Open imperialguy opened 3 years ago
Seems to be related to running on a rootfs (and thus not having any access to pivot_root) ?
https://github.com/containers/podman/issues/8846#issuecomment-751807431
So some kind of --no-pivot
is needed, when using --enable-sandbox
Tiny Core Linux runs everything straight from the initrd (RAM disk), by default
I have the same error in an alpine image where I want to run buildah/podman
I can start a container in the alpine build container in privileged mode with the following command
podman run -ti docker-index.repo01.vkbads.de/alpine:3.13.5
and the container is starting with no error and I can work with it. But when the build container is started with --cap-add SYS_ADMIN --device /dev/fuse --device /dev/net/tun instead of --privileged I get the following error
Error preparing container 12d25dc6f8475a0463aeb8c2184d6396a453772c003a444ace44586f6af5d461: /usr/bin/slirp4netns failed: "WARNING: Support for seccomp is experimental
sent tapfd=7 for tap0
received tapfd=7
cannot pivot_root to /tmp
create_sandbox failed
do_slirp is exiting
do_slirp failed
parent failed
Starting slirp
* MTU: 65520
* Network: 10.0.2.0
* Netmask: 255.255.255.0
* Gateway: 10.0.2.2
* DNS: 10.0.2.3
* Recommended IP: 10.0.2.100"
followed by the error
Error: cannot chown /home/jenkins/.local/share/containers/storage/overlay/40843dee03965bdefa32fc63f5585735cf6bba2966ecd15e87922be1fc4e5631/merged to 0:0: chown /home/jenkins/.local/share/containers/storage/overlay/40843dee03965bdefa32fc63f5585735cf6bba2966ecd15e87922be1fc4e5631/merged: operation not permitted
podman info --debug
host:
arch: amd64
buildahVersion: 1.21.0
cgroupControllers: []
cgroupManager: cgroupfs
cgroupVersion: v1
conmon:
package: Unknown
path: /usr/bin/conmon
version: 'conmon version 2.0.29, commit: b388b959974dee50d451f88949b3499c3ca6ca42'
cpus: 2
distribution:
distribution: alpine
version: 3.13.5
eventLogger: file
hostname: 3af878aabcca
idMappings:
gidmap:
- container_id: 0
host_id: 0
size: 1
- container_id: 1
host_id: 9000000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 9000000
size: 65536
kernel: 4.19.76-linuxkit
linkmode: dynamic
memFree: 103800832
memTotal: 2088132608
ociRuntime:
name: crun
package: Unknown
path: /usr/bin/crun
version: |-
crun version 0.20.1
commit: 38271d1c8d9641a2cdc70acfa3dcb6996d124b3d
spec: 1.0.0
+SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
os: linux
remoteSocket:
path: /tmp/podman-run-1000/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /etc/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: Unknown
version: |-
slirp4netns version 1.1.10
commit: baa2bc5ff12fe6db646c1f4f3f966526c0eba5a0
libslirp: 4.6.1
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.5.1
swapFree: 1048440832
swapTotal: 1073737728
uptime: 54h 41m 56.04s (Approximately 2.25 days)
registries:
search:
- docker.io
store:
configFile: /home/jenkins/.config/containers/storage.conf
containerStore:
number: 2
paused: 0
running: 0
stopped: 2
graphDriverName: overlay
graphOptions:
overlay.mount_program:
Executable: /usr/bin/fuse-overlayfs
Package: Unknown
Version: |-
fuse-overlayfs: version 1.6
fusermount3 version: 3.10.2
FUSE library version 3.10.2
using FUSE kernel interface version 7.31
graphRoot: /home/jenkins/.local/share/containers/storage
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "false"
Supports d_type: "true"
Using metacopy: "false"
imageStore:
number: 1
runRoot: /tmp/podman-run-1000/containers
volumePath: /home/jenkins/.local/share/containers/storage/volumes
version:
APIVersion: 3.2.2
Built: 1624673759
BuiltTime: Sat Jun 26 02:15:59 2021
GitCommit: f9b087ff6276eb5951817d212acff20e2b5aedff
GoVersion: go1.16.5
OsArch: linux/amd64
Version: 3.2.2
slirp4netns -version
slirp4netns version 1.1.10
commit: baa2bc5ff12fe6db646c1f4f3f966526c0eba5a0
libslirp: 4.6.1
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.5.1
cat /etc/*release
3.13.5
NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.13.5
PRETTY_NAME="Alpine Linux v3.13"
HOME_URL="https://alpinelinux.org/"
BUG_REPORT_URL="https://bugs.alpinelinux.org/"
Linux 091fb4510013 4.19.76-linuxkit #1 SMP Tue May 26 11:42:35 UTC 2020 x86_64 Linux
And if i do the manual steps described here https://github.com/rootless-containers/slirp4netns#usage and add --enable-sandbox in the start command
slirp4netns --configure --mtu=65520 --disable-host-loopback --enable-sandbox $(cat /tmp/pid) tap0
the same error occurs
sent tapfd=5 for tap0
received tapfd=5
Starting slirp
* MTU: 65520
* Network: 10.0.2.0
* Netmask: 255.255.255.0
* Gateway: 10.0.2.2
* DNS: 10.0.2.3
* Recommended IP: 10.0.2.100
cannot pivot_root to /tmp
create_sandbox failed
do_slirp is exiting
do_slirp failed
parent failed
Without the --enable-sandbox everything work like described.
pod is calling slirp4netns in the following way
slirp4netns command: /usr/bin/slirp4netns --disable-host-loopback --mtu=65520 --enable-sandbox --enable-seccomp -c -e 3 -r 4 --netns-type=path <some path>tap0
I found the problem...
the build container ist started with docker and the default seccomp.json file which is missing pivot_root!
https://github.com/moby/moby/blob/master/profiles/seccomp/default.json
I copied the content of the file and added pivot_root to the syscalls! After that the build container has to be run with --security-opt=./seccomp.json and the the error with --enable-sandbox is gone (except the followed error with chown which i don't investigated till now)
Description
podman run
fails on tinycore 11.1 VM because of some issue related toslirp4netns
. Using slirp4netns version 1.1.8.Steps to reproduce the issue:
Install podman on tinycore using manual install
Run
podman run hello-world
Results