None None 2018-12-06 19:57 UTC
Red Hat Knowledge Base (Solution) 3734981 None None None 2018-12-04 15:28 UTC

Description Jan Pazdziora 2018-12-01 09:44:06 UTC
Description of problem:

When container is started from image registry.access.redhat.com/rhel7:7.3, docker exec then always fails.

Version-Release number of selected component (if applicable):

docker-1.13.1-84.git07f3374.el7.x86_64

How reproducible:

Deterministic.

Steps to Reproduce:
1. docker run --name test -d --rm registry.access.redhat.com/rhel7:7.3 sleep 10
2. docker exec test date

Actual results:

rpc error: code = 2 desc = oci runtime error: exec failed: container_linux.go:247: starting container process caused "process_linux.go:110: decoding init error from pipe caused \"read parent: connection reset by peer\""

Expected results:

Sat Dec  1 09:42:33 UTC 2018

Additional info:

This is regression against RHEL 7.5 and its docker-1.13.1-75.git8633870.el7_5.x86_64.

This affects rhel7/ipa-server container upgrade testing from version rhel7/ipa-server:4.4.0.

Things work with registry.access.redhat.com/rhel7:7.4 and newer.

Comment 3 Mickaël Canévet 2018-12-03 08:58:22 UTC
I can reproduce. Some images are working, and some other don't:

Working images:
- registry.access.redhat.com/rhel7:7.4
- registry.access.redhat.com/rhel7:7.5
- registry.access.redhat.com/rhel7:7.6
- centos:7

Not working images:
- registry.access.redhat.com/rhel7:7.3
- debian:9
- ubuntu:18.04

It used to work on RHEL 7.5

Comment 4 Jan Pazdziora 2018-12-04 16:47:15 UTC
The problem is also present with images
- registry.fedoraproject.org/fedora:rawhide
- registry.fedoraproject.org/fedora:29
- registry.fedoraproject.org/fedora:28

So it looks like anything that is not recent registry.access.redhat.com/rhel7 or centos image is not usable by latest docker.

Let me increate the severity and priority of this bug.

Comment 6 Derrick Ornelas 2018-12-04 19:07:06 UTC
Lokesh, is this a duplicate of Bug 1650512 - podman exec faile with "panic: boringcrypto: not in FIPS mode" ?

Comment 7 Derrick Ornelas 2018-12-04 19:14:01 UTC
Sorry, I meant is this related?  The runc BZ is already closed with errata.

Comment 8 Derrick Ornelas 2018-12-04 21:12:23 UTC
*** Bug 1655975 has been marked as a duplicate of this bug. ***

Comment 9 Juan Vallejo 2018-12-04 22:10:16 UTC
*** Bug 1655971 has been marked as a duplicate of this bug. ***

Comment 10 Pavel Šefránek 2018-12-05 07:58:08 UTC
More images could be affected - for example I can reproduce this bug with image https://hub.docker.com/r/andyshinn/dnsmasq/. 

This issue is also mentioned on SO: https://stackoverflow.com/questions/53605666/cant-execute-bash-in-docker-container

Comment 11 Scott Dodson 2018-12-05 17:40:12 UTC
*** Bug 1656119 has been marked as a duplicate of this bug. ***

Comment 12 Swami Viswanathan 2018-12-05 19:46:16 UTC
We see this issue with centos 6.x based containers as well. Downgrade workaround works. Also upgrading to docker-1.13.1-87.git07f3374.el7.x86_64.rpm worked as well. We picked the rpms from 

https://cbs.centos.org/koji/buildinfo?buildID=24652

Comment 19 errata-xmlrpc 2018-12-06 19:57:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3796

Comment 20 William Brown 2018-12-08 23:42:58 UTC
PID=docker inspect --format {{.State.Pid}} <name of container>

nsenter --target $PID --mount --uts --ipc --net --pid /bin/sh

Is a possible temporary workaround to this issue


Note You need to log in before you can comment on or make changes to this bug.