thaJeztah
commented
4 years ago So the error comes from runc; https://github.com/opencontainers/runc/blob/master/libcontainer/rootfs_linux.go#L70-L73
if setupDev {
if err := createDevices(config); err != nil {
return newSystemErrorWithCause(err, "creating device nodes")
}Which calls https://github.com/opencontainers/runc/blob/master/libcontainer/rootfs_linux.go#L589-L609
// Create the device nodes in the container.
func createDevices(config *configs.Config) error {
useBindMount := system.RunningInUserNS() || config.Namespaces.Contains(configs.NEWUSER)
oldMask := unix.Umask(0000)
for _, node := range config.Devices {
// The /dev/ptmx device is setup by setupPtmx()
if utils.CleanPath(node.Path) == "/dev/ptmx" {
continue
}
// containers running in a user namespace are not allowed to mknod
// devices so we can just bind mount it from the host.
if err := createDeviceNode(config.Rootfs, node, useBindMount); err != nil {
unix.Umask(oldMask)
return err
}
}
unix.Umask(oldMask)
return nil
}Which (if user-ns is enabled) runs https://github.com/opencontainers/runc/blob/master/libcontainer/rootfs_linux.go#L632-L634
dest := filepath.Join(rootfs, node.Path)
if err := os.MkdirAll(filepath.Dir(dest), 0755); err != nil {
return err
}
if bind {
return bindMountDeviceNode(dest, node)
}func bindMountDeviceNode(dest string, node *configs.Device) error {
f, err := os.Create(dest)
if err != nil && !os.IsExist(err) {
return err
}
if f != nil {
f.Close()
}
return unix.Mount(node.Path, dest, "bind", unix.MS_BIND, "")
}
t0rrant
jfcabral
theobarkerh
Mapping a device into a docker container with --device fails with a "no such file or directory" error.
Steps to reproduce the issue:
docker run -it --rm --device /dev/null:/dev/null2 alpine:latest /bin/shDescribe the results you received: If failed with:
Describe the results you expected: When run without userns-remap enabled, the container starts normally, and the device appears at the desired path.
Additional information you deem important (e.g. issue happens only occasionally):
Using a device path that already gets mapped into the container does not product an error, but instead silently fails to map the expected device. e.g. (note the different device numbers):
Output of
docker version:Client: Docker Engine - Community Version: 19.03.12 API version: 1.40 Go version: go1.13.10 Git commit: 48a66213fe Built: Mon Jun 22 15:45:50 2020 OS/Arch: linux/amd64 Experimental: false ... containerd: Version: 1.2.13 ... runc: Version: 1.0.0-rc10 ... docker-init: Version: 0.18.0 ...
Output of
docker info:... Operating System: Debian GNU/Linux 10 (buster) ...
Additional environment details (AWS, VirtualBox, physical, etc.):