search

slimtoolkit / slim

Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)
Apache License 2.0
19.77k stars 739 forks source link

docker: Error response from daemon: oci runtime error: lstat /proc/self/fd/0: operation not permitted. #30

Open reinerj opened 8 years ago

reinerj commented 8 years ago

Hi,

I just tried on my Mac and on the Linux server to crate an sec comp profile.

The application which was used for testing is a very simple blog with apache.

./docker-slim profile --http-probe mylocalregistry/parcels/bludit

docker info Containers: 4 Running: 2 Paused: 0 Stopped: 2 Images: 2 Server Version: 1.12.1 Storage Driver: device mapper Pool Name: docker-253:0-67186553-pool Pool Blocksize: 65.54 kB Base Device Size: 10.74 GB Backing Filesystem: xfs Data file: /dev/loop0 Metadata file: /dev/loop1 Data Space Used: 482.1 MB Data Space Total: 107.4 GB Data Space Available: 16.75 GB Metadata Space Used: 999.4 kB Metadata Space Total: 2.147 GB Metadata Space Available: 2.146 GB Thin Pool Minimum Free Space: 10.74 GB Udev Sync Supported: true Deferred Removal Enabled: false Deferred Deletion Enabled: false Deferred Deleted Device Count: 0 Data loop file: /var/lib/docker/devicemapper/devicemapper/data WARNING: Usage of loopback devices is strongly discouraged for production use. Use --storage-opt dm.thinpooldev to specify a custom block storage device. Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata Library Version: 1.02.107-RHEL7 (2016-06-09) Logging Driver: json-file Cgroup Driver: cgroupfs Plugins: Volume: local Network: overlay host bridge null Swarm: inactive Runtimes: runc Default Runtime: runc Security Options: seccomp Kernel Version: 3.10.0-327.28.3.el7.x86_64 Operating System: CentOS Linux 7 (Core) OSType: linux Architecture: x86_64 CPUs: 1 Total Memory: 976.9 MiB Name: rocket.test ID: XHAH:MIU4:SFPM:EX2O:2AOB:4LVI:ZRWJ:TQQZ:5WW3:2KLT:5ENY:VOJT Docker Root Dir: /var/lib/docker Debug Mode (client): false Debug Mode (server): false Registry: https://index.docker.io/v1/ Insecure Registries: 127.0.0.0/8

kcq commented 8 years ago

Thanks for the report! Can you tell me more about this blog with apache? What port is it running on? What kind of blog app is it? Can you share any information about the tech stack in the container? I'd like to repro you condition. Any help will be appreciated!