Created attachment 1806161 [details] podspec Description of problem: crictl create of a container fails with "PID namespace requested, but sandbox infra container invalid" in cri-o-1.22.0-12.rhaos4.9.git0fc6d47.el8.aarch64. this issue is not seen in cri-o-1.22.0-10.rhaos4.9.gite06cce2.el8.arch64 Version-Release number of selected component (if applicable): cri-o-1.22.0-12.rhaos4.9.git0fc6d47.el8.aarch64 How reproducible: all the time Steps to Reproduce: This issue was found in RHCOS kola tests running in the ARM pipeline.The kola test in question 1. creates a pod spec and a container spec 2. does a "sudo crictl runp <pod-spec>" 3. does a "sudo crictl create --no-pull <podID> <container-spec> <pod-spec>" The container and pod spec are attached Actual results: creates container successfully. Expected results: Additional info:
Created attachment 1806162 [details] sleepcontainer
The problem here is your pod and container spec don't match in the pid namespace they've requested. The pod spec has: ``` "namespace_options": { "pid": 1 }, ``` and the container spec does not have anything specified for namespace options. A namespace option of "1" means the request is requesting a container level pid namespace, so the pod does not create an infra container (which is only needed for a pod level pid namespace). However, when the container creation request comes around, the container fails because it is requesting a pod level pid namespace (value "0"), which does not exist. I recommend either dropping namespace_options from the pod spec, or adding it to the container spec.
I've opened a PR to improve the error message
Adding the namespace_option to the container spec fixed the issue. Thanks!!
https://github.com/coreos/coreos-assembler/pull/2359 to fix the coreos-assembler test.
both linked PRs have been merged, so this should be fixed (better error message, fixed test)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.10.3 security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:0056