Crash on a docker dind environment

[soullivaneuh]

Which the following GitLab CI configuration, which is run under docker dind:

image: docker

services:
  - docker:dind

variables:
  DOCKER_DRIVER: overlay2
  PORTS_FIRST_NUMBER: 8

before_script:
  - docker info
  - apk add --update bash python py-pip python-dev
  - pip install docker-compose
  - ./configure
  - docker-compose up -d
  - docker-compose ps
  - docker-compose logs mysql
  - docker-compose exec -T console make install

stages:
  - lint
  - test

lint:
  stage: lint
  script:
    - docker-compose exec -T console make lint

test:
  stage: test
  script:
    - docker-compose exec -T console make test

I get a crash on MySQL:

$ docker-compose ps
       Name                      Command               State                                       Ports                                   
-------------------------------------------------------------------------------------------------------------------------------------------
project_apache_1     /entrypoint.sh apache2-for ...   Up       0.0.0.0:8000->80/tcp                                                       
project_console_1    /entrypoint.sh tail -f /de ...   Up                                                                                  
project_data_1       /bin/sh                          Exit 0                                                                              
project_docker_1     dockerd-entrypoint.sh            Up       2375/tcp                                                                   
project_mysql_1      docker-entrypoint.sh mysqld      Exit 1                                                                              
project_ngrok_1      /entrypoint.sh                   Up       0.0.0.0:8040->4040/tcp                                                     
project_pma_1        /run.sh phpmyadmin               Up       0.0.0.0:8100->80/tcp                                                       
project_rabbitmq_1   docker-entrypoint.sh rabbi ...   Up       15671/tcp, 0.0.0.0:8200->15672/tcp, 25672/tcp, 4369/tcp, 5671/tcp, 5672/tcp
$ docker-compose logs mysql
Attaching to lintocop_mysql_1
mysql_1     | 
mysql_1     | ERROR: mysqld failed while attempting to check config
mysql_1     | command was: "mysqld --verbose --help"
mysql_1     | 
mysql_1     | mysqld: error while loading shared libraries: libpthread.so.0: cannot stat shared object: Permission denied

As you can see, all the other service are up and running. So I guess this issue is related to this repository.

I don't have the issue on my local (without dind), but I don't know why this issue...

[yosifkit]

Seems to be related to this stackoverflow and moby/moby#7512.

[tianon]

So this is a AppArmor / Docker issue and there's nothing we can do to fix this image. 😞

[soullivaneuh]

@tianon @yosifkit well, could it be possible to have a little bit more details?

AFAIK, I don't personally use Moby. So why this should be related. Or maybe it's just an example?

So this is a AppArmor / Docker

Could you please elaborate? Any possible solution or maybe a link to an issue?

Thanks!

[yosifkit]

Moby == http://github.com/docker/docker; it is the new name for the project that is docker.

Basically, the MySQL container inherits the AppArmor unconfined that is given to the dind container (which can only run as privileged) rather than getting the Docker AppArmor profile that is applied to normal container runs. The rest of what happens is explained in moby/moby#7512 (comment). So my interpretation of that is that if you have control of the gitlab CI host, then remove AppArmor profiles installed; otherwise don't run MySQL in a dind environment on a host with AppArmor.