EtiennePerot / safe-code-execution

Code execution utilities for Open WebUI & Ollama
Apache License 2.0
194 stars 12 forks source link

procfs error #13

Closed EntropyYue closed 1 month ago

EntropyYue commented 1 month ago

I have set the memory limit to 0, but I still get the procfs error chat-export-1727090326791.json

EntropyYue commented 1 month ago

Use the --privileged=true docker parameter to resolve

EtiennePerot commented 1 month ago

Does it work if you change the procfs mount to --mount=type=bind,source=/proc,target=/proc2,readonly=false,bind-recursive=disabled?

EntropyYue commented 1 month ago

This will return

cgroupfs is not mounted writable but necessary for the sandbox to enforce memory limits; please remount it as writable (`--mount=type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly=false`)
EtiennePerot commented 1 month ago

OK, and what happens if you add that too?

EntropyYue commented 1 month ago

I'm sorry, I don't quite understand

EtiennePerot commented 1 month ago

You can add multiple --mount flags to the same docker run command in order to have multiple mounts. Can you try running it with all the flags listed on the setup docs? Like this:

docker run --rm --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined --security-opt=label=type:container_engine_t --mount=type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly=false --mount=type=bind,source=/proc,target=/proc2,readonly=false,bind-recursive=disabled ghcr.io/open-webui/open-webui:main

(You may also need to add any other flags you'd otherwise pass, like --gpus or -p for ports)

EntropyYue commented 1 month ago

您可以向同一命令添加多个标志,以便进行多次挂载。您可以尝试使用设置文档中列出的所有标志来运行它吗?喜欢这个:--mount``docker run

docker run --rm --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined --security-opt=label=type:container_engine_t --mount=type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly=false --mount=type=bind,source=/proc,target=/proc2,readonly=false,bind-recursive=disabled ghcr.io/open-webui/open-webui:main

(您可能还需要添加任何其他要传递的标志,例如 or for ports)--gpus``-p

It's working normally, thanks