Sandstorm doesn't work on Arch Linux

[fazo96]

Hello, I'm using Arch Linux (kernel 3.17.3) and although Sandstorm can install successfully, it looks like it can't run any app after installing it.

The apps end up showing "Internal Server Error [500]" instead of their UI and this comes up in sandstorm.log:

*** Uncaught exception ***
src/sandstorm/supervisor-main.c++:844: error from OS: unshare(CLONE_NEWUSER | 
CLONE_NEWNS | CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWPID): Invalid argument
stack: 0x7f044e5060bd 0x7f044e50a9b7 0x419474 0x411fdc 0x411c92 0x411c79 0x411c6a 
0x7f044e51389e 0x7f044e515237 0x7f044e5074b8 0x7f044e50da53 0x407e0a 
0x7f044d51ab45 0x407859
Exception while invoking method 'openSession' Error: Grain never came up.
    at Object.Future.wait (/programs/server/node_modules/fibers/future.js:326:15)
    at waitPromise (app/server/proxy.js:72:35)
    at startGrainInternal (app/server/proxy.js:346:10)
    at continueGrain (app/server/proxy.js:265:10)
    at Meteor.methods.openSession (app/server/proxy.js:138:19)
    at maybeAuditArgumentChecks (packages/ddp/livedata_server.js:1599)
    at packages/ddp/livedata_server.js:648
    at _.extend.withValue (packages/meteor/dynamics_nodejs.js:56)
    at packages/ddp/livedata_server.js:647
    at _.extend.withValue (packages/meteor/dynamics_nodejs.js:56)
    - - - - -
    at Socket.<anonymous> (app/server/proxy.js:341:14)
    at Socket.emit (events.js:117:20)
    at _stream_readable.js:929:16
    at process._tickCallback (node.js:419:13)
sandstorm-supervisor exited with code: 1

Maybe there is some dependency that I need or something.

[dwrensha]

There's some related discussion at the bottom of this thread: #97.

[kentonv]

Alas, Arch ships a kernel which doesn't have sandboxing features enabled, therefore Sandstorm doesn't work:

https://bugs.archlinux.org/task/36969

It would be nice to detect this problem in the installer script and give a better error.

[fazo96]

I see... that is very sad!

I think it would be nice to have some documentation on supported distros (by "supported" I mean distros on which we know that sandstorm works out of the box without custom kernel or other modifications) and maybe a suggested option.

What are you using to develop sandstorm? I really want to try it and maybe port my apps and hack on the shell (because I don't speak C++ but I have my experience with Meteor) but honestly I'm not sure which distro I should use to build a VM. Maybe a Vagrant image could be nice.

[kentonv]

Ubuntu works; there is a Vagrantfile in our repo that uses Ubuntu as its base. I personally am on Debian. Fedora is also known to work. Of the major distros, this problem seems unique to Arch, but even then Arch often works when people are running it on hosting services that provide their own kernel.

[fazo96]

Thank you for your help :)

[kentonv]

Let's keep this issue open so that other people wondering about Sandstorm on Arch see it.

[kentonv]

We really need to improve the installer script to detect this. Then we can close the bug. I'm marking this "byte-sized" because it's just a matter of improving the installer (there's nothing we can do about Arch's refusal to support this feature).

[kentonv]

I have updated the installer script to detect whether user namespaces are enabled. Could someone who has a real Arch Linux system try running the installer and verify that it fails out? It should fail immediately after the first prompt, which asks if you want to install as root (whether or not you choose to install as root) (note that I'm about to re-arrange the prompts, so this comment may no longer be accurate when you try it...).

[vikstrous]

Yep. I just tried it and it errored out as described.

[kentonv]

@vikstrous Thanks! I'm now closing this bug since it's out of our hands.

[dckc]

"upstream" would be a more useful label than "cantfix", for me.

[mauro3]

This is now properly fixed: https://sandstorm.io/news/2016-11-10-rhel-centos-arch-support