tailhook / vagga

Vagga is a containerization tool without daemons
http://vagga.readthedocs.org
MIT License
1.86k stars 96 forks source link

Permission error on Ubuntu 24.04 #582

Open bootchk opened 3 months ago

bootchk commented 3 months ago

I checked the things described in the docs.

RUST_DEBUG reveals little, vagga fails at the first exe with permission error.

Maybe need an apparmor whitelist https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2056555

I disabled apparmor, with no luck.

lloyd@ryz36:/wdSSD/home/lloyd/gimpBuildContainers/mesonClang$ RUST_LOG=debug vagga run
 INFO 2024-08-01T21:11:27Z: vagga::config::config: Found configuration file: Some("/wdSSD/home/lloyd/gimpBuildContainers/mesonClang/vagga.yaml")
 INFO 2024-08-01T21:11:27Z: vagga::process_util: Running "id" "-u" "-n"
 INFO 2024-08-01T21:11:27Z: vagga::process_util: Running "exe" "__wrapper__" "_build" "gimpMesonDev"
Command <Command "/proc/self/exe" "__wrapper__" "_build" "gimpMesonDev"; environ[3]; uid_map=[UidMap { inside_uid: 0, outside_uid: 1000, count: 1 }, UidMap { inside_uid: 1, outside_uid: 100000, count: 65535 }]; gid_map=[GidMap { inside_gid: 0, outside_gid: 1000, count: 1 }, GidMap { inside_gid: 1, outside_gid: 100000, count: 65535 }]>: error when executing: Permission denied (os error 13)

Besides changing from 23.10 to 24.04, the vagga.yaml files are no longer in my home directory, but on a separate filesystem.

Separate issue is that when I was in 23.10, !Ubuntu noble failed to find a downloadable image.

bootchk commented 4 weeks ago

Apparently this is because 24.04 does not allow unprivileged user namespaces, for security reasons.

You can disable the security. See the Noble Numbat release notes.

/ect/sysctl.d/60-apparmor-namespace.conf containing kernel.apparmor_restrict_unprivileged_userns=0