EtiennePerot / safe-code-execution

Code execution utilities for Open WebUI & Ollama
Apache License 2.0
137 stars 10 forks source link

procfs error #13

Closed xiaopa233 closed 1 week ago

xiaopa233 commented 1 week ago

I have set the memory limit to 0, but I still get the procfs error chat-export-1727090326791.json

xiaopa233 commented 1 week ago

Use the --privileged=true docker parameter to resolve

EtiennePerot commented 1 week ago

Does it work if you change the procfs mount to --mount=type=bind,source=/proc,target=/proc2,readonly=false,bind-recursive=disabled?

xiaopa233 commented 1 week ago

This will return

cgroupfs is not mounted writable but necessary for the sandbox to enforce memory limits; please remount it as writable (`--mount=type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly=false`)
EtiennePerot commented 1 week ago

OK, and what happens if you add that too?

xiaopa233 commented 1 week ago

I'm sorry, I don't quite understand

EtiennePerot commented 1 week ago

You can add multiple --mount flags to the same docker run command in order to have multiple mounts. Can you try running it with all the flags listed on the setup docs? Like this:

docker run --rm --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined --security-opt=label=type:container_engine_t --mount=type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly=false --mount=type=bind,source=/proc,target=/proc2,readonly=false,bind-recursive=disabled ghcr.io/open-webui/open-webui:main

(You may also need to add any other flags you'd otherwise pass, like --gpus or -p for ports)

xiaopa233 commented 1 week ago

您可以向同一命令添加多个标志,以便进行多次挂载。您可以尝试使用设置文档中列出的所有标志来运行它吗?喜欢这个:--mount``docker run

docker run --rm --security-opt=seccomp=unconfined --security-opt=apparmor=unconfined --security-opt=label=type:container_engine_t --mount=type=bind,source=/sys/fs/cgroup,target=/sys/fs/cgroup,readonly=false --mount=type=bind,source=/proc,target=/proc2,readonly=false,bind-recursive=disabled ghcr.io/open-webui/open-webui:main

(您可能还需要添加任何其他要传递的标志,例如 or for ports)--gpus``-p

It's working normally, thanks