Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.10 backport] rootless: bind mount: fix "operation not permitted" #42233

Merged
merged 1 commit into from Apr 1, 2021
Merged

[20.10 backport] rootless: bind mount: fix "operation not permitted" #42233

merged 1 commit into from Apr 1, 2021

Conversation

AkihiroSuda
Copy link
Member

@AkihiroSuda AkihiroSuda commented Apr 1, 2021 •
edited by thaJeztah

Cherry-pick #42230

- What I did
Fix #42090

Fix #41876

Fix the following issue

$ sudo mount -t tmpfs -o noexec none /tmp/foo
$ docker --context=rootless run -it --rm -v /tmp/foo:/mnt:ro alpine
docker: Error response from daemon: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:520: container init caused: rootfs_linux.go:60: mounting "/tmp/foo" to rootfs at "/home/suda/.local/share/docker/overlay2/b8e7ea02f6ef51247f7f10c7fb26edbfb308d2af8a2c77915260408ed3b0a8ec/merged/mnt" caused: operation not permitted: unknown.

- How I did it

Call getUnprivilegedMountFlags(m.Source)

- How to verify it

$ sudo mount -t tmpfs -o noexec none /tmp/foo
$ docker --context=rootless run -it --rm -v /tmp/foo:/mnt:ro alpine

- Description for the changelog

rootless: bind mount: fix "operation not permitted"

- A picture of a cute animal (not mandatory but encouraged)
馃惂

@AkihiroSuda
rootless: bind mount: fix "operation not permitted"
e974cb6 
The following was failing previously, because `getUnprivilegedMountFlags()` was not called:
```console
$ sudo mount -t tmpfs -o noexec none /tmp/foo
$ $ docker --context=rootless run -it --rm -v /tmp/foo:/mnt:ro alpine
docker: Error response from daemon: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:520: container init caused: rootfs_linux.go:60: mounting "/tmp/foo" to rootfs at "/home/suda/.local/share/docker/overlay2/b8e7ea02f6ef51247f7f10c7fb26edbfb308d2af8a2c77915260408ed3b0a8ec/merged/mnt" caused: operation not permitted: unknown.
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit 248f98e)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
@AkihiroSuda AkihiroSuda added area/rootless Rootless mode kind/bugfix PR's that fix bugs labels Apr 1, 2021
@AkihiroSuda AkihiroSuda added this to the 20.10.6 milestone Apr 1, 2021
@AkihiroSuda AkihiroSuda mentioned this pull request Apr 1, 2021
Closed
thaJeztah
thaJeztah approved these changes Apr 1, 2021
View reviewed changes
Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thaJeztah
Copy link
Member

Never seen this message (illegal wireType 7)

[2021-04-01T09:54:37.212Z] + docker build --force-rm --build-arg APT_MIRROR -t docker:e974cb638c384a45b5223f839d7c2bce7453f59c .
[2021-04-01T09:54:37.212Z] #2 [internal] load .dockerignore
[2021-04-01T09:54:37.212Z] #2 transferring context: 87B done
[2021-04-01T09:54:37.212Z] #2 DONE 0.0s
[2021-04-01T09:54:37.212Z] 
[2021-04-01T09:54:37.212Z] #1 [internal] load build definition from Dockerfile
[2021-04-01T09:54:37.212Z] #1 ERROR: proto: illegal wireType 7
[2021-04-01T09:54:37.212Z] ------
[2021-04-01T09:54:37.212Z]  > [internal] load build definition from Dockerfile:
[2021-04-01T09:54:37.212Z] ------
[2021-04-01T09:54:37.212Z] failed to solve with frontend dockerfile.v0: failed to resolve dockerfile: failed to build LLB: proto: illegal wireType 7

@tiborvass tiborvass merged commit 88bd96d into moby:20.10 Apr 1, 2021
@AkihiroSuda AkihiroSuda mentioned this pull request Apr 6, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tiborvass tiborvass tiborvass approved these changes

@thaJeztah thaJeztah thaJeztah approved these changes

Assignees
No one assigned
Labels
area/rootless Rootless mode kind/bugfix PR's that fix bugs status/4-merge
Projects
None yet
Milestone
20.10.6
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@AkihiroSuda @thaJeztah @tiborvass