Created attachment 1850549 [details]
probe-system-calls.c

Created attachment 1850549 [details]
probe-system-calls.c

Created attachment 1850549 [details]
probe-system-calls.c

The attached program, when running under systemd-container-239-51.el8.x86_64, produces the following output for the arguments “400 430”:

400: -1 (errno 1 [EPERM])
401: -1 (errno 1 [EPERM])
402: -1 (errno 1 [EPERM])
403: -1 (errno 1 [EPERM])
404: -1 (errno 1 [EPERM])
405: -1 (errno 1 [EPERM])
406: -1 (errno 1 [EPERM])
407: -1 (errno 1 [EPERM])
408: -1 (errno 1 [EPERM])
409: -1 (errno 1 [EPERM])
410: -1 (errno 1 [EPERM])
411: -1 (errno 1 [EPERM])
412: -1 (errno 1 [EPERM])
413: -1 (errno 1 [EPERM])
414: -1 (errno 1 [EPERM])
415: -1 (errno 1 [EPERM])
416: -1 (errno 1 [EPERM])
417: -1 (errno 1 [EPERM])
418: -1 (errno 1 [EPERM])
419: -1 (errno 1 [EPERM])
420: -1 (errno 1 [EPERM])
421: -1 (errno 1 [EPERM])
422: -1 (errno 1 [EPERM])
423: -1 (errno 1 [EPERM])
424: -1 (errno 1 [EPERM])
425: -1 (errno 1 [EPERM])
426: -1 (errno 1 [EPERM])
427: -1 (errno 1 [EPERM])
428: -1 (errno 1 [EPERM])
429: -1 (errno 1 [EPERM])
430: -1 (errno 1 [EPERM])

This means that systemd-nspawn breaks various distributions that use newer system calls in glibc. Only ENOSYS triggers fallback, EPERM is treated as a regular system call error.

This causes errors like this one in mock:

Errors during downloading metadata for repository 'fedora':
  - Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=x86_64 [getaddrinfo() thread failed to start]
Error: Failed to download metadata for repo 'fedora': Cannot prepare internal mirrorlist: Curl error (6): Couldn't resolve host name for https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=x86_64 [getaddrinfo() thread failed to start]

For mock, the workaround is to use “simple” isolation (not systemd-nspawn). That is, add this line to /etc/mock/site-defaults.cfg:

config_opts['isolation'] = 'simple'

But ideally, this workaround should not be needed.

This appears to have been fixed in Fedora; I don't see these EPERM errors with systemd-container-249.7-2.fc35.x86_64.