Can't create a working Docker jail

[Cellobita]

I have been unable to create a working Docker jail, even using the updated template (I have downloaded the current version of Jailmaker, 1.1.5). A few days ago I had some issues with Docker 26.0.2 (now superseded by 26.1.0), could it be that the new version requires adjustments to the template?

[Cellobita]

I'm using the latest template - enp3s0 is my NIC:

startup=0
gpu_passthrough_intel=1
gpu_passthrough_nvidia=0
# Turning off seccomp filtering improves performance at the expense of security
seccomp=1

# Use macvlan networking to provide an isolated network namespace,
# so docker can manage firewall rules
# Alternatively use --network-bridge=br1 instead of --network-macvlan
# Ensure to change eno1/br1 to the interface name you want to use
# You may want to add additional options here, e.g. bind mounts
systemd_nspawn_user_args=--network-macvlan=enp3s0
    --resolv-conf=bind-host
    --system-call-filter='add_key keyctl bpf'

# Script to run on the HOST before starting the jail
# Load kernel module and config kernel settings required for docker
pre_start_hook=#!/usr/bin/bash
    set -euo pipefail
    echo 'PRE_START_HOOK'
    echo 1 > /proc/sys/net/ipv4/ip_forward
    modprobe br_netfilter
    echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
    echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables

# Only used while creating the jail
distro=debian
release=bookworm

# Install docker inside the jail:
# https://docs.docker.com/engine/install/debian/#install-using-the-repository
# NOTE: this script will run in the host networking namespace and ignores
# all systemd_nspawn_user_args such as bind mounts
initial_setup=#!/usr/bin/bash
    set -euo pipefail

    apt-get update && apt-get -y install ca-certificates curl
    install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
    chmod a+r /etc/apt/keyrings/docker.asc

    echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian \
    $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
    tee /etc/apt/sources.list.d/docker.list > /dev/null
    apt-get update
    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

# You generally will not need to change the options below
systemd_run_default_args=--property=KillMode=mixed
    --property=Type=notify
    --property=RestartForceExitStatus=133
    --property=SuccessExitStatus=133
    --property=Delegate=yes
    --property=TasksMax=infinity
    --collect
    --setenv=SYSTEMD_NSPAWN_LOCK=0

systemd_nspawn_default_args=--keep-unit
    --quiet
    --boot
    --bind-ro=/sys/module
    --inaccessible=/sys/module/apparmor#                                                                                                                                              

[Lockszmith-GH]

I'm assuming you run with jlmkr create --start --confi...
Have you tried with gpu_passthrough_intel=0 instead of the 1 (top of the file)?
what is the failure output?

what is the output of the journalctl?

sudo journalctl -eu jlmkr-<name of jail>.service

[Cellobita]

I did a copy/paste from the docker config template, replacing en0 with enp3s0.

This is the error message, when trying to start the jail:

Starting jail wg with the following command:

systemd-run --property=KillMode=mixed --property=Type=notify --property=RestartForceExitStatus=133 --property=SuccessExitStatus=133 --property=Delegate=yes --property=TasksMax=infinity --collect --setenv=SYSTEMD_NSPAWN_LOCK=0 --unit=jlmkr-wg --working-directory=./jails/wg '--description=My nspawn jail wg [created with jailmaker]' --property=ExecStartPre=/mnt/Tank/jailmaker/jails/wg/.ExecStartPre -- systemd-nspawn --keep-unit --quiet --boot --bind-ro=/sys/module '--inaccessible=/sys/module/apparmor#' --machine=wg --directory=rootfs --bind=/dev/dri --network-bridge=br1 --resolv-conf=bind-host '--system-call-filter=add_key keyctl bpf'

Job for jlmkr-wg.service failed.
See "systemctl status jlmkr-wg.service" and "journalctl -xeu jlmkr-wg.service" for details.

Failed to start jail wg...
In case of a config error, you may fix it with:
jlmkr edit wg

root@SBServer[/mnt/Tank/jailmaker]# journalctl -xeu jlmkr-wg.service
░░ A start job for unit jlmkr-wg.service has finished with a failure.
░░ 
░░ The job identifier is 9787 and the job result is failed.
Apr 24 10:34:59 SBServer systemd[1]: Starting jlmkr-wg.service - My nspawn jail wg [created with jailmaker]...
░░ Subject: A start job for unit jlmkr-wg.service has begun execution
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit jlmkr-wg.service has begun execution.
░░ 
░░ The job identifier is 9864.
Apr 24 10:34:59 SBServer .ExecStartPre[1801679]: PRE_START_HOOK
Apr 24 10:34:59 SBServer systemd-nspawn[1801682]: Failed to resolve /mnt/Tank/jailmaker/jails/wg/rootfs//sys/module/apparmor#: No such file or directory
Apr 24 10:34:59 SBServer systemd[1]: jlmkr-wg.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ An ExecStart= process belonging to unit jlmkr-wg.service has exited.
░░ 
░░ The process' exit code is 'exited' and its exit status is 1.
Apr 24 10:34:59 SBServer systemd[1]: jlmkr-wg.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ The unit jlmkr-wg.service has entered the 'failed' state with result 'exit-code'.
Apr 24 10:34:59 SBServer systemd[1]: Failed to start jlmkr-wg.service - My nspawn jail wg [created with jailmaker].
░░ Subject: A start job for unit jlmkr-wg.service has failed
░░ Defined-By: systemd
░░ Support: https://www.debian.org/support
░░ 
░░ A start job for unit jlmkr-wg.service has finished with a failure.
░░ 
░░ The job identifier is 9864 and the job result is failed.
root@SBServer[/mnt/Tank/jailmaker]# systemctl status jlmkr-wg.service
Unit jlmkr-wg.service could not be found.
root@SBServer[/mnt/Tank/jailmaker]# 

[Jip-Hop]

Apr 24 10:34:59 SBServer systemd-nspawn[1801682]: Failed to resolve /mnt/Tank/jailmaker/jails/wg/rootfs//sys/module/apparmor#: No such file or directory

Could it be a typo? I think the # symbol should not be in the config file at the end of /sys/module/apparmor#

[Lockszmith-GH]

yep, you got it, look at the last line in the config you've pasted compared to the template

[Cellobita]

Did a copy/paste of the jailmaker/templates/docker/config file contents, while running the create command.

[Cellobita]

Nice catch, @Lockszmith-GH and @Jip-Hop - sorry for wasting your time. It was the # all along...

It is working, now. Thanks!