Buildah: seccomp: config provided but seccomp not supported

Created on 10 Feb 2018  路  70Comments  路  Source: containers/buildah

Description

When running a command in a container, the process exits with the error : 

container_linux.go:348: starting container process caused "seccomp: config provided but seccomp not supported"

I am not exactly sure it is a bug from buildah itself.
I guess I have to somehow enable seccomp, but I don't know how, and it seems to be already enabled : 

$ zgrep SECCOMP /proc/config.gz
CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
CONFIG_SECCOMP_FILTER=y
CONFIG_SECCOMP=y

So it might be an issue completely unrelated to seccomp altogether, but I lack the general knowledge to understand what is wrong, or where to look for clues.

Steps to reproduce the issue:

$ sudo buildah from fedora
Getting image source signatures
Copying blob sha256:a8ee583972c2295bb76704d4defe5116d5e4dd7ba3767aaa2cc8fcf71088ee06
 82.80 MiB / 82.80 MiB [===================================================] 26s
Copying config sha256:422dc563ca3260ad9ef5c47a1c246f5065d7f177ce51f4dd208efd82967ff182
 2.29 KiB / 2.29 KiB [======================================================] 0s
Writing manifest to image destination
Storing signatures
fedora-working-container
$ sudo buildah images
IMAGE ID             IMAGE NAME                                               CREATED AT             SIZE
422dc563ca32         docker.io/library/fedora:latest                          Nov 14, 2017 21:07     251 MB
$ sudo buildah containers
CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
5062084a1ad7     *     422dc563ca32 docker.io/library/fedora:latest  fedora-working-container
$ sudo buildah run fedora-working-container sh
container_linux.go:348: starting container process caused "seccomp: config provided but seccomp not supported"

Output of rpm -q buildah or apt list buildah:

I'm running Arch, and used yaourt to install buildah from git using this PKGBUILD.
It builds buildah from the source of this repo, and as I installed it just now (to be sure it isn't an issue already fixed), the version referes to the very last commit (46c1a54) as of now.

$ pacman -Q | grep buildah
buildah-git r478.46c1a54-1

Output of buildah version:

$ buildah -v                                                                                                                                                 
buildah version 0.11 (image-spec 1.0.0, runtime-spec 1.0.0)

Output of cat /etc/*release:

LSB_VERSION=1.4
DISTRIB_ID=Arch
DISTRIB_RELEASE=rolling
DISTRIB_DESCRIPTION="Arch Linux"
NAME="Arch Linux"
PRETTY_NAME="Arch Linux"
ID=arch
ID_LIKE=archlinux
ANSI_COLOR="0;36"
HOME_URL="https://www.archlinux.org/"
SUPPORT_URL="https://bbs.archlinux.org/"
BUG_REPORT_URL="https://bugs.archlinux.org/"

Output of uname -a:

Linux etndev 4.14.14-1-ARCH #1 SMP PREEMPT Fri Jan 19 18:42:04 UTC 2018 x86_64 GNU/Linux

Output of cat /etc/containers/storage.conf:

cat: /etc/containers/storage.conf: No such file or directory
picture etnbrd

All 70 comments

The storage.conf should come from skopeo-containers, but not sure if this has been packaged for "Arch Linux" yet.

rhatdan picture rhatdan on 11 Feb 2018

buildah should be able to work even if seccomp is not enabled. I believe this error is coming from runc, which buildah is executing to run the containers. What version of runc are you using?

rhatdan picture rhatdan on 11 Feb 2018

Is skopeo-contaiers the same thing as skopeo ?

I installed runc the same way than buildah : from the git repository.

$ skopeo -v
skopeo version 0.1.27
$ yaourt -Q skopeo
local/skopeo 0.1.27-1
$ runc -v
runc version spec: 1.0.0
$ yaourt -Q runc-git
local/runc-git v1.0.0.rc4.r217.ga618ab5a-1
etnbrd picture etnbrd on 11 Feb 2018

skopeo-containers is a subpackage of skopeo, at least that is what we ship in Fedora and I believe in our version for Ubuntu.
@lsm5 PTAL

Your version of runc looks recent enough.

On Fedora 

 rpm -q skopeo-containers -l
/etc/containers
/etc/containers/policy.json
/etc/containers/registries.d
/etc/containers/registries.d/default.yaml
/etc/containers/storage.conf
/usr/share/containers
/usr/share/containers/mounts.conf
/usr/share/man/man5/containers-storage.conf.5.gz
/usr/share/rhel/secrets
/usr/share/rhel/secrets/etc-pki-entitlement
/usr/share/rhel/secrets/rhel7.repo
/usr/share/rhel/secrets/rhsm
/var/lib/atomic/sigstore
rhatdan picture rhatdan on 11 Feb 2018

I don't know if it is of any help, but I tried to manually mount the working container, and create a container from it with runc, and it seems to work.

$ buildah containers
CONTAINER ID  BUILDER  IMAGE ID     IMAGE NAME                       CONTAINER NAME
5062084a1ad7     *     422dc563ca32 docker.io/library/fedora:latest  fedora-working-container
$ buildah mount fedora-working-container
/var/lib/containers/storage/devicemapper/mnt/4f12111492f235d8c2d326e2820c85aaec80dc4cc4a688c30caf75451ce6b7dc/rootfs
$ cd /var/lib/containers/storage/devicemapper/mnt/4f12111492f235d8c2d326e2820c85aaec80dc4cc4a688c30caf75451ce6b7dc
$ runc spec
$ runc run fedora-running-container
sh-4.4# id
uid=0(root) gid=0(root) groups=0(root)
etnbrd picture etnbrd on 11 Feb 2018

Apparently, the arch package lacks two files:
(except for man, and secrets files, that I believe are distribution specific)

/etc/containers/storage.conf
/usr/share/containers/mounts.conf

$ yaourt -Ql skopeo
skopeo /etc/
skopeo /etc/containers/
skopeo /etc/containers/policy.json
skopeo /etc/containers/registries.d/
skopeo /etc/containers/registries.d/default.yaml
skopeo /usr/
skopeo /usr/bin/
skopeo /usr/bin/skopeo
skopeo /usr/share/
skopeo /usr/share/bash-completion/
skopeo /usr/share/bash-completion/completions/
skopeo /usr/share/bash-completion/completions/skopeo
skopeo /usr/share/man/
skopeo /usr/share/man/man1/
skopeo /usr/share/man/man1/skopeo.1.gz
skopeo /var/
skopeo /var/lib/
skopeo /var/lib/atomic/
skopeo /var/lib/atomic/sigstore/
etnbrd picture etnbrd on 11 Feb 2018

/usr/share/containers/mounts.conf
Is also about putting secrets into the containers, so I guess that would be distro specific.

 cat /etc/containers/storage.conf 
# storage.conf is the configuration file for all tools
# that share the containers/storage libraries
# See man 5 containers-storage.conf for more information

# The "container storage" table contains all of the server options.
[storage]

# Default Storage Driver
driver = "overlay"

# Temporary storage location
runroot = "/var/run/containers/storage"

# Primary Read/Write location of container storage
graphroot = "/var/lib/containers/storage"

[storage.options]
# AdditionalImageStores is used to pass paths to additional Read/Only image stores
# Must be comma separated list.
additionalimagestores = [
]

# Size is used to set a maximum size of the container image.  Only supported by
# certain container storage drivers.
size = ""

# OverrideKernelCheck tells the driver to ignore kernel checks based on kernel version
override_kernel_check = "true"
rhatdan picture rhatdan on 11 Feb 2018

These are all defaulted, but helpful to the admin to understand options available to them.

rhatdan picture rhatdan on 11 Feb 2018

@etnbrd I believe your system has a version of runc that was built without Seccomp support. The kernel itself supports it, but your runc was built without libseccomp and as such lacks the interfaces to use the kernel seccomp calls. Can you build a version of runc from source with seccomp enabled and see if the problem is solved?

mheon picture mheon on 12 Feb 2018

The fact that you can start the container from the spec seems to undermine this, but I'm pretty familiar with the runc seccomp code, and that error should only be present in versions of runc built without seccomp.

mheon picture mheon on 12 Feb 2018

I will try to compile runc tonight, and keep you posted :)

etnbrd picture etnbrd on 12 Feb 2018

Ok I will close this, reopen if it turns out to be an issue with buildah. @etnbrd If you make your alpine versions available in public we will update the docs to point at them.

rhatdan picture rhatdan on 12 Feb 2018

When compiling runc, you have to use a BUILDTAG with "seccomp".

rhatdan picture rhatdan on 12 Feb 2018

It turns out the problem seems to come from the PKGBUILD (the distro-specific file used to build runc and install it into my system).
I compiled it manually, and it seems to work as expected:

$ sudo buildah run fedora-working-container sh
sh-4.4#

I will now investigate the problem in the PKGBUILD, and report it to its maintainer.

Thanks a lot for your help :)

etnbrd picture etnbrd on 12 Feb 2018

@rhatdan, I believe that you meant the Arch package, when you said 'your alpine version' :)
The official runc package for Arch is currently stuck at version 0.1.1, which is the last stable version.
Though, I fixed the unofficial version (AUR) and took maintainership of it.
For the documentation, this unofficial package is available here: https://aur.archlinux.org/packages/runc-git

etnbrd picture etnbrd on 12 Feb 2018
👍1

Yes, I confused another Issue which was looking at Alpine and wrote the message here. Bottom line we are thrilled to see people attempting to use some of these tools on different Linux versions, then we manage. We would love to see buildah, CRI-O, Skopeo, Podman available on lots of Linux Variants and would love to link to where users of these distros could get packaged versions of our tools.

rhatdan picture rhatdan on 13 Feb 2018

I get the same error on F28 with the latest updates installed, runc came packaged with podman:

img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "seccomp: config provided but seccomp not supported"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile --runtime $GOPATH/bin/runc -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "seccomp: config provided but seccomp not supported"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$

Tried using compiled runc with/without seccomp. I see the same issue using img compiled with seccomp. Is there any package I'm missing

frezbo picture frezbo on 6 Aug 2018

You potentially have a kernel without seccomp support. I don't know if there's an easy way to test this, though.

mheon picture mheon on 6 Aug 2018

If it's a standard Fedora kernel, it definitely would have support, though

mheon picture mheon on 6 Aug 2018

@mheon this issue has dreaded me for a while, I have to mostly compile these tools from source without seccomp support, any help would be appreciated.

frezbo picture frezbo on 6 Aug 2018

@frezbo Can you get a rpm -qa | grep kernel

mheon picture mheon on 6 Aug 2018

This could be a runc without seccomp support.

rhatdan picture rhatdan on 6 Aug 2018

If runc does not have seccomp support it will reject the seccomp file handed to it by buildah.

rhatdan picture rhatdan on 6 Aug 2018

@mheon 

~ (aws:rean-gov-sd)(kc)$  rpm -qa | grep kernel
kernel-core-4.17.7-200.fc28.x86_64
abrt-addon-kerneloops-2.10.10-1.fc28.x86_64
kernel-core-4.17.9-200.fc28.x86_64
kernel-4.17.9-200.fc28.x86_64
libreport-plugin-kerneloops-2.9.5-1.fc28.x86_64
kernel-4.17.7-200.fc28.x86_64
kernel-devel-4.17.7-200.fc28.x86_64
kernel-modules-4.17.11-200.fc28.x86_64
kernel-modules-extra-4.17.11-200.fc28.x86_64
kernel-headers-4.17.11-1.fc28.x86_64
kernel-modules-4.17.7-200.fc28.x86_64
kernel-modules-4.17.9-200.fc28.x86_64
kernel-modules-extra-4.17.9-200.fc28.x86_64
kernel-core-4.17.11-200.fc28.x86_64
kernel-devel-4.17.9-200.fc28.x86_64
kernel-modules-extra-4.17.7-200.fc28.x86_64
kernel-devel-4.17.11-200.fc28.x86_64
kernel-4.17.11-200.fc28.x86_64
~ (aws:rean-gov-sd)(kc)$

Just pending a kernel update rebboot :wink:

@rhatdan I tried compiling runc with and without seccomp and always see this. I even used the bundled runc from podman rpm

frezbo picture frezbo on 6 Aug 2018

Those certainly look like official Fedora packages, and they are definitely built with seccomp

mheon picture mheon on 6 Aug 2018

config provided but seccomp not supported is a runc error.

 grep -r "config provided but seccomp not supported" .
./libcontainer/seccomp/seccomp_unsupported.go:var ErrSeccompNotEnabled = errors.New("seccomp: config provided but seccomp not supported")

I think you are definitely using a runc without seccomp built in.

rhatdan picture rhatdan on 6 Aug 2018

@frezbo That message is only in runc without Seccomp support - a runc with seccomp support shouldn't even contain the string

mheon picture mheon on 6 Aug 2018

locate runc
And make sure you are not running one in /usr/local/bin/runc?

rhatdan picture rhatdan on 6 Aug 2018

podman info should indicate the path to the OCI runtime (runc) and Conmon that it will use.

rhatdan picture rhatdan on 6 Aug 2018

podman run with --log-level=debug would also print the path as part of the Conmon commandline

mheon picture mheon on 6 Aug 2018

I had a runc at usr/local/bin removed that so that it uses /usr/bin/runc from runc rpm package, still the same:

img (aws:rean-gov-sd)(kc)$ rpm -ql runc
/usr/bin/runc
/usr/lib/.build-id
/usr/lib/.build-id/f6
/usr/lib/.build-id/f6/c8f750f001325328717d44c83904afc97a4322
/usr/share/bash-completion/completions/runc
/usr/share/doc/runc
/usr/share/doc/runc/CONTRIBUTING.md
/usr/share/doc/runc/MAINTAINERS_GUIDE.md
/usr/share/doc/runc/PRINCIPLES.md
/usr/share/doc/runc/README.md
/usr/share/licenses/runc
/usr/share/licenses/runc/LICENSE
/usr/share/man/man8/runc-checkpoint.8.gz
/usr/share/man/man8/runc-create.8.gz
/usr/share/man/man8/runc-delete.8.gz
/usr/share/man/man8/runc-events.8.gz
/usr/share/man/man8/runc-exec.8.gz
/usr/share/man/man8/runc-kill.8.gz
/usr/share/man/man8/runc-list.8.gz
/usr/share/man/man8/runc-pause.8.gz
/usr/share/man/man8/runc-ps.8.gz
/usr/share/man/man8/runc-restore.8.gz
/usr/share/man/man8/runc-resume.8.gz
/usr/share/man/man8/runc-run.8.gz
/usr/share/man/man8/runc-spec.8.gz
/usr/share/man/man8/runc-start.8.gz
/usr/share/man/man8/runc-state.8.gz
/usr/share/man/man8/runc-update.8.gz
/usr/share/man/man8/runc.8.gz
img (aws:rean-gov-sd)(kc)$ which runc
/usr/bin/runc
img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "setup user: cannot set any additional groups in a rootless container"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$
frezbo picture frezbo on 6 Aug 2018

Running podman with debug also shows using usr/bin/runc

frezbo picture frezbo on 6 Aug 2018

strings /usr/bin/runc | grep -i seccomp
Also does rpm -qVf /usr/bin/runc
show any issues?

rpm -qf /usr/bin/runc
rpm -qf /usr/bin/runc
runc-1.0.0-46.dev.gitb4e2ecb.fc28.x86_64

rhatdan picture rhatdan on 6 Aug 2018 
~ (aws:rean-gov-sd)(kc)$ strings /usr/bin/runc | grep -i seccomp
libseccomp.so.2
seccomp_version
_cgo_12fe10e24c7d_Cfunc_seccomp_export_bpf
_cgo_12fe10e24c7d_Cfunc_seccomp_arch_add
_cgo_12fe10e24c7d_Cfunc_seccomp_syscall_resolve_name
_cgo_12fe10e24c7d_Cfunc_seccomp_syscall_priority
_cgo_12fe10e24c7d_Cfunc_seccomp_export_pfc
_cgo_12fe10e24c7d_Cfunc_seccomp_attr_set
_cgo_12fe10e24c7d_Cfunc_seccomp_rule_add_array
_cgo_12fe10e24c7d_Cfunc_seccomp_arch_remove
_cgo_12fe10e24c7d_Cfunc_seccomp_attr_get
_cgo_12fe10e24c7d_Cfunc_seccomp_merge
_cgo_12fe10e24c7d_Cfunc_seccomp_syscall_resolve_name_arch
_cgo_12fe10e24c7d_Cfunc_seccomp_arch_exist
_cgo_12fe10e24c7d_Cfunc_seccomp_syscall_resolve_num_arch
_cgo_12fe10e24c7d_Cfunc_seccomp_arch_native
_cgo_12fe10e24c7d_Cfunc_seccomp_release
_cgo_12fe10e24c7d_Cfunc_seccomp_rule_add_exact_array
_cgo_12fe10e24c7d_Cfunc_seccomp_load
_cgo_12fe10e24c7d_Cfunc_seccomp_reset
_cgo_12fe10e24c7d_Cfunc_seccomp_init
entersyscallexit status fields.levelgcpacertracehost is downillegal seekinit seccompinvalid baseinvalid kindinvalid portinvalid rootinvalid slotlfstack.pushlibcontainermac_overridemask path %smin_cbm_bitsname=systemdno such hostno-new-privsno-subreaperpids.currentpointtopointpreserve-fdsprotobuf_keyprotobuf_valreflect.Copyreleasep: m=resources, rruntime: gp=short buffersys_resourcesystem.slicetracing stopunexpected )unknown (%c)unknown portunknown_name (default %q) (default %v) MB released
FixedStack is not power-of-2Invalid source for route: %sLibseccomp version too low: MHeap_FreeSpanLocked - span MSpan_Sweep: m is not lockedPrepended_Concatenation_MarkSIGHUP: terminal line hangupSIGWINCH: window size changeUnable to read the lost name_LIBCONTAINER_INITTYPE=setns_mheap_alloc not on g0 stackbad pointer in write barrierblkio.io_wait_time_recursivecan't preserve unlinked spancannot unmarshal DNS messagecomparing uncomparable type container id cannot be emptycontainer init still runningcontainer with id exists: %vcriu failed: %s
heapBitsSetTypeGCProg: small allocationinvalid directory to restore checkpointmismatched count during itab table copymisrounded allocation in MHeap_SysAllocmissing argument to repetition operatormissing verb: % at end of format stringnegative minwidth, tabwidth, or paddingorg.freedesktop.DBus.Error.NoSuchObjectorg.freedesktop.systemd1.Manager.Reloadreflect.MakeMapWithSize of non-map typereflect: FieldByName of non-struct typereflect: unexpected GC program in MapOfrelabeling content in %s is not allowedruntime: blocked write on free polldescruntime: casfrom_Gscanstatus failed gp=runtime: function symbol table header: setting cgroup config for ready processspan and treap node npages do not matchstack growth not allowed in system calltemplate: pattern matches no files: %#qtrailing backslash at end of expressiontransport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697925567626953125action in seccomp profile is invalid: %saddress family not supported by protocolbulkBarrierPreWrite: unaligned argumentscannot exec a container that has stoppedcannot free workbufs when work.full != 0could not check that %q is a symlink: %vdbus: invalid bus address (no transport)deferproc: d.panic != nil after newdeferduration interval must be greater than 0execute new process inside the containerhook ran past specified timeout of %.1fsinvalid synchronisation flag from parentorg.freedesktop.DBus.Error.UnknownMethodorg.freedesktop.systemd1.Manager.GetUnitorg.freedesktop.systemd1.Manager.UnitNewpath to the root of the bundle directoryproto: %s: illegal tag %d (wire type %d)proto: no encoder function for %v -> %v
cannot start a container that has stoppedcannot start an already running containercgo argument has Go pointer to Go pointercrypto/md5: invalid hash state identifierdevice access at %d field cannot be emptyerror validating Seccomp architecture: %sfailure - %s is expected to have 4 fieldsgcSweep being done but phase is not GCoffjson: error calling MarshalJSON for type one of Dst.IP, Src, or Gw must not be nilorg.freedesktop.systemd1.Manager.KillUnitorg.freedesktop.systemd1.Manager.StopUnitreflect.Value.Addr of unaddressable valueruntime.SetFinalizer: second argument is runtime: blocked read on closing polldescruntime: typeBitsBulkBarrier without typesetCheckmarked and isCheckmarked disagreestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basestring %s is not a valid arch for seccomptime: Reset called on uninitialized Timertime: missing Location in call to Time.Inunable to parse %q as a uint from file %qunix:path=/var/run/dbus/system_bus_socketwrong type for value; expected %s; got %s received but handler not on signal stack
log file: %scrypto/sha1: invalid hash state identifiercurrent working directory in the containerenable auto deduplication of memory imagesfunction name %s is not a valid identifierinternal error: no fields in evalChainNodelibcontainer_%d_systemd_test_default.slicelooking for beginning of object key stringon a locked thread with no template threadorg.freedesktop.systemd1.Manager.ListUnitsorg.freedesktop.systemd1.Manager.StartUnitorg.freedesktop.systemd1.Manager.Subscribepersistentalloc: align is not a power of 2proto: duplicate proto type registered: %sproto: invalid google.protobuf.Any messagereflect: Call with too few input argumentsruntime: blocked write on closing polldescsetting Intel RDT config for ready processsubtraction of infinities with equal signssync/atomic: store of nil value into Valueunexpected signal during runtime execution looking for beginning of object key string%c is not a valid device type for device %s%s is an unexported field of struct type %s%s: %q requires a maximum of %d argument(s)%s: %q requires a minimum of %d argument(s)Memory reservation or soft_limit (in bytes)The string of Intel RDT/CAT L3 cache schemaUnable to convert param value to uint64: %sbufio: tried to rewind past start of bufferdbus: got unix fds on unsupported transportgcBgMarkWorker: unexpected gcMarkWorkerModeheapBitsSetTypeGCProg: unexpected bit countinterrupted system call should be restartedlibcontainer: container init failed to execmultiple Read calls return no data or errornon executable command in pipeline stage %dnull conditions list, but length is nonzeroorg.freedesktop.DBus.Error.PropertyReadOnlyorg.freedesktop.systemd1.Manager.JobRemovedorg.freedesktop.systemd1.Manager.ReloadUnitproto: %s: wiretype end group for non-groupreflect: Call with too many input argumentsreflect: CallSlice of non-variadic functionreflect: FieldByNameFunc of non-struct typereflect: nil type passed to Type.Implementsrootless containers require user namespacesruntime.SetFinalizer: finalizer already setruntime.SetFinalizer: first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: heapBitsSetTypeGCProg: total bits runtime: releaseSudog with non-nil gp.paramsetting cgroup config for procHooks processspecify the file to write the process id tostring %s is not a valid action for seccompunknown runnable goroutine during bootstrapuser: %q is a member of more than %d groupswrong number of args for %s: want %d got %d using value obtained using unexported fieldCan't create ipvlan link without ParentIndexContainer cannot be checkpointed in %s stateMust be a func of type `cli.ActionFunc`.  %sUSER namespaces aren't enabled in the kerneladditional-gids must be a positive number %dapplying Intel RDT configuration for processcrypto/sha256: invalid hash state identifiercrypto/sha512: invalid hash state identifierencoding alphabet contains newline charactererror adding seccomp rule for syscall %s: %serror loading seccomp filter into kernel: %sgcmarknewobject called while doing checkmarkorg.freedesktop.systemd1.Manager.RestartUnitorg.freedesktop.systemd1.Manager.Unsubscribereflect: funcLayout with interface receiver reflect: slice length out of range in SetLenruntime: lfstack.push invalid packing: node=systemstack called from unexpected goroutinetemplate: multiple definition of template %qtmpcopyup: failed to move mount %s to %s: %vuse of WriteTo with pre-connected connectionAction: Notify tracing processes with code %dError found less than 3 fields post '-' in %qKernel memory limit (in bytes) for tcp buffercan't call method/function %q with %d resultscannot initialize Seccomp - nil config passedcannot send after transport endpoint shutdowncontext: internal error: missing cancel errorcrypto: RegisterHash of unknown hash functionexitsyscall: syscall frame is no longer validfailed to set the terminal from the stdin: %vheapBitsSetType: called with non-pointer typeleave the process running after checkpointingmath/big: cannot unmarshal %q into a *big.Intmath/big: cannot unmarshal %q into a *big.Ratproto: can't skip unknown wire type %d for %sproto: internal error: bad wiretype for oneofproto: no slice elem oenc for %T -> %T -> %T
reflect: internal error: invalid method indexreflect: nil type passed to Type.AssignableToruntime: failed MSpanList_Remove span.npages=string %s is not a valid operator for seccompwrong number of args: got %d want at least %dbytes.Reader.UnreadByte: at beginning of slicecpuset: cgroup parent path outside cgroup rooterror running hook: %v, stdout: %s, stderr: %sfunction called with %d args; should be 1 or 2math/big: mismatched montgomery number lengthsorg.freedesktop.systemd1.Manager.LinkUnitFilesorg.freedesktop.systemd1.Manager.ListUnitFilesorg.freedesktop.systemd1.Manager.MaskUnitFilespanicwrap: unexpected string after type name: path for previous criu image files in pre-dumpreflect.Value.Slice: slice index out of boundsreflect: nil type passed to Type.ConvertibleToreflect: slice capacity out of range in SetCaprestore a container from a previous checkpointruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc heap initialized
runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesetting Intel RDT config for procHooks processstopTheWorld: not stopped (status != _Pgcstop)template: no files named in call to ParseFilesuse userfaultfd to lazily restore memory pagesMaximum number of pids allowed in the containerP has cached GC work at end of mark terminationattempting to link in too many shared librariesbufio: reader returned negative count from Readchacha20poly1305: message authentication failedchdir to cwd (%q) set in config.json failed: %vdbus: unbuffered channel passed to (*Conn).Senddbus: unbuffered channel passed to (*Object).Goerror adding architecture to seccomp filter: %sorg.freedesktop.systemd1.Manager.TryRestartUnitreflect.Value.Slice3: slice index out of boundsreflect.Value.UnsafeAddr of unaddressable valuereflect: CallSlice with too few input argumentsset the no new privileges value for the processsysctl %q is not in a separate kernel namespaceInt.GobDecode: encoding version %d not supportedP has unflushed stats at end of mark terminationRat.GobDecode: encoding version %d not supportedShows a list of commands or help for one commandTime.MarshalJSON: year outside of range [0,9999]Time.MarshalText: year outside of range [0,9999]bufio: writer returned negative count from Writecan't install method/function %q with %d resultsdivision of zero by zero or infinity by infinityorg.freedesktop.systemd1.Manager.EnableUnitFilesorg.freedesktop.systemd1.Manager.ResetFailedUnitorg.freedesktop.systemd1.Manager.UnmaskUnitFilesreflect: CallSlice with too many input argumentsruntime: cannot map pages in arena address spacestrconv: illegal AppendFloat/FormatFloat bitSizetls: CloseWrite called before handshake completeunable to convert param value (%q) to uint64: %vunable to parse %q as a uint from Cgroup file %qCPU shares (relative weight vs. other containers)cannot set gid to unmapped user in user namespacecannot set uid to unmapped user in user namespacecasgstatus: waiting for Gwaiting but is Grunnableenable rootless mode ('true', 'false', or 'auto')generate a configuration for a rootless containerinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characterorg.freedesktop.DBus.Properties.PropertiesChangedorg.freedesktop.systemd1.Manager.DisableUnitFilesorg.freedesktop.systemd1.Manager.ListUnitsByNamespanicwrap: unexpected string after package name: pause suspends all processes inside the containerreflect.Value.Slice: slice of unaddressable arrayrequested action matches default action of filterruntime.reflect_makemap: unsupported map key types.allocCount != s.nelems && freeIndex == s.nelemsstrconv: internal error, rest != 0 but needed > 0strconv: num > den<<shift in adjustLastDigitFixedstrings.Reader.UnreadByte: at beginning of stringstrings.Reader.WriteTo: invalid WriteString countwritebarrierptr_prewrite1 called with mp.p == nil%s has arguments but cannot be invoked as functionFloat.GobDecode: encoding version %d not supportedattempt to execute system stack code on user stackcriu writes \0 to this FD once lazy-pages is readydbus: invalid address (both path and abstract set)encountered nil syscall while initializing Seccompgo package net: dynamic selection of DNS resolver
cgroups mode: 'soft' (default), 'full' and 'strict'dbus: received more than one socket control messageerror adding seccomp filter rule for syscall %s: %serror initializing seccomp - invalid default actionorg.freedesktop.systemd1.Manager.StartTransientUnitproto: bad extension number; not in declared rangesruntime: cannot reserve arena virtual address spacesysctl %q is not allowed in the hosts ipc namespace%q cannot be mounted because it is located inside %qUser namespaces enabled, but no group mapping found.add a capability to the bounding set for the processapparmor: config provided but apparmor not supportedcannot get OOM notifications from rootless containercasfrom_Gscanstatus: gp->status is not in scan statecreate a namespace, but don't restore its propertiescrypto/rsa: message too long for RSA public key sizedbus: control data truncated (too many fds received)lists containers started by runc with the given rootmath/big: cannot unmarshal %q into a *big.Float (%v)org.freedesktop.systemd1.Manager.ListUnitsByPatternsorg.freedesktop.systemd1.Manager.ReloadOrRestartUnitps displays the processes running inside a containerruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Init
set the format used by logs ('text' (default), or 'json')sync: WaitGroup misuse: Add called concurrently with Waitinvalid cgroup entry: must contain at least two colons: %vjson: cannot set embedded pointer to unexported struct: %vbufio.Scanner: SplitFunc returns advance count beyond inputerror creating seccomp syscall condition for syscall %s: %sreflect: indirection through nil pointer to embedded structruntime: mmap: too much locked memory (check 'ulimit -l').
*configs.Seccomp
*seccomp.ScmpArch
*seccomp.ScmpAction
*seccomp.ScmpFilter
*seccomp._Ctype_int
*specs.LinuxSeccomp
*seccomp.ScmpSyscall
*seccomp._Ctype_char
*seccomp._Ctype_uint
*seccomp._Ctype_void
*seccomp.VersionError
*seccomp._Ctype_uchar
*seccomp._Ctype_ulong
*seccomp.ScmpCompareOp
*seccomp.ScmpCondition
*specs.LinuxSeccompArg
*seccomp.scmpFilterAttr
Seccomp
json:"seccomp"
*[]seccomp.ScmpCondition
*[]specs.LinuxSeccompArg
*[0]seccomp.ScmpCondition
*[1]seccomp.ScmpCondition
*specs.LinuxSeccompAction
*func(*seccomp.ScmpFilter)
*seccomp._Ctype_scmp_cast_t
*specs.LinuxSeccompOperator
*func(seccomp.ScmpArch) error
*func(int16) seccomp.ScmpAction
*func(seccomp.ScmpAction) error
*seccomp._Ctype_scmp_filter_ctx
 *func(*seccomp.ScmpFilter) error
Seccomp
json:"seccomp,omitempty"
#*func() (seccomp.ScmpAction, error)
#*seccomp._Ctype_struct_scmp_arg_cmp
%*func(seccomp.ScmpArch) (bool, error)
'*func(seccomp.ScmpArch) (string, error)
'*func(seccomp.ScmpSyscall, uint8) error
4*func(seccomp.ScmpSyscall, seccomp.ScmpAction) error
Jgithub.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang
M*func(seccomp.ScmpSyscall, seccomp.ScmpAction, []seccomp.ScmpCondition) error
type..hash.github.com/opencontainers/runc/vendor/github.com/opencontainers/runtime-spec/specs-go.LinuxSeccompArg
type..eq.github.com/opencontainers/runc/vendor/github.com/opencontainers/runtime-spec/specs-go.LinuxSeccompArg
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_CString
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_GoString
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_add_struct_arg_cmp
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_free
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_get_major_version
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_get_micro_version
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_get_minor_version
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_make_arg_cmp_array
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_arch_add
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_arch_exist
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_arch_remove
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_attr_get
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_attr_set
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_export_bpf
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_export_pfc
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_init
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_load
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_merge
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_release
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_reset
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_rule_add_array
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_rule_add_exact_array
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_syscall_priority
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_syscall_resolve_name
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._Cfunc_seccomp_syscall_resolve_num_arch
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang._cgo_cmalloc
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.VersionError.Error
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.GetArchFromString
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ensureSupportedVersion
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.checkVersionAbove
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpArch.String
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpCompareOp.String
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpAction.String
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpAction.SetReturnCode
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpAction.GetReturnCode
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpSyscall.GetName
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpSyscall.GetNameByArch
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpArch.toNative
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.GetSyscallFromName
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.MakeCondition
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.NewFilter
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpAction.toNative
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).IsValid
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Reset
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Release
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Merge
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).IsArchPresent
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).AddArch
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).RemoveArch
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Load
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).GetDefaultAction
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).GetBadArchAction
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).GetNoNewPrivsBit
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).SetBadArchAction
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).SetNoNewPrivsBit
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).SetSyscallPriority
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).AddRule
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).AddRuleExact
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).AddRuleConditional
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).AddRuleConditionalExact
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).ExportPFC
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).ExportBPF
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.filterFinalizer
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).getFilterAttr
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.scmpFilterAttr.toNative
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).setFilterAttr
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).addRuleWrapper
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).addRuleGeneric
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpCompareOp.toNative
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.sanitizeArch
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.sanitizeAction
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.actionFromNative
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpSyscall.GetNameByArch.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.GetSyscallFromName.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Reset.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Release.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Merge.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).IsArchPresent.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).AddArch.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).RemoveArch.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).Load.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).SetSyscallPriority.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).ExportPFC.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).ExportBPF.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).getFilterAttr.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).setFilterAttr.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).addRuleWrapper.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).addRuleWrapper.func2
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpFilter).addRuleGeneric.func1
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.init
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpAction).String
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpAction).SetReturnCode
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpAction).GetReturnCode
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpArch).String
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpCompareOp).String
type..hash.github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpFilter
type..eq.github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.ScmpFilter
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpSyscall).GetName
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*ScmpSyscall).GetNameByArch
type..hash.github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.VersionError
type..eq.github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.VersionError
github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang.(*VersionError).Error
github.com/opencontainers/runc/libcontainer/seccomp.ConvertStringToOperator
github.com/opencontainers/runc/libcontainer/seccomp.ConvertStringToAction
github.com/opencontainers/runc/libcontainer/seccomp.ConvertStringToArch
github.com/opencontainers/runc/libcontainer/seccomp.InitSeccomp
github.com/opencontainers/runc/libcontainer/seccomp.getAction
github.com/opencontainers/runc/libcontainer/seccomp.getOperator
github.com/opencontainers/runc/libcontainer/seccomp.getCondition
github.com/opencontainers/runc/libcontainer/seccomp.matchCall
github.com/opencontainers/runc/libcontainer/seccomp.init
github.com/opencontainers/runc/libcontainer/specconv.SetupSeccomp
/builddir/build/BUILD/runc-ad0f5255060d36872be04de22f8731f38ef2d7b1/GOPATH/src/github.com/opencontainers/runc/GOPATH/src/github.com/opencontainers/runc/libcontainer/seccomp/seccomp_linux.go
/builddir/build/BUILD/runc-ad0f5255060d36872be04de22f8731f38ef2d7b1/GOPATH/src/github.com/opencontainers/runc/GOPATH/src/github.com/opencontainers/runc/libcontainer/seccomp/config.go
/builddir/build/BUILD/runc-ad0f5255060d36872be04de22f8731f38ef2d7b1/GOPATH/src/github.com/opencontainers/runc/GOPATH/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go
/builddir/build/BUILD/runc-ad0f5255060d36872be04de22f8731f38ef2d7b1/GOPATH/src/github.com/opencontainers/runc/GOPATH/src/github.com/opencontainers/runc/vendor/github.com/seccomp/libseccomp-golang/seccomp.go
~ (aws:rean-gov-sd)(kc)$

~ (aws:rean-gov-sd)(kc)$ rpm -qVf /usr/bin/runc ~ (aws:rean-gov-sd)(kc)$ rpm -qf /usr/bin/runc runc-1.0.0-36.gitad0f525.fc28.x86_64 ~ (aws:rean-gov-sd)(kc)$
Thanks

frezbo picture frezbo on 6 Aug 2018

That looked like a separate bug in the second trace - something about rootless containers? Are you running as non-root?

mheon picture mheon on 6 Aug 2018

Yeh non-root

frezbo picture frezbo on 6 Aug 2018

Does it work if you run it as root?

rhatdan picture rhatdan on 7 Aug 2018

@giuseppe ptal

rhatdan picture rhatdan on 7 Aug 2018

@rhatdan I just got a runc rpm update today and now getting a new error:

img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN ["echo", "hi"]
container_linux.go:336: starting container process caused "setup user: cannot set any additional groups in a rootless container"
error running container: error creating container for [/bin/echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[json:true] Message:RUN echo hi Original:RUN ["echo", "hi"]}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$ cat Dockerfile.new 
FROM docker.io/library/alpine
RUN ["echo", "hi"]

img (aws:rean-gov-sd)(kc)$

works as root:

img (aws:rean-gov-sd)(kc)$ sudo su 
[sudo] password for frezbo: 
Sorry, try again.
[sudo] password for frezbo: 
img $ ls
Dockerfile  Dockerfile.new  Dockerfile.scratch  target
img $ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
Getting image source signatures
Copying blob sha256:8e3ba11ec2a2b39ab372c60c16b421536e50e5ce64a0bc81765c2e38381bcff6
 2.10 MiB / 2.10 MiB [======================================================] 0s
Copying config sha256:11cd0b38bc3ceb958ffb2f9bd70be3fb317ce7d255c8a4c3f4af30e298aa1aab
 1.48 KiB / 1.48 KiB [======================================================] 0s
Writing manifest to image destination
Storing signatures
STEP 2: RUN ["echo", "hi"]
hi
STEP 3: COMMIT containers-storage:[overlay@/var/lib/containers/storage+/var/run/containers/storage:overlay.override_kernel_check=true]@1346dab1fad340ff4f2337e269b6a82e287404b653ff6e4a9d41238c8944d23b
Getting image source signatures
Skipping fetch of repeat blob sha256:73046094a9b835e443af1a9d736fcfc11a994107500e474d0abf399499ed280c
Copying blob sha256:5d7cd18731134be2d83723feeaa661b0e2591dee032cdc7edb1f7a2532d9573f
 160 B / 160 B [============================================================] 0s
Copying config sha256:8fcbd43176699e5786647dd99f5cd874cb46d736bd2060063a88c9a5e931e59b
 721 B / 721 B [============================================================] 0s
Writing manifest to image destination
Storing signatures
--> 1346dab1fad340ff4f2337e269b6a82e287404b653ff6e4a9d41238c8944d23b
img $
frezbo picture frezbo on 7 Aug 2018

I think that is a bug in runc. It complains that it cannot set additional groups even if newuidmap/newgidmap are used to configure the mapping into the container thus it is not necessary to disable additional groups (set /proc/PID/setgroups to deny) when setting a new user namespace.

giuseppe picture giuseppe on 7 Aug 2018

@giuseppe PTAL

rhatdan picture rhatdan on 7 Aug 2018

we could also fix it for now in Buildah not using additional groups to the config.json file

giuseppe picture giuseppe on 7 Aug 2018
👍1

Could you open a PR, and I can get a updated package out.

rhatdan picture rhatdan on 7 Aug 2018

looking into it right now...

giuseppe picture giuseppe on 7 Aug 2018

@giuseppe https://github.com/projectatomic/buildah/issues/467#issuecomment-411011903 that would explain why plain runc works rootless

frezbo picture frezbo on 7 Aug 2018

I am not able to reproduce it using buildah-1.3-1 and runc-1.0.0-46 from Bodhi. Have you used these versions?

giuseppe picture giuseppe on 7 Aug 2018 
~ (aws:rean-gov-sd)(kc)$ rpm -qf /usr/bin/runc
runc-1.0.0-46.dev.gitb4e2ecb.fc28.x86_64
~ (aws:rean-gov-sd)(kc)$ rpm -qf $(which buildah)
buildah-1.2-1.gitbe87762.fc28.x86_64
~ (aws:rean-gov-sd)(kc)$

I am using the rpm's. I could compile from source and check as the buildah version differs significanlty

frezbo picture frezbo on 7 Aug 2018

could you please try: https://bodhi.fedoraproject.org/updates/FEDORA-2018-a600343e06 and https://bodhi.fedoraproject.org/updates/FEDORA-2018-98c4c26a8c ?

giuseppe picture giuseppe on 7 Aug 2018

@giuseppe just build buildah from source:

img (aws:rean-gov-sd)(kc)$ $GOPATH/bin/buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN ["echo", "hi"]
hi
STEP 3: COMMIT containers-storage:[vfs@/home/frezbo/.local/share/containers/storage+/run/user/1000/run]@bb9b3a832c4f692011ac98867146ab1cde2cc2b5b428f79b7a3d60affdf6562b
Getting image source signatures
Skipping fetch of repeat blob sha256:73046094a9b835e443af1a9d736fcfc11a994107500e474d0abf399499ed280c
Copying blob sha256:48eaf946e278225a2384fd53250d167868b5c7614c6d157766accfd9d17376a6
 132 B / 132 B [============================================================] 0s
Copying config sha256:cfb8ab732064d19ddb1a98ace0bd3d2760f0237ff6ca16b05e583b681b116cf4
 719 B / 719 B [============================================================] 0s
Writing manifest to image destination
Storing signatures
ERRO[0003] Error while applying layer: ApplyLayer exit status 1 stdout:  stderr: lchown /etc: invalid argument 
error copying layers and metadata: Error committing the finished image: error adding layer with blob "sha256:48eaf946e278225a2384fd53250d167868b5c7614c6d157766accfd9d17376a6": ApplyLayer exit status 1 stdout:  stderr: lchown /etc: invalid argument
ERRO[0003] exit status 1                                
img (aws:rean-gov-sd)(kc)$ 
buildah (aws:rean-gov-sd)(kc)(git:master)$ $GOPATH/bin/buildah --version
buildah version 1.4-dev (image-spec 1.0.0, runtime-spec 1.0.0)
buildah (aws:rean-gov-sd)(kc)(git:master)$
frezbo picture frezbo on 7 Aug 2018

another thing to check, how many subuids/subgids are available to your user? They are defined in the /etc/subuid and /etc/subgid files?

giuseppe picture giuseppe on 7 Aug 2018

I hope this is not an issue:

img (aws:rean-gov-sd)(kc)$ cat /etc/subuid
frezbo:100000:65536
img (aws:rean-gov-sd)(kc)$ cat /etc/subgid
frezbo:100000:65536
img (aws:rean-gov-sd)(kc)$
frezbo picture frezbo on 7 Aug 2018

the configuration looks fine, but the error message looks very similar to something that we fixed recently: https://github.com/projectatomic/buildah/issues/882

Could you confirm if the commit https://github.com/projectatomic/buildah/commit/b956493c6d2f8ebc9a26e90aaae563345949b8ae is included in your version of buildah?

giuseppe picture giuseppe on 7 Aug 2018

or even better, what commit exactly are you using for the build? :-)

giuseppe picture giuseppe on 7 Aug 2018

@giuseppe I do have that commit:

buildah (aws:rean-gov-sd)(kc)(git:detached)$ gs
HEAD detached at b956493c
nothing to commit, working tree clean
buildah (aws:rean-gov-sd)(kc)(git:detached)$

and I'm at master on 308ad3d7fc63ee34ed213c2ffa6b345441600b8f

frezbo picture frezbo on 7 Aug 2018

buildah has a nice feature to create an usernamespace and run a command in it.

Could you try buildah unshare cat /proc/self/uid_map?

giuseppe picture giuseppe on 7 Aug 2018 
~ (aws:rean-gov-sd)(kc)$ buildah unshare cat /proc/self/uid_map
         0       1000          1
    100000     100000      65536
~ (aws:rean-gov-sd)(kc)$ $GOPATH/bin/buildah unshare cat /proc/self/uid_map
         0       1000          1
         1     100000      65536
~ (aws:rean-gov-sd)(kc)$
frezbo picture frezbo on 7 Aug 2018

do you have a similar outputh with /proc/self/gid_map? The buildah in the GOPATH is correct, that is the correct map. I am afraid somehow the system installed buildah is used for the build of your container, thus the error you have seen earlier.

giuseppe picture giuseppe on 7 Aug 2018 
~ (aws:rean-gov-sd)(kc)$ $GOPATH/bin/buildah unshare cat /proc/self/uid_map
         0       1000          1
         1     100000      65536
~ (aws:rean-gov-sd)(kc)$ buildah unshare cat /proc/self/uid_map
         0       1000          1
    100000     100000      65536
~ (aws:rean-gov-sd)(kc)$ $GOPATH/bin/buildah unshare cat /proc/self/gid_map
         0       1000          1
         1     100000      65536
~ (aws:rean-gov-sd)(kc)$ buildah unshare cat /proc/self/gid_map
         0       1000          1
    100000     100000      65536
~ (aws:rean-gov-sd)(kc)$

I could uninstall buildah and try, I prefer using compiled binaries in GOPATH

frezbo picture frezbo on 7 Aug 2018

it might be something wrong in the re-exec code in buildah, could you just move the compiled buildah in /usr/local/bin to see if it makes any difference?

giuseppe picture giuseppe on 7 Aug 2018

same sadly :o: 

~ (aws:rean-gov-sd)(kc)$ which buildah
/usr/bin/buildah
~ (aws:rean-gov-sd)(kc)$ sudo mv /usr/bin/buildah /tmp/
[sudo] password for frezbo: 
~ (aws:rean-gov-sd)(kc)$ sudo cp $GOPATH/bin/buildah /usr/bin/buildah
~ (aws:rean-gov-sd)(kc)$ cd git/work/docker/img
img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
hi
STEP 3: COMMIT containers-storage:[vfs@/home/frezbo/.local/share/containers/storage+/run/user/1000/run]@029fae12bed890145991eb5527d485a0824b5b5cea9fe2361391d52ff8b41462
Getting image source signatures
Skipping fetch of repeat blob sha256:73046094a9b835e443af1a9d736fcfc11a994107500e474d0abf399499ed280c
Copying blob sha256:4e3b9e2843588404968be95f542fada9f09388b9098d8f21b120746da81e66b8
 132 B / 132 B [============================================================] 0s
Copying config sha256:49f996efff4db8f9b7d78979ad5e57a4551606439d7c72e5d732a7d0aa6a1dea
 721 B / 721 B [============================================================] 0s
Writing manifest to image destination
Storing signatures
ERRO[0002] Error while applying layer: ApplyLayer exit status 1 stdout:  stderr: lchown /etc: invalid argument 
error copying layers and metadata: Error committing the finished image: error adding layer with blob "sha256:4e3b9e2843588404968be95f542fada9f09388b9098d8f21b120746da81e66b8": ApplyLayer exit status 1 stdout:  stderr: lchown /etc: invalid argument
ERRO[0002] exit status 1                                
img (aws:rean-gov-sd)(kc)$
frezbo picture frezbo on 7 Aug 2018

oh it can be that the storage got corrupted from the previous broken version. Could you try to nuke the storage before the build? sudo rm -rf /home/frezbo/.local/share/containers/storage

giuseppe picture giuseppe on 7 Aug 2018

I've just spawned a new F28 droplet on Digital Ocean to try again on a clean system:

this is all I've done:

# dnf upgrade -y
# dnf install -y https://kojipkgs.fedoraproject.org//packages/buildah/1.3/1.git4888163.fc28/x86_64/buildah-1.3-1.git4888163.fc28.x86_64.rpm \
    https://kojipkgs.fedoraproject.org//packages/runc/1.0.0/46.dev.gitb4e2ecb.fc28/x86_64/runc-1.0.0-46.dev.gitb4e2ecb.fc28.x86_64.rpm
# adduser foo
#  mkdir /run/user/1000 && chown 1000:1000 /run/user/1000
# su -l foo
$ printf "FROM docker.io/library/alpine\nRUN echo hi\n" > Dockerfile
$ buildah bud .
STEP 1: FROM docker.io/library/alpine
Getting image source signatures
Copying blob sha256:8e3ba11ec2a2b39ab372c60c16b421536e50e5ce64a0bc81765c2e38381bcff6
 2.10 MiB / 2.10 MiB [======================================================] 0s
Copying config sha256:11cd0b38bc3ceb958ffb2f9bd70be3fb317ce7d255c8a4c3f4af30e298aa1aab
 1.48 KiB / 1.48 KiB [======================================================] 0s
Writing manifest to image destination
Storing signatures
STEP 2: RUN echo hi
STEP 3: COMMIT containers-storage:[vfs@/home/foo/.local/share/containers/storage+/run/user/1000/run]@685ddf5a1ca930e4564c5af28874dc901b0bb6f0b95a863e5a93c89d1904d858
Getting image source signatures
Skipping fetch of repeat blob sha256:73046094a9b835e443af1a9d736fcfc11a994107500e474d0abf399499ed280c
Copying blob sha256:55738ddf6159ab2ca873a05a6268d88acce61bb59dbcac34616d4b1b43fe8a71
 132 B / 132 B [============================================================] 0s
Copying config sha256:54a40d3470caa67c22057c9657f7a7e66c1ecdc5953319cb2fe9c2b647058f5b
 721 B / 721 B [============================================================] 0s
Writing manifest to image destination
Storing signatures
--> 685ddf5a1ca930e4564c5af28874dc901b0bb6f0b95a863e5a93c89d1904d858

```

giuseppe picture giuseppe on 7 Aug 2018

I thought I ha removed that, yeh it worked. Thanks. So I assume the next set of upcoming rpms fix it.

frezbo picture frezbo on 7 Aug 2018

@giuseppe Thanks for all the help. Even the compiled runc works.

frezbo picture frezbo on 7 Aug 2018

great! @rhatdan I think we can close this issue

giuseppe picture giuseppe on 7 Aug 2018

ahh so builda does not cache stages, woudn't that slow the builds, I was thinking of benchmarking with img, buildctl, buildah etc

frezbo picture frezbo on 7 Aug 2018

@frezbo buildah bud --layers ... to enable the cache

giuseppe picture giuseppe on 7 Aug 2018
👍1

@frezbo Also if you want to default to buildah --layers. then set the environment variable.

export BUILDAH_LAYERS=true

And you will get it by default.

rhatdan picture rhatdan on 7 Aug 2018
👍1

I get the same error on F28 with the latest updates installed, runc came packaged with podman:

img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "seccomp: config provided but seccomp not supported"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile --runtime $GOPATH/bin/runc -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "seccomp: config provided but seccomp not supported"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$

Tried using compiled runc with/without seccomp. I see the same issue using img compiled with seccomp. Is there any package I'm missing

hey i am also facing the same error? did you find anything on this issue?

anjupawaria picture anjupawaria on 23 Nov 2020

I get the same error on F28 with the latest updates installed, runc came packaged with podman:

img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile  -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "seccomp: config provided but seccomp not supported"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$ buildah build-using-dockerfile --runtime $GOPATH/bin/runc -f Dockerfile.new .
STEP 1: FROM docker.io/library/alpine
STEP 2: RUN echo hi
container_linux.go:336: starting container process caused "seccomp: config provided but seccomp not supported"
error running container: error creating container for [/bin/sh -c echo hi]: : exit status 1
error building at step {Env:[PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin] Command:run Args:[echo hi] Flags:[] Attrs:map[] Message:RUN echo hi Original:RUN echo hi}: exit status 1
ERRO[0001] exit status 1                                
img (aws:rean-gov-sd)(kc)$

Tried using compiled runc with/without seccomp. I see the same issue using img compiled with seccomp. Is there any package I'm missing

hey i am also facing the same error? did you find anything on this issue?

You quoted a comment about f28 which has been dead for a long time now. Perhaps better to file a new issue.

lsm5 picture lsm5 on 23 Nov 2020
Was this page helpful?
0 / 5 - 0 ratings

Related issues

tensor5 picture tensor5  路  5Comments
azatsarynnyy picture azatsarynnyy  路  3Comments
bkhadars picture bkhadars  路  11Comments
stiller-leser picture stiller-leser  路  10Comments
ssbarnea picture ssbarnea  路  11Comments