Fedora Account System
Red Hat Associate
Red Hat Customer
+++ This bug was initially created as a clone of Bug #1880094 +++ Description of problem: running toolbox under fc33 get fail [martin@localhost ~]$ toolbox rm --force Error: failed to get the Podman version Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1.toolbox create 2.toolbox enter 3.get fail Actual results: Error: failed to start container fedora-toolbox-33 Additional info: --- Additional comment from Walter Francis on 2020-10-01 06:55:47 EDT --- $ toolbox create Created container: fedora-toolbox-33 Enter with: toolbox enter $ toolbox enter Error: failed to start container fedora-toolbox-33 Attaching log of debug output. --- Additional comment from Walter Francis on 2020-10-01 06:56:23 EDT --- Note; this is a freshly installed Fedora 33 beta, updated to the latest packages with dnf update. --- Additional comment from Debarshi Ray on 2020-10-01 14:16:08 EDT --- Could you please try: $ podman start --attach fedora-toolbox-33 --- Additional comment from Walter Francis on 2020-10-01 15:22:52 EDT --- $ podman start --attach fedora-toolbox-33 Error: unable to start container 8f5c99debf5591fe5763659bae0ca930b2cd52702678cebf6cd6c82f98212858: open /proc/sys/net/ipv4/ping_group_range: Permission denied: OCI runtime permission denied error --- Additional comment from Jens Petersen on 2020-10-02 04:58:20 EDT --- I see the same with fresh F33+ WS installs. Also with toolbox-0.0.96-1.fc34 --- Additional comment from Martin on 2020-10-02 11:40:20 EDT --- [martin@localhost ~]$ podman start --attach fedora-toolbox-33 Error: unable to start container e087d5cf66c87ec67772821db7a5ef2af13e3b415879085a8492bf0010c9d70c: open /proc/sys/net/ipv4/ping_group_range: Permission denied: OCI runtime permission denied error --- Additional comment from Walter Francis on 2020-10-02 11:51:22 EDT --- Looking at the ping_group_range in context, I found something specific to that here: https://github.com/containers/podman/blob/master/troubleshooting.md But even after fiddling about with some various values, nothing seemed to help. It did seem to have very sane values to begin with but I tried anyway. I might be missing something, or toolbox might have some independent settings somehow, I am not very familiar with toolbox, I've always used podman directly.
Dan, this occurs even with the package set in https://bodhi.fedoraproject.org/updates/FEDORA-2020-7b6058fec9
The issue here is in containers.conf from containers-common, IE Skopeo package. I have just released an update for a different problem, but this includes the ping_group_range setting. https://bodhi.fedoraproject.org/updates/FEDORA-2020-15e7ef1dcc Look in /usr/share/containers/containers.conf for the ping_group_range setting. It should only be being set for a range of 1 GID.
*** This bug has been marked as a duplicate of bug 1880094 ***
@Dan, yes, that's what I see as well: "net.ipv4.ping_group_range=0 1" But I see this issue when I use `podman run --net=host`. I'm not sure if that's deprecated, in the manpage I see `--network` but no `--net`.
They are aliases.