Can't start docker container sysdig

[pascalandy]

Hello folks,

From page http://www.sysdig.org/install/, I tried to run:

docker run -it \
--name sysdig \
--privileged \
-v /var/run/docker.sock:/host/var/run/docker.sock \
-v /dev:/host/dev \
-v /proc:/host/proc:ro \
-v /boot:/host/boot:ro \
-v /lib/modules:/host/lib/modules:ro \
-v /usr:/host/usr:ro \
sysdig/sysdig

But I get this error message:

* Setting up /usr/src links from host
* Unloading sysdig-probe, if present
rmmod: ERROR: Module sysdig_probe is not currently loaded
* Running dkms autoinstall
Error! echo
Your kernel headers for kernel 4.8.14-docker-2 cannot be found at
/lib/modules/4.8.14-docker-2/build or /lib/modules/4.8.14-docker-2/source.
* Trying to load a system sysdig-probe, if present
* Trying to load a dkms sysdig-probe, if present
* Trying to find precompiled sysdig-probe for 4.8.14-docker-2
Found kernel config at /proc/config.gz
* Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/sysdig-probe-0.14.0-x86_64-4.8.14-docker-2-537c3a6756feb1802d5b0227ca6d2111.ko
Download failed, consider compiling your own sysdig-probe and loading it or getting in touch with the sysdig community
root@ea8b542ee43a:/# ^C

About about sysdig-probe? What's missing ?

Cheers!

[luca3m]

You have not installed kernel headers in your host machine:

Your kernel headers for kernel 4.8.14-docker-2 cannot be found at
/lib/modules/4.8.14-docker-2/build or /lib/modules/4.8.14-docker-2/source.

[pascalandy]

Trying to install:

apt-get -qq -y install linux-headers-$(uname -r)
E: Unable to locate package linux-headers-4.8.14

$ uname -r
4.8.14-docker-2

$ apt-get -qq -y install linux-headers-4.8.14
E: Unable to locate package linux-headers-4.8.14

but I can't :(

I'm using a VPS from scaleway.
Pascal

[gajus]

Same problem here.

[smith3v]

Container doesn't work.

$ docker run --rm -it --name=sysdig --privileged=true --volume=/var/run/docker.sock:/host/var/run/docker.sock sysdig/sysdig              [10:34:19]
* Setting up /usr/src links from host
ls: cannot access '/host/usr/src': No such file or directory
* Unloading sysdig-probe, if present
rmmod: ERROR: ../libkmod/libkmod.c:514 lookup_builtin_file() could not open builtin file '/lib/modules/4.9.12-moby/modules.builtin.bin'
rmmod: ERROR: Module sysdig_probe is not currently loaded
* Running dkms autoinstall
Error! echo
Your kernel headers for kernel 4.9.12-moby cannot be found at
/lib/modules/4.9.12-moby/build or /lib/modules/4.9.12-moby/source.
* Trying to load a system sysdig-probe, if present
* Trying to load a dkms sysdig-probe, if present
* Trying to find precompiled sysdig-probe for 4.9.12-moby
Found kernel config at /proc/config.gz
* Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/stable/sysdig-probe-binaries/sysdig-probe-0.15.0-x86_64-4.9.12-moby-ffd4edca48be3be2a5aad8dc495c3678.ko
Download failed, consider compiling your own sysdig-probe and loading it or getting in touch with the sysdig community

The same issue with the latest dev build

$ docker run --rm -it --name=sysdig --privileged=true --volume=/var/run/docker.sock:/host/var/run/docker.sock sysdig/sysdig:dev          [10:41:29]
Unable to find image 'sysdig/sysdig:dev' locally
dev: Pulling from sysdig/sysdig
9ae0ca2913d5: Pull complete
afda7e7efecb: Pull complete
c9f13692710a: Pull complete
5bf0f64a8099: Pull complete
9b7a3ec2dbfb: Pull complete
bdaf5cb54987: Pull complete
20b48f78e5b4: Pull complete
19ba590ebc22: Pull complete
Digest: sha256:3e1d26d3da17d580b5a73b9e032962dfa1f8b0df9582cb0d22015992dfe335fa
Status: Downloaded newer image for sysdig/sysdig:dev
* Setting up /usr/src links from host
ls: cannot access '/host/usr/src': No such file or directory
* Unloading sysdig-probe, if present
rmmod: ERROR: ../libkmod/libkmod.c:514 lookup_builtin_file() could not open builtin file '/lib/modules/4.9.12-moby/modules.builtin.bin'
rmmod: ERROR: Module sysdig_probe is not currently loaded
* Running dkms autoinstall
Error! echo
Your kernel headers for kernel 4.9.12-moby cannot be found at
/lib/modules/4.9.12-moby/build or /lib/modules/4.9.12-moby/source.
* Trying to load a system sysdig-probe, if present
* Trying to load a dkms sysdig-probe, if present
* Trying to find precompiled sysdig-probe for 4.9.12-moby
Found kernel config at /proc/config.gz
* Trying to download precompiled module from https://s3.amazonaws.com/download.draios.com/dev/sysdig-probe-binaries/sysdig-probe-0.99.2300dev-x86_64-4.9.12-moby-ffd4edca48be3be2a5aad8dc495c3678.ko
Download failed, consider compiling your own sysdig-probe and loading it or getting in touch with the sysdig community

I'm trying to start sysdig/sysdig from Docker Hub. I suppose, it should already contain all necessary kernel headers and/or kernel modules. Am I missing something?

[luca3m]

Right now we don't support docker4mac or docker4aws. We are working on it, meanwhile you can use the workaround explained here: #637 (comment)

[eaorak]

Any advancement on this issue? I'm trying to install sysdig to Ubuntu Xenial (16.04 latest) with x86_64 4.10.8 docker #1 bootscript but apt can not locate the linux-headers package:

root@server:~# apt-get -qq -y install linux-headers-$(uname -r)
E: Unable to locate package linux-headers-4.10.8-docker-1
E: Couldn't find any package by glob 'linux-headers-4.10.8-docker-1'
E: Couldn't find any package by regex 'linux-headers-4.10.8-docker-1'

Is there any solution?

[ketank-new]

@eaorak : can you try the following

apt-cache search linux-headers ( This will list u all the ones present in repo, install the latest one)

It might not be the case in which the headers of the base kernel are in repository

[eaorak]

@ketank-new Thanks for the suggestion but I've given up after trying many different things. I've decided to use CAdvisor instead.

But I don't think your suggestion would solve the problem cause the machine I'm trying to install sysdig on uses a custom built kernel by Scaleway which is not in package repository.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.