ctalledo
commented
3 years ago Hi @d-mankowski-samsung , thanks for filing this issue and for all the info provided. Let me try to reproduce it and will get back to you a bit later today.
Closed d-mankowski-samsung closed 3 years ago
ctalledo
commented
3 years ago Hi @d-mankowski-samsung , thanks for filing this issue and for all the info provided. Let me try to reproduce it and will get back to you a bit later today.
ctalledo
commented
3 years ago Hi @d-mankowski-samsung,
I was able to repro the problem with Sysbox v0.3.0 using the detailed steps you provided for the minimal (non-working) example. Thanks.
It seems Sysbox is hitting a problem when creating the container and mounting the secrets file to it:
"starting container failed: OCI runtime create failed: container_linux.go:392: starting container process caused: process_linux.go:592: container init caused: process_linux.go:563: handleReqOp caused:
rootfs_init_linux.go:260: bind mounting /var/lib/docker/containers/144717a2a438c64bc49a23986b7849c522aade6618e91936594122cb4e5e281c/mounts/secrets/u7wh58bsppve3r48hcl4wclaw to run/secrets/TEST_SECRET caused:
bind-mount of /var/lib/docker/containers/144717a2a438c64bc49a23986b7849c522aade6618e91936594122cb4e5e281c/mounts/secrets/u7wh58bsppve3r48hcl4wclaw to run/secrets/TEST_SECRET failed: exit status 32: unknown"We recently did some fixes in the way Sysbox sets up container mounts, and I can confirm that with the top-of-tree Sysbox I no longer see the problem:
cat << EOF > docker-compose.yaml
version: "3.8"
services:
test:
image: alpine:latest
command: 'tail -f /dev/null'
deploy:
mode: replicated
replicas: 1
secrets:
- TEST_SECRET
secrets:
TEST_SECRET:
external: true
EOF
$ docker stack deploy -c docker-compose.yaml test [72/6436]
Creating network test_default
Creating service test_test
$ docker node ps --no-trunc
ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS
p5ipw6lzrbk9kcz7t2y75trwd test_test.1 alpine:latest@sha256:69e70a79f2d41ab5d637de98c1e0b055206ba40a8145e7bddb55ccc04e13cf8f focal Running Running 4 minutes ago
$ docker exec test_test.1.p5ipw6lzrbk9kcz7t2y75trwd cat /run/secrets/TEST_SECRET
testWould you mind trying with the top-of-tree Sysbox? That requires building Sysbox from source, as described here). It's pretty easy as the build occurs entirely within a build container which carries all build dependencies.
Otherwise, the next release of Sysbox (scheduled in a couple of weeks) will carry the fix.
If you need this urgently, ping me via the Sysbox slack and I can provide further help.
d-mankowski-samsung
commented
3 years ago Thanks for your response, @ctalledo. I will try the top-of-tree version this week, maybe even tomorrow if I have some spare time. I've also encountered another issue while trying to mount directory from host to container, but before reporting another issue I will try to reproduce it on updated version of Sysbox first.
ctalledo
commented
3 years ago Thanks for your response, @ctalledo. I will try the top-of-tree version this week, maybe even tomorrow if I have some spare time. I've also encountered another issue while trying to mount directory from host to container, but before reporting another issue I will try to reproduce it on updated version of Sysbox first.
Sounds good, thanks. Let me know if you hit any issues please.
d-mankowski-samsung
commented
3 years ago @ctalledo I can confirm that mounting secrets in the top-of-tree version works fine. However, I've encountered problem with mounting directory from host (in both v0.3.0 and top-of-tree), so I will create another issue and close this one.
Hi, while trying to adjust Jenkins and its agents (running in containers in Swarm mode) to sysbox, I've encountered the following issue:
Container with Jenkins wasn't able to start after the deployment of docker service.
/etc/docker/daemon.jsonlooks like this:Related part of docker-compose looks like this (removed unnecessary bits):
docker info:After removing
"default-runtime": "sysbox-runc"fromdaemon.jsonand restartingdocker.service, everything works fine, so it seems that this issue is sysbox-related.Sysbox version:
A minimal (not) working example:
And logs from this example:
Logs from
sysbox-fs.log:Logs from
sysbox-mgr.log:And logs from Docker Daemon (after adding
"debug": truetodaemon.json):