New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
userns doesn't work on ubuntu-xenial #769
Comments
Same problem on my host with docker 1.10.3-cs2 after upgrade to xenial (4.4.0-21-generic) mount(2) of mqueue returns EPERM with --ipc=host and EBUSY without. |
I suspect a bug in the Xenial kernel as there is no such issue on Fedora 23 with 4.4.6 kernel or rawhide that tracks upstream kernel 4.6.0.rc*. |
I agree that it's almost certainly a Xenial-specific kernel bug. Tumbleweed doesn't have this problem with its stock kernel (4.5.x) and I compiled 4.6-rc5 yesterday to play with cgroup namespaces and that didn't have this problem either. |
I can start lxd userns containers on xenial and /dev/mqueue is mounted inside them successfully, so somehow this bug is specific to runc
|
And this is what I get in docker: without --ipc=host
and with --ipc=host
|
@iavael Can you reproduce this just with runc and no overlay rootfs (to rule out overlayfs)? |
Did it with runc 0.1.1 from github releases
Tested on exported and chown-ed uid/gid+65535 docker busybox image and default config.json with added userns and uid/gidmapping sections. |
changing mqueue mount section to {
"destination": "/dev/mqueue",
"type": "bind",
"source": "/dev/mqueue",
"options": [
"rbind"
]
}, resolves (more likely kludges) the problem in runc in exchange for posix mq isolation |
Any news on that ? |
I did some digging and suspect this ubuntu specific commit http://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/commit/fs/super.c?id=b6500fda5c9f2402830000d9f992861e5a91231b |
@mrunalp Yeah, it looks like the problems with |
It's been quite a few months. No update on this? |
@CRTX bug was fixed in linux-image-4.4.0-25-generic kernel |
@iavael Can you add some links so we can close this issue? |
@iavael Thanks, moby/moby#22633 is still open I think there is a different issue, close this now. |
config-linux: Require at least one entry in linux.seccomp.sycalls[].names
from master:
rootfs_linux.go:53: mounting "/dev/mqueue" to rootfs "/home/vagrant/a/rootfs" caused "device or resource busy"
from docker v1.11(slightly older runc):
docker: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: could not synchronise with container process: device or resource busy".
The text was updated successfully, but these errors were encountered: