apt update fails on ubuntu:jammy unless --security-opt seccomp=unconfined is specified #236

tnir · 2022-04-22T12:09:03Z

apt update (or apt-get update) fails on ubuntu:jammy (ubuntu@sha256:7599221e4e2e4eeb90ad282fc523139578f3dfea245b5049c4fee1b28776d2be) if --security-opt seccomp=unconfined is not specified.

$ docker run ubuntu:jammy apt-get update
Get:1 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Fetched 20.2 MB in 2s (10.8 MB/s)                         
Reading package lists... Done
E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
E: Sub-process returned an error code

or

$ docker run ubuntu:jammy apt update

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Fetched 20.2 MB in 2s (11.0 MB/s)
Reading package lists...
E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
E: Sub-process returned an error code

The text was updated successfully, but these errors were encountered:

woky · 2022-04-22T13:09:54Z

@tnir, it looks like you hit this issue: https://bugs.launchpad.net/cloud-images/+bug/1943049 It should be fixed in latest docker.io package in archives. Can you try to update?

tnir · 2022-04-22T14:01:01Z

@woky Thanks. Nothing is changed even with https://hub.docker.com/layers/ubuntu/library/ubuntu/latest/images/sha256-c27987afd3fd8234bcf7a81e46cf86c2c4c10ef06e80f0869c22c6ff22b29f9d?context=explore (linux/amd64) 🤔 :

$ docker run --rm ubuntu@sha256:c27987afd3fd8234bcf7a81e46cf86c2c4c10ef06e80f0869c22c6ff22b29f9d apt update

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Get:1 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Fetched 20.2 MB in 3s (5897 kB/s)
Reading package lists...
E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
E: Sub-process returned an error code

tianon · 2022-04-22T14:02:49Z

You need to update Docker and libseccomp on your host (not just a newer Docker image).

andrewcorrigan · 2022-04-22T18:03:52Z

What versions are required of Docker and libseccomp? I'm hitting similar issues to the above using:

Docker version 20.10.14, build a224086
libseccomp-2.3.1-4.el7.x86_64

tianon · 2022-04-22T18:05:44Z

Definitely at least libseccomp 2.4.2 or newer, but possibly even as high as 2.5.0.

tnir · 2022-04-22T21:44:23Z

Even with libseccomp 2.5.1-1ubuntu1~20.04.2, it does not work to me:

$ docker version
Client: Docker Engine - Community
 Version:           20.10.12
 API version:       1.41
 Go version:        go1.16.12
 Git commit:        e91ed57
 Built:             Mon Dec 13 11:45:33 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.12
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.12
  Git commit:       459d0df
  Built:            Mon Dec 13 11:43:42 2021
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.4.13
  GitCommit:        9cc61520f4cd876b86e77edfeb88fbcd536d1f9d
 gitpod:
  Version:          1.1.0
  GitCommit:        v1.1.0-0-g067aaf85
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
$ dpkg -l libseccomp2
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name              Version                Architecture Description
+++-=================-======================-============-============================================
ii  libseccomp2:amd64 2.5.1-1ubuntu1~20.04.2 amd64        high level interface to Linux seccomp filter

woky · 2022-04-25T09:59:46Z

@tnir It seems you're running focal host with docker-ce package from https://docs.docker.com/engine/install/ubuntu/, not docker.io from Ubuntu archive, but you're not using the latest version. Your docker-ce is at 5:20.10.12~3-0~ubuntu-focal but the Docker archive already contains 5:20.10.14~3-0~ubuntu-focal.

Anyway, I've tried to replicate your setup with

V='5:20.10.12~3-0~ubuntu-focal'
apt-get install docker-ce=$V docker-ce-cli=$V docker-ce-rootless-extras=$V containerd.io

so my versions are

root@localhost:~# dpkg -l docker-ce libseccomp2
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name              Version                     Architecture Description
+++-=================-===========================-============-====================================================
ii  docker-ce         5:20.10.12~3-0~ubuntu-focal amd64        Docker: the open-source application container engine
ii  libseccomp2:amd64 2.5.1-1ubuntu1~20.04.2      amd64        high level interface to Linux seccomp filter
root@localhost:~# docker version
Client: Docker Engine - Community
 Version:           20.10.12
 API version:       1.41
 Go version:        go1.16.12
 Git commit:        e91ed57
 Built:             Mon Dec 13 11:45:33 2021
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.12
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.12
  Git commit:       459d0df
  Built:            Mon Dec 13 11:43:42 2021
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.5.11
  GitCommit:        3df54a852345ae127d1fa3092b95168e4a88e2f8
 runc:
  Version:          1.0.3
  GitCommit:        v1.0.3-0-gf46b6ba
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
root@localhost:~#

And I still can't reproduce your bug:

root@localhost:~# docker run ubuntu:jammy apt-get update
Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:4 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:9 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [693 B]
Get:10 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages [621 B]
Fetched 20.2 MB in 1s (15.8 MB/s)
Reading package lists...
root@localhost:~#

Any suggestions to reproduce this?

errietta · 2022-04-25T10:12:11Z

We can reproduce this. Neither 21.10 nor 20.04 have this issue, but latest and 22.04 tags do.
This fails on ci (buddy ci, no idea what version of docker they use on the host) AND my local macbook: Docker version 20.10.8, build 3967b7d.

woky · 2022-04-25T10:26:27Z

Can you try to run the following commands and post output all?

docker run -it ubuntu:jammy apt-get update
docker run -it --security-opt seccomp=unconfined ubuntu:jammy apt-get update
docker run -it --privileged ubuntu:jammy apt-get update

errietta · 2022-04-25T11:10:20Z

@woky
1:

errykostala in ~  > docker run -it ubuntu:jammy apt-get update
Unable to find image 'ubuntu:jammy' locally
jammy: Pulling from library/ubuntu
Digest: sha256:2a7dffab37165e8b4f206f61cfd984f8bb279843b070217f6ad310c9c31c9c7c
Status: Downloaded newer image for ubuntu:jammy
Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:9 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages [621 B]
Get:10 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [693 B]
Fetched 20.2 MB in 3s (7590 kB/s)               
Reading package lists... Done
E: Problem executing scripts APT::Update::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
E: Sub-process returned an error code

(doesn't work)
2:

errykostala in ~  > docker run -it --security-opt seccomp=unconfined ubuntu:jammy apt-get update

Get:1 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:9 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [693 B]
Get:10 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages [621 B]
Fetched 20.2 MB in 3s (7716 kB/s)                        
Reading package lists... Done

(seems to work)

3:

errykostala in ~  > docker run -it --privileged ubuntu:jammy apt-get update
Get:1 http://security.ubuntu.com/ubuntu jammy-security InRelease [90.7 kB]
Get:2 http://archive.ubuntu.com/ubuntu jammy InRelease [270 kB]
Get:3 http://archive.ubuntu.com/ubuntu jammy-updates InRelease [90.7 kB]
Get:4 http://archive.ubuntu.com/ubuntu jammy-backports InRelease [90.7 kB]
Get:5 http://archive.ubuntu.com/ubuntu jammy/restricted amd64 Packages [164 kB]
Get:6 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages [1792 kB]
Get:7 http://archive.ubuntu.com/ubuntu jammy/universe amd64 Packages [17.5 MB]
Get:8 http://archive.ubuntu.com/ubuntu jammy/multiverse amd64 Packages [266 kB]
Get:9 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages [621 B]
Get:10 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages [693 B]
Fetched 20.2 MB in 3s (7406 kB/s)                        
Reading package lists... Done

(also works)

That's not really an acceptable fix though, because running with --privileged is a great backdoor into escaping the container and privescing into the host

tnir · 2022-04-25T11:34:42Z

--security-opt seccomp=unconfined is required to reproduce the problem to me as well.

errietta · 2022-04-25T12:00:51Z

@tnir it works fine with, doesn't work without, unless that's what you meant

woky · 2022-04-25T12:36:30Z

@tnir Can you run the following on your host and attach here resulting strace.log?

docker run -it woky/jammy-strace strace -f apt update &> strace.log

Also, please post output of the following from your host

cat /etc/os-release
uname -a

TIA

EDIT: Please also attach output of docker info.

srepollock · 2022-05-16T18:37:38Z

I am running into this issue on:
macOS: 11.3.1 (20E241)
docker desktop: 4.8.1 (78998)
docker engine: 20.10.14

Trying to build with: ubuntu:latest in the Dockerfile

Running in console: docker build -t [name] -f Dockerfile .
as soon as I hit RUN apt update --fix-missing && apt upgrade -y the build then fails out with:

 => ERROR [ 2/21] RUN apt update --fix-missing     && apt upgrade -y                                                                                                                                                                                                 1.5s
------                                                                                                                                                                                                                                                                    
 > [ 2/21] RUN apt update --fix-missing     && apt upgrade -y:
#6 1.135 Segmentation fault
------
executor failed running [/bin/sh -c apt update --fix-missing     && apt upgrade -y]: exit code: 139
make: *** [build-main_server] Error 1

I am unable to build and therefore cannot run with --security-opt seccomp=unconfined

Please note: I have built on both:
Windows (latest):
I don't have access to the machine at the time of writing as I'm away from it, but docker was up to date and using the same Dockerfile

AWS EC2 Ubuntu

Ubuntu 22.04
Docker 20.10.16

I've tried the following Ubuntu images with similar errors (in no particular order):
latest
focal
impish
devel

The following seems to work:
bionic
trusty

Edit*:

$ docker version

Client:
 Cloud integration: v1.0.24
 Version:           20.10.14
 API version:       1.41
 Go version:        go1.16.15
 Git commit:        a224086
 Built:             Thu Mar 24 01:49:20 2022
 OS/Arch:           darwin/amd64
 Context:           default
 Experimental:      true

Server: Docker Desktop 4.8.1 (78998)
 Engine:
  Version:          20.10.14
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.15
  Git commit:       87a90dc
  Built:            Thu Mar 24 01:46:14 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.5.11
  GitCommit:        3df54a852345ae127d1fa3092b95168e4a88e2f8
 runc:
  Version:          1.0.3
  GitCommit:        v1.0.3-0-gf46b6ba
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

mwhudson · 2022-05-17T00:54:37Z

@srepollock i don't know what problem you're seeing there, but it's not the same as the ones the other people are discussing which is a problem with the clone3 syscall, which is only used in jammy and kinetic images -- if you're seeing the issue with focal, it's 100% something else so please file a new bug!

tianon · 2022-10-18T15:35:25Z

This repository is no longer canonical; see #248 for more details.

This was referenced Apr 25, 2022

docker run ubuntu:jammy apt-get update fails in a Gitpod workspace gitpod-io/gitpod#9501

Closed

Update Ubuntu from focal (20.04) to jammy (22.04) gitpod-io/workspace-images#814

Closed

tnir changed the title ~~apt update fails on ubuntu:jammy~~ apt update fails on ubuntu:jammy unless --security-opt seccomp=unconfined is specified Apr 25, 2022

srepollock mentioned this issue May 17, 2022

apt update fails on macOS #239

Closed

yosifkit mentioned this issue Jun 29, 2022

Latest image incompatible with old versions of docker engine ? docker-library/tomcat#269

Closed

xwi88 mentioned this issue Jul 15, 2022

MacOS build ubuntu22.04 failed with error DPkg::Post-Invoke v8fg/docker-compose-resources#58

Open

wglambert mentioned this issue Aug 9, 2022

Cannot instantiate docker image using tomcat:9.0.65-jdk17-temurin docker-library/tomcat#274

Closed

david-bakin mentioned this issue Sep 25, 2022

Update Ubuntu from focal (20.04) to jammy (22.04) gitpod-io/workspace-images#932

Closed

tianon closed this as completed Oct 18, 2022

yosifkit mentioned this issue Feb 9, 2023

ERROR: child process failed, exited with 51 docker-library/mongo#606

Closed

yosifkit mentioned this issue May 23, 2024

"operation not permitted", a libseccomp story docker-library/official-images#16829

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

apt update fails on ubuntu:jammy unless --security-opt seccomp=unconfined is specified #236

apt update fails on ubuntu:jammy unless --security-opt seccomp=unconfined is specified #236

tnir commented Apr 22, 2022 •

edited

Loading

woky commented Apr 22, 2022

tnir commented Apr 22, 2022

tianon commented Apr 22, 2022 via email

andrewcorrigan commented Apr 22, 2022

tianon commented Apr 22, 2022 via email

tnir commented Apr 22, 2022

woky commented Apr 25, 2022

errietta commented Apr 25, 2022

woky commented Apr 25, 2022

errietta commented Apr 25, 2022 •

edited

Loading

tnir commented Apr 25, 2022

errietta commented Apr 25, 2022

woky commented Apr 25, 2022 •

edited

Loading

srepollock commented May 16, 2022 •

edited

Loading

mwhudson commented May 17, 2022

tianon commented Oct 18, 2022

apt update fails on ubuntu:jammy unless --security-opt seccomp=unconfined is specified #236

apt update fails on ubuntu:jammy unless --security-opt seccomp=unconfined is specified #236

Comments

tnir commented Apr 22, 2022 • edited Loading

woky commented Apr 22, 2022

tnir commented Apr 22, 2022

tianon commented Apr 22, 2022 via email

andrewcorrigan commented Apr 22, 2022

tianon commented Apr 22, 2022 via email

tnir commented Apr 22, 2022

woky commented Apr 25, 2022

errietta commented Apr 25, 2022

woky commented Apr 25, 2022

errietta commented Apr 25, 2022 • edited Loading

tnir commented Apr 25, 2022

errietta commented Apr 25, 2022

woky commented Apr 25, 2022 • edited Loading

srepollock commented May 16, 2022 • edited Loading

mwhudson commented May 17, 2022

tianon commented Oct 18, 2022

tnir commented Apr 22, 2022 •

edited

Loading

errietta commented Apr 25, 2022 •

edited

Loading

woky commented Apr 25, 2022 •

edited

Loading

srepollock commented May 16, 2022 •

edited

Loading