exec /sbin/docker-init: operation not permitted

[ArnyminerZ]

Hi, the container has been working perfectly, and after some restarts, the following error is thrown, without any extra explanation:

exec /sbin/docker-init: operation not permitted

I'm using docker compose with the following configuration:

  radicale:
    image: tomsquest/docker-radicale
    container_name: mic_radicale
    restart: "no"
    ports:
      - "5232:5232"
    networks:
      - backend
    environment:
      - TAKE_FILE_OWNERSHIP=false
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    healthcheck:
      test: curl -f http://localhost:5232 || exit 1
      interval: 30s
      retries: 3
    volumes:
      - radicale-testing:/data
      - ./radicale-config:/config:ro

volumes:
  radicale-testing:
    driver: local

Any ideas on what I have done? It has been working until now.

Docker version:

Docker version 20.10.17, build 100c70180f

Docker-compose version:

docker-compose version 1.29.2, build unknown

I'm running Kubuntu on:

Distributor ID: Ubuntu
Description:    Ubuntu 22.04.1 LTS
Release:        22.04
Codename:       jammy

Thank you very much for the container and the help ❤️

[tomsquest]

Hi @ArnyminerZ ,

Thanks for the report. I will try my best to try to reproduce it.

Couple questions:

• does it happen with other containers?
• did it happen suddenly?

Thanks, Tom

[ArnyminerZ]

Yes, it did happen suddenly, it was working perfectly. I've even tried removing volumes, pruning and pulling the image again... Nothing fixes it.

What did help was removing all the security parameters:

    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL

Without that, the image boots just fine.

[tomsquest]

I did not manage to reproduce here. Pretty use the error is coming from the host.

Here is the versions I have:

Docker:

$ docker version     
Client: Docker Engine - Community
 Version:           20.10.21
 API version:       1.41
 Go version:        go1.18.7
 Git commit:        baeda1f
 Built:             Tue Oct 25 18:02:14 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          20.10.21
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.18.7
  Git commit:       3056208
  Built:            Tue Oct 25 18:00:01 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.12
  GitCommit:        a05d175400b1145e5e6a735a6710579d181e7fb0
 runc:
  Version:          1.1.4
  GitCommit:        v1.1.4-0-g5fd4c4d
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Docker-compose installed from official repo. Seems way more uptodate that your version:

$ docker-compose version
Docker Compose version v2.13.0

Distribution:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.10
Release:    22.10
Codename:   kinetic

docker-compose.yml:

version: '3.7'

services:
  radicale:
    image: tomsquest/docker-radicale
    container_name: radicale
    ports:
      - 127.0.0.1:5232:5232
    init: true
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - KILL
    healthcheck:
      test: curl -f http://127.0.0.1:5232 || exit 1
      interval: 30s
      retries: 3
    restart: unless-stopped
    volumes:
      - /tmp/data:/data

I would double check Docker and which user is running it, if it has the appropriate permission to drop permission (it is a permission to remove permission btw), and so on. Cannot help really more. I can provide the user/group permissions if you want to compare.

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 14 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 14 days with no activity.

[frisodubach]

I run into this same issue on one of my Ubuntu installations. The problem doesn't happen on a brand-new install where I installed docker according to the docker-website guide. However it does occur on an install where I have docker installed through snap. Like that is the source of the issue.

[HenningCode]

I am running into the same issue, while setting it up the first time. I managed to get it running with removing the ` security_opt:

• no-new-privileges:true` part inside the docker-compose.yml.

I used the exmaple docker-compose file.