-
Notifications
You must be signed in to change notification settings - Fork 2.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Podman failed to mount runtime directory for rootless netns: no such file or directory #13703
Comments
The error
|
When you run podman on a non systemd system we should not try to move the process under a new systemd scope. Ref containers#13703 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When you run podman on a non systemd system we should not try to move the process under a new systemd scope. [NO NEW TESTS NEEDED] Ref containers#13703 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
I do have selinux installed but getenforce reports that it's in permissive mode. These are the logs I could find related to podman in /var/log/messages: http://dpaste.com/FRZSBJKZL Edit and podman related entried in audit.log: http://dpaste.com/4BEM47HHL |
We are tying to label it with the iptables_var_run_t type, is that available on your system? |
These are the packages I have related to iptables:
|
This is not about missing binaries, you are missing a selinux policy which provides this selinux type. |
This looks like you have a custom policy and not the default policy. Your policy does not support MLS labels (MCS) which Podman relies on for container separation. Someone wrote podman_t types, and the person writing and shipping this policy needs to diagnose and figure out what is going on. This is not something the upstream podman team can fix. |
I would be willing to work with whomever wrote this policy, but this is not a Podman issue. |
When you run podman on a non systemd system we should not try to move the process under a new systemd scope. [NO NEW TESTS NEEDED] Ref containers#13703 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
When you run podman on a non systemd system we should not try to move the process under a new systemd scope. [NO NEW TESTS NEEDED] Ref containers#13703 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Could it be related to this? opencontainers/selinux#171 |
It could be, but I thought some fixes had gone in for this. |
I ran into this, found the ultimate issue was
|
@rhatdan For the record, I'm certain this is the policy I originally wrote and upstreamed to refpolicy which is now part of Gentoo's policy. I agree I don't think it's a bug in podman but unfortunately I can't provide more details without seeing any AVCs, and I never ran into this issue during the policy's development. opencontainers/selinux#171 is a separate issue. |
This is the most recent audit log: http://sprunge.us/2a3zQC |
@fraschm1998 Looks like your system is badly mislabeled. touch /.autorelabel; reboot |
The behavior for running podman as an unconfined user in refpolicy has changed recently, but that change is not part of Gentoo's policy yet. If you aren't hitting this issue while SELinux is in permissive mode, I suggest filing a bug in the Gentoo bug tracker since that would indicate the problem is outside the scope of Podman. |
When you run podman on a non systemd system we should not try to move the process under a new systemd scope. [NO NEW TESTS NEEDED] Ref containers#13703 Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
Steps to reproduce the issue:
Describe the results you received:
Podman failed to mount runtime directory for rootless netns: no such file or directory. I'm not sure if it's an issue with SELinux: https://dpaste.com/ANRM893KY
I found where the error message is printed (lines 128-138): https://fossies.org/linux/podman/libpod/networking_linux.go
echo $XDG_RUNTIME_DIR prints: /run/user/1000
Edit according to lines 114-119 it seems as tho I need to have the following binds mounted:
However in /run/user/1000 the only file related to netns is /run/user/1000/netns/rootless-netns-*
fd rootless in /
Edit I tried starting up the container again after doing podman system reset and get this:
Output of
podman version
:Output of
podman info --debug
:Package info (e.g. output of
rpm -q podman
orapt list podman
):Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)
Yes
Additional environment details (AWS, VirtualBox, physical, etc.):
Gentoo SeLinux Openrc
The text was updated successfully, but these errors were encountered: