podman complains about missing `dbus-launch` -- but I don't want to install a full desktop environment #9353

asottile · 2021-02-12T23:28:24Z

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

When I run any podman command as another user, I get this output:

$ sudo -u pcrunner podman ps
WARN[0000] Failed to add podman to systemd sandbox cgroup: exec: "dbus-launch": executable file not found in $PATH 
CONTAINER ID  IMAGE   COMMAND  CREATED  STATUS  PORTS   NAMES

dbus-launch on ubuntu is provided by the dbus-x11 package which pulls in a full x11 environment which I absolutely do not need on a headless server.

Steps to reproduce the issue:

run any podman command as another user

Describe the results you received:

see above

Describe the results you expected:

no extraneous output

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

$ sudo -u pcrunner podman version
WARN[0000] Failed to add podman to systemd sandbox cgroup: exec: "dbus-launch": executable file not found in $PATH 
Version:      3.0.0
API Version:  3.0.0
Go Version:   go1.15.2
Built:        Thu Jan  1 00:00:00 1970
OS/Arch:      linux/amd64

Output of podman info --debug:

$ sudo -u pcrunner podman info --debug
WARN[0000] Failed to add podman to systemd sandbox cgroup: exec: "dbus-launch": executable file not found in $PATH 
host:
  arch: amd64
  buildahVersion: 1.19.2
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: 'conmon: /usr/libexec/podman/conmon'
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.0.26, commit: '
  cpus: 1
  distribution:
    distribution: ubuntu
    version: "20.04"
  eventLogger: journald
  hostname: ip-172-31-79-82
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 2000
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 2000
      size: 1
    - container_id: 1
      host_id: 165536
      size: 65536
  kernel: 5.4.0-1037-aws
  linkmode: dynamic
  memFree: 82300928
  memTotal: 1026150400
  ociRuntime:
    name: crun
    package: 'crun: /usr/bin/crun'
    path: /usr/bin/crun
    version: |-
      crun version 0.17.6-58ef-dirty
      commit: fd582c529489c0738e7039cbc036781d1d039014
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  remoteSocket:
    path: /tmp/podman-run-2000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    selinuxEnabled: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: 'slirp4netns: /usr/bin/slirp4netns'
    version: |-
      slirp4netns version 1.1.8
      commit: unknown
      libslirp: 4.3.1-git
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.4.3
  swapFree: 0
  swapTotal: 0
  uptime: 44m 35.93s
registries: {}
store:
  configFile: /home/pcrunner/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mount_program:
      Executable: /usr/bin/fuse-overlayfs
      Package: 'fuse-overlayfs: /usr/bin/fuse-overlayfs'
      Version: |-
        fusermount3 version: 3.9.0
        fuse-overlayfs: version 1.4
        FUSE library version 3.9.0
        using FUSE kernel interface version 7.31
  graphRoot: /home/pcrunner/.local/share/containers/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 1
  runRoot: /tmp/containers-user-2000/containers
  volumePath: /home/pcrunner/.local/share/containers/storage/volumes
version:
  APIVersion: 3.0.0
  Built: 0
  BuiltTime: Thu Jan  1 00:00:00 1970
  GitCommit: ""
  GoVersion: go1.15.2
  OsArch: linux/amd64
  Version: 3.0.0

Package info (e.g. output of rpm -q podman or apt list podman):

$ apt list podman-rootless
Listing... Done
podman-rootless/unknown,now 100:3.0.0-1 amd64 [installed]
podman-rootless/unknown 100:3.0.0-1 arm64
podman-rootless/unknown 2.2.1~4 armhf
podman-rootless/unknown 100:3.0.0-1 s390x

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide?

Yes

Additional environment details (AWS, VirtualBox, physical, etc.):

AWS

The text was updated successfully, but these errors were encountered:

vrothberg · 2021-02-15T08:43:32Z

Thanks for reaching out!

Podman uses the systemd cgroup manager by default. You could change it to cgroupfs on the CLI via --cgroup-manager=cgroupfs or you tweak /usr/share/containers/containers.conf and set

[engine]
cgroup_manager="cgroupfs"

vrothberg · 2021-02-15T08:46:38Z

Please let me know if that works for you.

rhatdan · 2021-02-15T14:05:59Z

The containers.conf change should be made in /etc/containers/containers.conf

asottile · 2021-02-15T15:43:35Z

that changes the error message but doesn't fix it:

$ sudo -u pcrunner podman run --rm -ti ubuntu:focal echo
WARN[0000] Failed to add podman to systemd sandbox cgroup: dbus: couldn't determine address of session bus

asottile · 2021-02-15T15:44:31Z

and actually, if I install dbus-x11 (which I don't want to) it still doesn't work (this is with the default container config):

$ sudo -u pcrunner podman run --rm -ti ubuntu:focal echo
WARN[0000] Failed to add podman to systemd sandbox cgroup: dbus: couldn't determine address of session bus

vrothberg · 2021-02-15T15:48:20Z

Can you try with sudo --login -u? It looks like the systemd session of the pcrunner user is not complete.

asottile · 2021-02-15T15:51:02Z

It's meant to be a service user only -- does podman require a full login session?

asottile · 2021-02-15T15:51:48Z

(fwiw, this prints -- as I expect for service users):

$ sudo --login -u pcrunner podman run --rm -ti ubuntu:focal echo
This account is currently not available.

al-cheb · 2021-02-15T17:48:56Z

I can reproduce the same behavior on Ubuntu 18.04. Starting with podman 3.0.0 one of dependence is dbus-user-session which breaks our CI with Az.Accounts powershell module. Is it possible to eliminate installation the dbus-user-session pkg?

$ pwsh -command "Import-Module Az.Accounts"
** Message: 17:43:58.624: Remote error from secret service: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.secrets was not provided by any .service files
** Message: 17:43:58.630: Remote error from secret service: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.secrets was not provided by any .service files
** Message: 17:43:58.633: Remote error from secret service: org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.secrets was not provided by any .service files

journalclt -e

Feb 15 17:43:58  powershell[16735]: Microsoft.Identity.Client.Extensions.TraceSource Error: 0 :
Feb 15 17:43:58  powershell[16735]: [MSAL.Extension][2021-02-15T17:43:58.6249328Z] An error was encountered while saving secret to keyring in the MsalCacheStorage domain:'95' co
Feb 15 17:43:58  powershell[16735]: Microsoft.Identity.Client.Extensions.TraceSource Error: 0 :
Feb 15 17:43:58  powershell[16735]: [MSAL.Extension][2021-02-15T17:43:58.6308996Z] An error was encountered while reading secret from keyring in the MsalCacheStorage domain:'95'
Feb 15 17:43:58  powershell[16735]: Microsoft.Identity.Client.Extensions.TraceSource Error: 0 :
Feb 15 17:43:58  powershell[16735]: [MSAL.Extension][2021-02-15T17:43:58.6340969Z] An error was encountered while clearing secret from keyring in the MsalCacheStorage domain:'95

lsb_release -a

No LSB modules are available.
Distributor ID:Ubuntu
Description:Ubuntu 18.04.5 LTS
Release:18.04
Codename:bionic

Warnings don't reproduce with sudo:

$ sudo --login -u test pwsh -command "Import-Module Az.Accounts;Get-Module"

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.2.5                 Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}

ocafebabe · 2021-02-15T22:44:15Z

I'm observing the same behaviour with a fresh podman 3.0.0 install on Ubuntu 20.04...

I never had this issue with podman 2.2.1 on my other Ubuntu 20.04 servers, what has been changed in the latest release?

asottile · 2021-02-16T00:04:53Z

I'm observing the same behaviour with a fresh podman 3.0.0 install on Ubuntu 20.04...

I never had this issue with podman 2.2.1 on my other Ubuntu 20.04 servers, what has been changed in the latest release?

I believe the reason it is just showing up now is the default log level changed from ERROR => WARN in 3.0.0

ocafebabe · 2021-02-16T00:11:51Z

I'm observing the same behaviour with a fresh podman 3.0.0 install on Ubuntu 20.04...
I never had this issue with podman 2.2.1 on my other Ubuntu 20.04 servers, what has been changed in the latest release?

I believe the reason it is just showing up now is the default log level changed from ERROR => WARN in 3.0.0

This really sucks because now I get false-positive alerts whenever podman is invoked as this gets printed during crontab task executions.

BTW my use case is similar to yours: service account (accessed using sudo -u xxxxx -i) running on headless servers.

asottile · 2021-02-16T00:23:18Z

I'm currently hacking around the warning with --log-level error (in a commit that I hope to revert once this issue is fixed)

rhatdan · 2021-02-16T20:05:15Z

Are you saying that you changed the containers.conf to use cgroupfs for cgroup-manager, but you are still seeing it attempt to use dbus-launch?

asottile · 2021-02-16T20:12:36Z

yes:

$ grep cgroup_manager /etc/containers/containers.conf
cgroup_manager = "cgroupfs"
$ sudo -u pcrunner podman run ubuntu:focal echo
WARN[0000] Failed to add podman to systemd sandbox cgroup: dbus: couldn't determine address of session bus

rhatdan · 2021-02-16T21:06:00Z

What about the log_driver? Is this set to journald?

rhatdan · 2021-02-16T21:07:14Z

# events_logger = "journald"

asottile · 2021-02-16T21:08:01Z

it's set to whatever the default is:

$ grep log_d -- /etc/containers/containers.conf 
# log_driver = "k8s-file"

rhatdan · 2021-02-16T21:24:52Z

Uncomment that line and see if the problem goes away.

asottile · 2021-02-16T21:33:39Z

no dice

$ grep -E '(cgroup_|log_d)' /etc/containers/containers.conf 
log_driver = "k8s-file"
cgroup_manager = "cgroupfs"
$ sudo -u pcrunner podman run ubuntu:focal echo
WARN[0000] Failed to add podman to systemd sandbox cgroup: dbus: couldn't determine address of session bus

rhatdan · 2021-02-17T01:12:58Z

func (ic *ContainerEngine) SetupRootless(_ context.Context, cmd *cobra.Command) error {
	// do it only after podman has already re-execed and running with uid==0.
	if os.Geteuid() == 0 {
		ownsCgroup, err := cgroups.UserOwnsCurrentSystemdCgroup()
		if err != nil {
			logrus.Warnf("Failed to detect the owner for the current cgroup: %v", err)
		}
		if !ownsCgroup {
			conf, err := ic.Config(context.Background())
			if err != nil {
				return err
			}

			initCommand, err := ioutil.ReadFile("/proc/1/comm")
			// On errors, default to systemd
			runsUnderSystemd := err != nil || strings.TrimRight(string(initCommand), "\n") == "systemd"

			unitName := fmt.Sprintf("podman-%d.scope", os.Getpid())
			if runsUnderSystemd || conf.Engine.CgroupManager == config.SystemdCgroupsManager {
				if err := utils.RunUnderSystemdScope(os.Getpid(), "user.slice", unitName); err != nil {
					logrus.Warnf("Failed to add podman to systemd sandbox cgroup: %v", err)
				}
			}
		}
		return nil
	}
...

rhatdan · 2021-02-17T01:14:23Z

@giuseppe WDYT? Should we handle the lack of dbus_launch better, IE Not Warn?

ocafebabe · 2021-02-17T01:34:10Z

@giuseppe WDYT? Should we handle the lack of dbus_launch better, IE Not Warn?

Could you please explain why "dbus_launch" is important for podman?

vrothberg · 2021-02-17T09:19:34Z

It's meant to be a service user only -- does podman require a full login session?

It'll work without a full login session but the storage paths may differ when logging in. Since you intend it to be service-only user, it's good.

@giuseppe WDYT? Should we handle the lack of dbus_launch better, IE Not Warn?

I think it should be a debug log.

if the current process could not be moved to a different systemd cgroup do not raise a warning but debug message. Closes: containers#9353 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe · 2021-02-17T10:47:42Z

dbus-launch is used by github.com/godbus/dbus/v5/conn_other.go.

I am fine to downgrade the warning to a debug message: opened a PR: #9407

if the current process could not be moved to a different systemd cgroup do not raise a warning but debug message. Closes: containers#9353 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

if the current process could not be moved to a different systemd cgroup do not raise a warning but debug message. [NO TESTS NEEDED] Closes: containers#9353 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

openshift-ci-robot added the kind/bug Categorizes issue or PR as related to a bug. label Feb 12, 2021

giuseppe mentioned this issue Feb 17, 2021

[NO TEST NEEDED] infra: downgrade warning to debug #9407

Merged

openshift-merge-robot closed this as completed in #9407 Feb 17, 2021

tetchel mentioned this issue Feb 20, 2021

systemd warning logged every time podman is executed redhat-actions/push-to-registry#28

Closed

al-cheb mentioned this issue Feb 22, 2021

Podman cannot mount /etc/localtime in some containers on ubuntu-20.04 actions/runner-images#2759

Closed

7 tasks

BenTheElder mentioned this issue Feb 24, 2021

cluster creation is failing in podman CI kubernetes-sigs/kind#2085

Closed

hswong3i mentioned this issue Dec 14, 2022

Warning "dbus-launch": executable file not found in $PATH alvistack/ansible-role-podman#17

Closed

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 22, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

podman complains about missing `dbus-launch` -- but I don't want to install a full desktop environment #9353

podman complains about missing `dbus-launch` -- but I don't want to install a full desktop environment #9353

asottile commented Feb 12, 2021

vrothberg commented Feb 15, 2021 •

edited

vrothberg commented Feb 15, 2021

rhatdan commented Feb 15, 2021

asottile commented Feb 15, 2021

asottile commented Feb 15, 2021

vrothberg commented Feb 15, 2021 •

edited

asottile commented Feb 15, 2021

asottile commented Feb 15, 2021

al-cheb commented Feb 15, 2021 •

edited

ocafebabe commented Feb 15, 2021

asottile commented Feb 16, 2021

ocafebabe commented Feb 16, 2021

asottile commented Feb 16, 2021

rhatdan commented Feb 16, 2021

asottile commented Feb 16, 2021

rhatdan commented Feb 16, 2021

rhatdan commented Feb 16, 2021 •

edited

asottile commented Feb 16, 2021

rhatdan commented Feb 16, 2021

asottile commented Feb 16, 2021

rhatdan commented Feb 17, 2021 •

edited

rhatdan commented Feb 17, 2021

ocafebabe commented Feb 17, 2021

vrothberg commented Feb 17, 2021

giuseppe commented Feb 17, 2021

podman complains about missing dbus-launch -- but I don't want to install a full desktop environment #9353

podman complains about missing dbus-launch -- but I don't want to install a full desktop environment #9353

Comments

asottile commented Feb 12, 2021

vrothberg commented Feb 15, 2021 • edited

vrothberg commented Feb 15, 2021

rhatdan commented Feb 15, 2021

asottile commented Feb 15, 2021

asottile commented Feb 15, 2021

vrothberg commented Feb 15, 2021 • edited

asottile commented Feb 15, 2021

asottile commented Feb 15, 2021

al-cheb commented Feb 15, 2021 • edited

ocafebabe commented Feb 15, 2021

asottile commented Feb 16, 2021

ocafebabe commented Feb 16, 2021

asottile commented Feb 16, 2021

rhatdan commented Feb 16, 2021

asottile commented Feb 16, 2021

rhatdan commented Feb 16, 2021

rhatdan commented Feb 16, 2021 • edited

asottile commented Feb 16, 2021

rhatdan commented Feb 16, 2021

asottile commented Feb 16, 2021

rhatdan commented Feb 17, 2021 • edited

rhatdan commented Feb 17, 2021

ocafebabe commented Feb 17, 2021

vrothberg commented Feb 17, 2021

giuseppe commented Feb 17, 2021

podman complains about missing `dbus-launch` -- but I don't want to install a full desktop environment #9353

podman complains about missing `dbus-launch` -- but I don't want to install a full desktop environment #9353

vrothberg commented Feb 15, 2021 •

edited

vrothberg commented Feb 15, 2021 •

edited

al-cheb commented Feb 15, 2021 •

edited

rhatdan commented Feb 16, 2021 •

edited

rhatdan commented Feb 17, 2021 •

edited