Operation Not Permitted Error from Rocker RStudio Image on M1 MacBook

[kuang-da]

Hi,

I try to run the following command to have the RStudio Server run on an M1 MacBook with macOS Monterey.

docker run -e PASSWORD=yourpassword --rm -p 8788:8787 rocker/rstudio

But I keep having the following error after the login page.

[rserver] ERROR system error 1 (Operation not permitted); OCCURRED AT rstudio::core::Error rstudio::core::system::posix::{anonymous}::restorePrivilegesImpl(uid_t) src/cpp/shared_core/system/PosixSystem.cpp:66; LOGGED FROM: rstudio::core::Error rstudio::core::system::launchChildProcess(std::__cxx11::string, std::__cxx11::string, rstudio::core::system::ProcessConfig, rstudio::core::system::ProcessConfigFilter, PidType*) src/cpp/core/system/PosixSystem.cpp:2168

Any suggestions would be highly appreciated. Thank you very much!

[eitsupi]

It seems duplicate of #144.
RStduio Server does not support arm64 architecture at this time. Therefore, RStduio Server does not seem to work on M1 mac.

[echuber2]

Perhaps the x86 version will work with the latest version of Docker Desktop for Mac if Rosetta 2 emulation for amd64 architecture is enabled. Details are explained here: https://docs.docker.com/desktop/mac/apple-silicon/ I can't test this myself either.

[gaojunxuan]

Perhaps the x86 version will work with the latest version of Docker Desktop for Mac if Rosetta 2 emulation for amd64 architecture is enabled. Details are explained here: https://docs.docker.com/desktop/mac/apple-silicon/ I can't test this myself either.

Unfortunately, this does not seem to work.

[echuber2]

I see, that's unfortunate. I heard one report of someone getting the PrairieLearn version of Rocker to work locally on an M1 Mac, so maybe you'd like to try that version, but it may not be configured for your needs:

https://github.com/PrairieLearn/PrairieLearn/tree/master/workspaces/rstudio

[gaojunxuan]

I see, that's unfortunate. I heard one report of someone getting the PrairieLearn version of Rocker to work locally on an M1 Mac, so maybe you'd like to try that version, but it may not be configured for your needs:

https://github.com/PrairieLearn/PrairieLearn/tree/master/workspaces/rstudio

Do you have any detail or link to that report and/or a working example?

[eddelbuettel]

I had verbal confirmation from @barbehenna works with me on things involving quite a bit of docker that this worked on his new M1 macbook. Standard launch of Docker in daemon mode to have RStudio exposed via the network as usual.

All this ... surprised me which is why I brought it up to @echuber2 who help us here / essentially built and tweaked this thing for our use in the test and grade software we use. @echuber2 may know best what the delta is to upstream -- we lifted on authentication step not needed in our setup as I recall, and added (iirc) one nginx indirection needed for us. I do not see how that makes the difference so maybe some digging will reveal it.

I am still confused as to how this can have worked when it didn't for everybody else.

[echuber2]

@gaojunxuan Can you try out this script on your Mac? Supposedly, this works with macOS Monterey 12.1 on an M1 Pro. Docker version 20.10.11, Docker Desktop 4.3.2. Thanks to @barbehenna for testing this.

https://gist.github.com/echuber2/2dd51ab799411cbd4894f8a85a3db52c

[gaojunxuan]

@gaojunxuan Can you try out this script on your Mac? Supposedly, this works with macOS Monterey 12.1 on an M1 Pro. Docker version 20.10.11, Docker Desktop 4.3.2. Thanks to @barbehenna for testing this.

https://gist.github.com/echuber2/2dd51ab799411cbd4894f8a85a3db52c

Yes! This works. I have not tried all the features yet, but at least RStudio seems to work fine. I wonder if it is because of some file/folder permission issue as the "Operation not permitted" error message I got when trying to use the vanilla Rocker image seems it was trying to modify some permission settings and failed.

11 Jan 2022 19:30:40 [rserver] ERROR system error 1 (Operation not permitted); OCCURRED AT.
rstudio::core::Error rstudio::core::system::posix::{anonymous}::restorePrivilegesImpl(uid_t) 
src/cpp/shared_core/system/PosixSystem.cpp:66; LOGGED FROM: void rstudio::server::pam_auth::
{anonymous}::assumeRootPriv() src/cpp/server/ServerPAMAuth.cpp:57

11 Jan 2022 19:30:41 [rserver] ERROR system error 1 (Operation not permitted); OCCURRED AT 
rstudio::core::Error rstudio::core::system::posix::{anonymous}::restorePrivilegesImpl(uid_t) 
src/cpp/shared_core/system/PosixSystem.cpp:66; LOGGED FROM: rstudio::core::Error 
rstudio::core::system::launchChildProcess(std::__cxx11::string, std::__cxx11::string, 
rstudio::core::system::ProcessConfig, rstudio::core::system::ProcessConfigFilter, PidType*) 
src/cpp/core/system/PosixSystem.cpp:210

[echuber2]

Interesting, thanks a lot for trying it. The PrairieLearn version is set up to run as a non-root user. I'm still not sure why the default version of Rocker works with non-M1 chips by default, if this is the issue. Maybe it's not an ARM issue per se but a difference in how the M1 kernels handle permissions.

[mattwigway]

I dug into this a bit, and wasn't able to get a reproducible image that worked but did get past this error. Running as a non-root user is indeed the key to getting past this image. When running an x86 image on ARM, Docker uses qemu to run the code, and for some reason the setuid code does not work in this emulation.

I was able to get RStudio to run by starting rocker/rstudio with the --platform=linux/amd64 option to Docker, and then logging into the container with the command line, stopping rstudio, suing to the rstudio-server user and running /usr/lib/rstudio-server/bin/rserver --server-daemonize=0. When I tried to build a reproducible image, though, I kept getting permission denied errors, I think because I don't know what all the files rstudio is trying to read/write are.

[echuber2]

@mattwigway Have you tried the gist here? https://gist.github.com/echuber2/2dd51ab799411cbd4894f8a85a3db52c Interested if it works for you too (or not).

[eitsupi]

Duplicate of #144