search

mviereck / x11docker

Run GUI applications and desktops in docker and podman containers. Focus on security.
MIT License
5.62k stars 378 forks source link

pid1pid terminate immediately, how to debug #367

Closed liyimeng closed 3 years ago

liyimeng commented 3 years ago

I issue a simple test command as below. x11docker --debug x11docker/xfce pid1pid terminated right after start. I use the some commands and it works. so it must be something wrong in the current env. setup. but I don't know where to look into the issue. Please help!

Thanks a lot in advanced! 

bash-5.1# x11docker --debug x11docker/xfce
tty: ignoring all arguments
/dev/pts/0
DEBUGNOTE[22:14:10,]: check_host(): ps can watch root processes: no
x11docker note: Your terminal seems to be not POSIX compliant.
  Command 'logname' does not return a value.
  Consider to use another terminal emulator.
  Fallback: Will try to check $SUDO_USER and $PKEXEC_UID.

x11docker note: Will use $(id -un) = root as host user.

DEBUGNOTE[22:14:10,]: host user: root 0:0 /root
x11docker WARNING: Running as user root.
  Maybe $(logname) did not provide an unprivileged user.
  Please use option --hostuser=USER to specify an unprivileged user.
  Otherwise, new X server runs as root, and container user will be root.

DEBUGNOTE[22:14:10,]: storeinfo(): cache=/root/.cache/x11docker/x11docker-xfce-63250
DEBUGNOTE[22:14:10,]: storeinfo(): stdout=/root/.cache/x11docker/x11docker-xfce-63250/share/stdout
DEBUGNOTE[22:14:10,]: storeinfo(): stderr=/root/.cache/x11docker/x11docker-xfce-63250/share/stderr
x11docker WARNING: Your host X server runs without cookie authentication.

DEBUGNOTE[22:14:10,]: storeinfo(): x11dockerpid=21439
DEBUGNOTE[22:14:11,]: 
x11docker version: 6.9.1-beta-1
Backend version:   Docker version 20.10.7, build f0df350
Host system:       "Alpine Linux v3.13"
Host architecture: amd64 (x86_64)
Command:           '/usr/bin/x11docker' '--debug' 'x11docker/xfce' 
Parsed options:     --debug -- 'x11docker/xfce'
DEBUGNOTE[22:14:11,]: --xpra: xpra not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --xpra: 1
DEBUGNOTE[22:14:11,]: Dependencies of --xpra already checked: 1 
DEBUGNOTE[22:14:11,]: --nxagent: nxagent not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --nxagent: 1
DEBUGNOTE[22:14:11,]: --xephyr: Neither Xephyr nor Xnest found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --xephyr: 1
DEBUGNOTE[22:14:11,]: Dependencies of --xephyr already checked: 1 
DEBUGNOTE[22:14:11,]: --kwin-xwayland: kwin_wayland not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: --kwin-xwayland: Xwayland not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --kwin-xwayland: 1
DEBUGNOTE[22:14:11,]: Dependency check for --hostdisplay: 0
DEBUGNOTE[22:14:11,]: --runx: runx is available on MS Windows only.
DEBUGNOTE[22:14:11,]: --runx: runx not found. 
  Need runx from https://github.com/mviereck/runx
DEBUGNOTE[22:14:11,]: Dependency check for --runx: 1
DEBUGNOTE[22:14:11,]: --xwin: XWin is available in Cygwin on MS Windows only.
DEBUGNOTE[22:14:11,]: --xwin: xwininfo not found. 
  Need 'xwininfo' package from Cygwin/X (X11 section).
DEBUGNOTE[22:14:11,]: Dependency check for --xwin: 1
DEBUGNOTE[22:14:11,]: --nxagent: nxagent not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --nxagent: 1
DEBUGNOTE[22:14:11,]: --weston-xwayland: weston not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: --weston-xwayland: Xwayland not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --weston-xwayland: 1
DEBUGNOTE[22:14:11,]: --xpra: xpra not found.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages
DEBUGNOTE[22:14:11,]: Dependency check for --xpra: 1
DEBUGNOTE[22:14:11,]: Dependency check for --hostdisplay: 0
DEBUGNOTE[22:14:11,]: Dependencies of --hostdisplay already checked: 0 
x11docker note: Using X server option --hostdisplay

DEBUGNOTE[22:14:11,]: storeinfo(): xserver=--hostdisplay
x11docker note: Option --hostdisplay: You host X server seems to run
  without cookie authentication. Cannot set up a cookie for X access.
  Fallback: Enabling option --no-auth.

x11docker note: Command 'xdpyinfo' not found. Need it to check
  whether Xorg supports untrusted cookies for --hostdisplay
  and whether extension MIT-SHM for shared memory is enabled.
  Please install 'xdpyinfo'.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages

x11docker WARNING: Clipboard isolation may fail.

x11docker note: To allow protection against X security leaks,
  please install 'xinit' and one or more of:
    xpra, Xephyr, nxagent, weston+Xwayland, kwin_wayland+Xwayland or Xnest,
  or run a second Xorg server with option --xorg.

x11docker WARNING: Option --hostdisplay provides only low container isolation!
  It is recommended to use another X server option like --nxagent or --xpra.

  To improve security with --hostdisplay x11docker uses untrusted cookies.
  This can lead to strange behaviour of some applications.

  If you encounter application errors, enable option --clipboard
  that disables security restrictions for --hostdisplay as a side effect.

x11docker note: Option --user=root: Enabling option --sudouser.

DEBUGNOTE[22:14:11,]: container user: root 0:0 /root
DEBUGNOTE[22:14:11,]: waitforlogentry(): tailstderr: Waiting for logentry "x11docker=ready" in store.info
DEBUGNOTE[22:14:11,]: waitforlogentry(): tailstdout: Waiting for logentry "x11docker=ready" in store.info
DEBUGNOTE[22:14:11,]: storepid(): Stored pid '22071' of 'watchpidlist': 
DEBUGNOTE[22:14:11,]: storepid(): Stored pid '22097' of 'watchmessagefifo': 
x11docker note: check_screensize(): Could not determine your screen size.
  Please improve this by installing one of xrandr, xdpyinfo or xwininfo.
  Or use option --size=XxY.
  You can look for the package name of this command at: 
 https://github.com/mviereck/x11docker/wiki/dependencies#table-of-all-packages

DEBUGNOTE[22:14:11,]: storeinfo(): DISPLAY=:0
DEBUGNOTE[22:14:11,]: storeinfo(): Xenv= DISPLAY=:0
DEBUGNOTE[22:14:11,]: storeinfo(): tini=/usr/local/bin/docker-init
DEBUGNOTE[22:14:11,]: Users and terminal:
  x11docker was started by:                       root
  As host user serves (running X, storing cache): root
  Container user will be:                         root
  Container user password:                        x11docker
  Getting permission to run backend with:         eval 
  Terminal for password frontend:                 bash -c
  Running in a terminal:                          yes
  Running on console:                             no
  Running over SSH:                               no
  Running sourced:                                no
  bash $-:                                        huBE
x11docker WARNING: Option --sudouser severly reduces container security.
  Container gains additional capabilities to allow sudo and su.
  If an application breaks out of container, it can harm your system
  in many ways without you noticing. Default password: x11docker

x11docker note: Option --sudouser: Enabling option --newprivileges=yes.
  You can avoid this with --newprivileges=no

x11docker WARNING: Option --newprivileges=yes: x11docker does not set 
  docker run option --security-opt=no-new-privileges. 
  That degrades container security.
  However, this is still within a default docker setup.

DEBUGNOTE[22:14:11,]: storeinfo(): containername=x11docker_X0_x11docker-xfce_63250
DEBUGNOTE[22:14:12,]: docker command:
  docker run --detach --tty \
  --name x11docker_X0_x11docker-xfce_63250 \
  --user 0:0 \
  --userns=host \
  --cap-drop ALL \
  --cap-add AUDIT_WRITE \
  --cap-add CHOWN \
  --cap-add DAC_OVERRIDE \
  --cap-add FOWNER \
  --cap-add FSETID \
  --cap-add KILL \
  --cap-add SETGID \
  --cap-add SETPCAP \
  --cap-add SETUID \
  --security-opt label=type:container_runtime_t \
  --volume '/usr/local/bin/docker-init':'/usr/local/bin/init':ro \
  --tmpfs /run:exec --tmpfs /run/lock \
  --volume '/root/.cache/x11docker/x11docker-xfce-63250/share':'/x11docker':rw \
  --workdir '/tmp' \
  --entrypoint env \
  --env 'container=docker' \
  --env 'XAUTHORITY=/x11docker/Xauthority.client' \
  --env 'DISPLAY=:0' \
  --env 'USER=root' \
  -- x11docker/xfce /usr/local/bin/init -- /bin/sh - /x11docker/containerrc
DEBUGNOTE[22:14:12,]: dockerrc:  Found docker environment variable: DOCKER_VERSION=20.10.7
DEBUGNOTE[22:14:12,]: dockerrc:  Found docker environment variable: DOCKER_TLS_CERTDIR=/certs
DEBUGNOTE[22:14:12,]: storepid(): Stored pid '22579' of 'containershell': 
DEBUGNOTE[22:14:12,]: Running xtermrc: Ask for password if needed (no)
DEBUGNOTE[22:14:12,]: waitforlogentry(): start_xserver(): Waiting for logentry "readyforX=ready" in store.info
DEBUGNOTE[22:14:12,]: Running dockerrc: Setup as root or as user docker on host.
DEBUGNOTE[22:14:12,]: dockerrc: Found default container Runtime: runc
DEBUGNOTE[22:14:12,]: dockerrc: All  Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
DEBUGNOTE[22:14:12,]: dockerrc: Container Runtime: UNDECLARED_RUNTIME
DEBUGNOTE[22:14:12,]: storeinfo(): runtime=UNDECLARED_RUNTIME
DEBUGNOTE[22:14:12,]: dockerrc: Image architecture: amd64
DEBUGNOTE[22:14:13,]: dockerrc: Image CMD: startxfce4
DEBUGNOTE[22:14:13,]: dockerrc: Image USER: 
DEBUGNOTE[22:14:13,]: storeinfo(): containeruser=root
DEBUGNOTE[22:14:13,]: dockerrc: Image ENTRYPOINT: 
DEBUGNOTE[22:14:13,]: dockerrc: Image WORKDIR: 
DEBUGNOTE[22:14:13,]: storeinfo(): readyforX=ready
DEBUGNOTE[22:14:13,]: waitforlogentry(): start_xserver(): Found log entry "readyforX=ready" in store.info.
DEBUGNOTE[22:14:13,]: waitforlogentry(): dockerrc: Waiting for logentry "xinitrc is ready" in xinit.log
DEBUGNOTE[22:14:13,]: Running xinitrc
x11docker WARNING: --hostdisplay: X server :0 runs without cookie authentication.

DEBUGNOTE[22:14:13,]: storeinfo(): xinitrc=ready
DEBUGNOTE[22:14:13,]: waitforlogentry(): dockerrc: Found log entry "xinitrc is ready" in xinit.log.
DEBUGNOTE[22:14:14,]: waitforlogentry(): containerrc: Waiting for logentry "containerrootrc=ready" in store.info
DEBUGNOTE[22:14:14,]: storeinfo(): containerid=8cc353b9fcc0e728471718df8b54fe04f9d2293dd50e9753607e51ace9198a85
DEBUGNOTE[22:14:15,]: dockerrc: Container is up and running.
DEBUGNOTE[22:14:15,]: dockerrc: 1. check for PID 1: 23098
DEBUGNOTE[22:14:15,]: storeinfo(): pid1pid=23098
DEBUGNOTE[22:14:15,]: storeinfo(): containerip=172.17.0.2
DEBUGNOTE[22:14:15,]: dockerrc(): Starting containerrootrc with docker exec
DEBUGNOTE[22:14:16,]: Running containerrootrc: Setup as root in container
DEBUGNOTE[22:14:16,]: containerrootrc: Container libc: glibc
DEBUGNOTE[22:14:16,]: containerrootrc: root:x:0:0:root,,,:/home/root:/bin/bash
DEBUGNOTE[22:14:16,]: storeinfo(): containerrootrc=ready
DEBUGNOTE[22:14:16,]: storeinfo(): dockerrc=ready
DEBUGNOTE[22:14:16,]: waitforlogentry(): start_docker(): Waiting for logentry "dockerrc=ready" in store.info
DEBUGNOTE[22:14:16,]: waitforlogentry(): start_docker(): Found log entry "dockerrc=ready" in store.info.
DEBUGNOTE[22:14:16,]: storepid(): Stored pid '23550' of 'dockerstopshell': 
DEBUGNOTE[22:14:16,]: storeinfo(): xtermrc=ready
DEBUGNOTE[22:14:16,]: watchpidlist(): Setting pid 23098 on watchlist: pid1pid
DEBUGNOTE[22:14:16,]: waitforlogentry(): containerrc: Found log entry "containerrootrc=ready" in store.info.
DEBUGNOTE[22:14:16,]: storepid(): Stored pid '23098' of 'pid1pid': 
DEBUGNOTE[22:14:16,]: watchpidlist(): Watching pids: 
(pid 23098 not found)
DEBUGNOTE[22:14:17,]: Process tree of container: (maybe not complete yet)
-+= 00001 root dockerd --host=unix:///var/run/docker.sock --host=tcp://0.0.0.0:2376 --tlsverify --tlscacert /certs/server/ca.pem --tlscert /certs/server/cert.pem --tlskey /certs/server/key.pem 
 \-+= 23078 root /usr/local/bin/containerd-shim-runc-v2 -namespace moby -id 8cc353b9fcc0e728471718df8b54fe04f9d2293dd50e9753607e51ace9198a85 -address /var/run/docker/containerd/containerd.sock 
   \-+= 23098 root /usr/local/bin/init -- /bin/sh - /x11docker/containerrc 
     |--= 23714 root /usr/bin/dbus-daemon --syslog --fork --print-pid 4 --print-address 6 --session 
     |--- 23706 root /usr/bin/dbus-launch --sh-syntax --exit-with-session xfce4-session 
     \-+= 23149 root sh /x11docker/cmdrc 
       |-+- 23660 root /bin/sh /etc/xdg/xfce4/xinitrc 
       | \--- 23687 root xfce4-session 
       |--- 23656 root tail -f /x11docker/stderr 
       \--- 23655 root tail -f /x11docker/stdout 
DEBUGNOTE[22:14:17,]: Running containerrc: Unprivileged user commands in container
DEBUGNOTE[22:14:17,]: Process tree of x11docker:

  Lost child of dockerrc (dockerstopshell):
    -+= 00001 root dockerd --host=unix:///var/run/docker.sock --host=tcp://0.0.0.0:2376 --tlsverify --tlscacert /certs/server/ca.pem --tlscert /certs/server/cert.pem --tlskey /certs/server/key.pem 
 \--- 23550 root bash /root/.cache/x11docker/x11docker-xfce-63250/dockerrc 
DEBUGNOTE[22:14:17,]: storeinfo(): Stored info:
cache=/root/.cache/x11docker/x11docker-xfce-63250
stdout=/root/.cache/x11docker/x11docker-xfce-63250/share/stdout
stderr=/root/.cache/x11docker/x11docker-xfce-63250/share/stderr
x11dockerpid=21439
xserver=--hostdisplay
DISPLAY=:0
Xenv= DISPLAY=:0
tini=/usr/local/bin/docker-init
containername=x11docker_X0_x11docker-xfce_63250
runtime=UNDECLARED_RUNTIME
containeruser=root
readyforX=ready
xinitrc=ready
containerid=8cc353b9fcc0e728471718df8b54fe04f9d2293dd50e9753607e51ace9198a85
pid1pid=23098
containerip=172.17.0.2
containerrootrc=ready
dockerrc=ready
xtermrc=ready
DEBUGNOTE[22:14:17,]: storepid(): Stored pids:
22071 watchpidlist
22097 watchmessagefifo
22579 containershell
23550 dockerstopshell
23098 pid1pid
DEBUGNOTE[22:14:17,]: containerrc: HOME is empty. Copying from /etc/skel
DEBUGNOTE[22:14:17,]: storeinfo(): x11docker=ready
DEBUGNOTE[22:14:17,]: cmdrc: Running container command:  
   startxfce4 

DEBUGNOTE[22:14:17,]: watchpidlist(): PID 23098 has terminated
DEBUGNOTE[22:14:18,]: time to say goodbye (watchpidlist 23098)
DEBUGNOTE[22:14:18,]: time to say goodbye (main)
DEBUGNOTE[22:14:18,]: time to say goodbye (watchpidlist)
DEBUGNOTE[22:14:18,]: Terminating x11docker.
DEBUGNOTE[22:14:18,]: time to say goodbye (finish)
DEBUGNOTE[22:14:18,]: finish(): Checking pid 23098 (pid1pid): (already gone)
DEBUGNOTE[22:14:18,]: finish(): Checking pid 23550 (dockerstopshell): (already gone)
DEBUGNOTE[22:14:18,]: finish(): Checking pid 22579 (containershell): (already gone)
DEBUGNOTE[22:14:18,]: finish(): Checking pid 22097 (watchmessagefifo): (already gone)
DEBUGNOTE[22:14:18,]: waitforlogentry(): tailstderr: Stopped waiting for x11docker=ready in store.info due to terminating signal.
DEBUGNOTE[22:14:18,]: waitforlogentry(): tailstdout: Stopped waiting for x11docker=ready in store.info due to terminating signal.
DEBUGNOTE[22:14:18,]: finish(): Checking pid 22071 (watchpidlist): (already gone)
DEBUGNOTE[22:14:18,]: Removing container x11docker_X0_x11docker-xfce_63250
    x11docker_X0_x11docker-xfce_63250
DEBUGNOTE[22:14:19,]: termpid(): Terminating 23550 (dockerstopshell): 
DEBUGNOTE[22:14:19,]: termpid(): Killing 23550 (dockerstopshell): 
x11docker note: Failed to terminate 23550 (dockerstopshell): 

x11docker WARNING: Failed to terminate pid 23550 (dockerstopshell): 

DEBUGNOTE[22:14:20,]: storeinfo(): error=64
DEBUGNOTE[22:14:20,]: termpid(): Terminating 22097 (watchmessagefifo): 
DEBUGNOTE[22:14:20,]: x11docker exit code: 64
bash-5.1#
mviereck commented 3 years ago

I am not sure what exactly caused xfce to stop. But one important point: xfce is a desktop, so you need to set option --desktop. Otherwise it will interfere with your host desktop. I recommend to install Xephyr for x11docker desktop mode. (Alpine: package xorg-server-xephyr)

Please install Xephyr and try:

x11docker --desktop x11docker/xfce
liyimeng commented 3 years ago

@mviereck Thanks a lot! I could not figure out what is going wrong, but your tips help anyway!