Cri-o: CRI-o fails to start after installation
After installing cri-o-1.11 on ubuntu - it fails to start, because runc is not linked to the right location /usr/bin/runc
OS: ubuntu/xenial64
$ add-apt-repository -y ppa:projectatomic/ppa
$ apt-get update
$ apt-get install -y cri-o-1.11
$ systemctl status crio.service
● crio.service - Open Container Initiative Daemon
Loaded: loaded (/lib/systemd/system/crio.service; disabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Sun 2018-09-02 22:30:15 UTC; 2min 8s ago
Docs: https://github.com/kubernetes-incubator/cri-o
Process: 5686 ExecStart=/usr/bin/crio $CRIO_STORAGE_OPTIONS $CRIO_NETWORK_OPTIONS (code=exited, status=1/FAILURE)
Main PID: 5686 (code=exited, status=1/FAILURE)
Sep 02 22:30:15 master1 systemd[1]: Starting Open Container Initiative Daemon...
Sep 02 22:30:15 master1 crio[5686]: time="2018-09-02 22:30:15.891302068Z" level=fatal msg="invalid --runtime value "stat /usr/bin/runc: no such file or directory""
Sep 02 22:30:15 master1 systemd[1]: crio.service: Main process exited, code=exited, status=1/FAILURE
Sep 02 22:30:15 master1 systemd[1]: Failed to start Open Container Initiative Daemon.
Sep 02 22:30:15 master1 systemd[1]: crio.service: Unit entered failed state.
Sep 02 22:30:15 master1 systemd[1]: crio.service: Failed with result 'exit-code'.
$ which runc
$ find / -name runc
/usr/lib/cri-o-runc/sbin/runc
ln -s /usr/lib/cri-o-runc/sbin/runc /usr/bin/runc
$ systemctl start crio
$ systemctl status crio.service
● crio.service - Open Container Initiative Daemon
Loaded: loaded (/lib/systemd/system/crio.service; disabled; vendor preset: enabled)
Active: active (running) since Sun 2018-09-02 22:32:28 UTC; 1s ago
Docs: https://github.com/kubernetes-incubator/cri-o
Main PID: 5872 (crio)
Tasks: 10
Memory: 6.2M
CPU: 79ms
CGroup: /system.slice/crio.service
└─5872 /usr/bin/crio
Sep 02 22:32:28 master1 systemd[1]: Starting Open Container Initiative Daemon...
Sep 02 22:32:28 master1 systemd[1]: Started Open Container Initiative Daemon.
outcoldman
All 31 comments
And maybe to the same note, when I tried to kubeadm init, got some problems, that kubernetes expected to find /usr/local/libexec/crio/conmon and /usr/local/libexec/crio/pause, but they were located in /usr/lib/crio/bin/, so linked them again
mkdir -p /usr/local/libexec/crio/
ln -s /usr/lib/crio/bin/conmon /usr/local/libexec/crio/conmon
ln -s /usr/lib/crio/bin/pause /usr/local/libexec/crio/pause
@lsm5 looks like the crio configuration and package is somehow misconfigured, did we change anything?
runcom
on 3 Sep 2018
This problem just happened on my Fedora 29 workstation. Runc is installed on /usr/sbin/runc and crio searches for /usr/bin/runc. A simple link resolved the problem.
L30Bola
on 31 Jan 2019
@outcoldman 👍
tongchao199
on 22 Feb 2019
@lsm5 do we still have this issue?
rhatdan
on 18 Mar 2019
Yes, I am also having this issue on CentOS.
j-chao
on 11 Apr 2019
To link the binary, use ln:
ln -s /usr/sbin/runc /usr/bin/runc
The -s make the link, a symbolic link.
From the binary /usr/sbin/runc
And create a link at /usr/bin/runc
L30Bola
on 11 Apr 2019
I'm running into the same issue with Ubuntu 18.04 and cri-o 1.17. I was able to fix the issue with @outcoldman's suggestion: ln -s /usr/lib/cri-o-runc/sbin/runc /usr/bin/runc.
● crio.service - Container Runtime Interface for OCI (CRI-O)
Loaded: loaded (/usr/lib/systemd/system/crio.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Sun 2020-02-23 15:46:17 UTC; 4h 26min ago
Docs: https://github.com/cri-o/cri-o
Process: 6237 ExecStart=/usr/bin/crio $CRIO_CONFIG_OPTIONS $CRIO_RUNTIME_OPTIONS $CRIO_STORAGE_OPTIONS $CRIO_NETWORK_OPTIONS $CRIO_METRICS_OPTIONS (code=exited, status=1/FAILURE)
Main PID: 6237 (code=exited, status=1/FAILURE)
Feb 23 15:46:16 ubuntu systemd[1]: Starting Container Runtime Interface for OCI (CRI-O)...
Feb 23 15:46:17 ubuntu crio[6237]: time="2020-02-23 15:46:17.134726652Z" level=fatal msg="runtime config: runtime validation: \"runc\" not found in $PATH: exec: \"runc\": executable file not found in $PATH"
Feb 23 15:46:17 ubuntu systemd[1]: crio.service: Main process exited, code=exited, status=1/FAILURE
Feb 23 15:46:17 ubuntu systemd[1]: crio.service: Failed with result 'exit-code'.
Feb 23 15:46:17 ubuntu systemd[1]: Failed to start Container Runtime Interface for OCI (CRI-O).
marshall@ubuntu:~$ sudo apt-cache show cri-o-1.17
Package: cri-o-1.17
Version: 1.17.0-3
Architecture: amd64
Maintainer: Lokesh Mandvekar <[email protected]>
Installed-Size: 87308
Depends: libgpgme11, libseccomp2, conmon, containers-common (>= 0.1.27), cri-o-runc (>= 1.0.0)
Suggests: containernetworking-plugins
Replaces: cri-o-1.10, cri-o-1.11, cri-o-1.11-stable, cri-o-1.12, cri-o-1.13, cri-o-1.14, cri-o-1.15, cri-o-1.16
Filename: ./amd64/cri-o-1.17_1.17.0-3_amd64.deb
Size: 18611120
MD5sum: e7fd801f59f0bd199835e573cfbdf814
SHA1: 5b5e529106c9bc81bd9a6150e0dd851372032bdd
SHA256: 127a26329d2e739f11f23785a83da5a86d067b72e2603d66098b2dd96191f4e6
Section: devel
Priority: optional
Homepage: https://github.com/cri-o/cri-o
Description: OCI-based implementation of Kubernetes Container Runtime Interface.
Description-md5: a8cb00ac87b19d2db81aefe9cf4f39e3
marshallford
on 23 Feb 2020
Same issue here on CentOS7, installing cluster using Kubespray v2.12.1, using cri-o v1.14.11-1.el7.
$ ansible-playbook -i inventory/inventory.ini cluster.yml -b -v
fatal: [master]: FAILED! => {"changed": false, "msg": "Unable to start service crio: Job for crio.service failed because the control process exited with error code. See \"systemctl status crio.service\" and \"journalctl -xe\" for details.\n"}
$ systemctl status crio.service
● crio.service - Open Container Initiative Daemon
Loaded: loaded (/usr/lib/systemd/system/crio.service; enabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Tue 2020-02-25 17:09:09 UTC; 15h ago
Docs: https://github.com/cri-o/cri-o
Process: 1897 ExecStart=/usr/bin/crio $CRIO_STORAGE_OPTIONS $CRIO_NETWORK_OPTIONS $CRIO_METRICS_OPTIONS (code=exited, status=1/FAILURE)
Main PID: 1897 (code=exited, status=1/FAILURE)
$ journalctl -xe
Feb 26 08:59:01 master systemd[1]: Starting CRI-O Auto Update Script...
-- Subject: Unit crio-wipe.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit crio-wipe.service has begun starting up.
Feb 26 08:59:01 master crio[2696]: version file /var/lib/crio/version not found: open /var/lib/crio/ver
Feb 26 08:59:01 master systemd[1]: Started CRI-O Auto Update Script.
-- Subject: Unit crio-wipe.service has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit crio-wipe.service has finished starting up.
--
-- The start-up result is done.
Feb 26 08:59:01 master systemd[1]: Starting Open Container Initiative Daemon...
-- Subject: Unit crio.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit crio.service has begun starting up.
Feb 26 08:59:01 master crio[2716]: time="2020-02-26 08:59:01.990665351Z" level=fatal msg="decoding secc
Feb 26 08:59:01 master systemd[1]: crio.service: main process exited, code=exited, status=1/FAILURE
Feb 26 08:59:01 master systemd[1]: Failed to start Open Container Initiative Daemon.
-- Subject: Unit crio.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit crio.service has failed.
--
-- The result is failed.
Feb 26 08:59:01 master systemd[1]: Unit crio.service entered failed state.
Feb 26 08:59:01 master systemd[1]: crio.service failed.
_/usr/bin/runc_ exists, thanks to runtime path being specified in the playbook (in _./roles/container-engine/cri-o/templates/crio.conf.j2_) :
[crio.runtime.runtimes.runc]
{% if ansible_os_family == "ClearLinux" or ansible_os_family == "RedHat" or ansible_distribution == "Ubuntu" %}
runtime_path = "/usr/bin/runc"
{% else %}
runtime_path = "/usr/sbin/runc"
{% endif %}
runtime_type = "oci"
Any clue of what could be the problem ... ?
Thanks
manicole
on 26 Feb 2020
@manicole what is the rest of this line:
Feb 26 08:59:01 master crio[2716]: time="2020-02-26 08:59:01.990665351Z" level=fatal msg="decoding secc
in the journal logs? I would guess that's the issue
haircommander
on 26 Feb 2020
by the way, we've deprecated the projectatomic ppa, and now are moving our packaging efforts to openSUSE's OBS Kubic repo:
https://build.opensuse.org/project/show/devel:kubic:libcontainers:stable
you may have more luck with that
haircommander
on 26 Feb 2020
@manicole what is the rest of this line:
Feb 26 08:59:01 master crio[2716]: time="2020-02-26 08:59:01.990665351Z" level=fatal msg="decoding secc
in the journal logs? I would guess that's the issue
Good guess :
Feb 26 16:08:44 master crio[5589]: time="2020-02-26 16:08:44.556525318Z" level=fatal msg="decoding seccomp profile failed: invalid character '"' in literal null (expecting 'u')"
My seccomp profile is :
{
"defaultAction": "SCMP_ACT_ERRNO",
"archMap": [
{
"architecture": "SCMP_ARCH_X86_64",
"subArchitectures": [
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
]
},
{
"architecture": "SCMP_ARCH_AARCH64",
"subArchitectures": [
"SCMP_ARCH_ARM"
]
},
{
"architecture": "SCMP_ARCH_MIPS64",
"subArchitectures": [
"SCMP_ARCH_MIPS",
"SCMP_ARCH_MIPS64N32"
]
},
{
"architecture": "SCMP_ARCH_MIPS64N32",
"subArchitectures": [
"SCMP_ARCH_MIPS",
"SCMP_ARCH_MIPS64"
]
},
{
"architecture": "SCMP_ARCH_MIPSEL64",
"subArchitectures": [
"SCMP_ARCH_MIPSEL",
"SCMP_ARCH_MIPSEL64N32"
]
},
{
"architecture": "SCMP_ARCH_MIPSEL64N32",
"subArchitectures": [
"SCMP_ARCH_MIPSEL",
"SCMP_ARCH_MIPSEL64"
]
},
{
"architecture": "SCMP_ARCH_S390X",
"subArchitectures": [
"SCMP_ARCH_S390"
]
}
],
"syscalls": [
{
"names": [
"accept",
"accept4",
"access",
"adjtimex",
"alarm",
"bind",
"brk",
"capget",
"capset",
"chdir",
"chmod",
"chown",
"chown32",
"clock_getres",
"clock_gettime",
"clock_nanosleep",
"close",
"connect",
"copy_file_range",
"creat",
"dup",
"dup2",
"dup3",
"epoll_create",
"epoll_create1",
"epoll_ctl",
"epoll_ctl_old",
"epoll_pwait",
"epoll_wait",
"epoll_wait_old",
"eventfd",
"eventfd2",
"execve",
"execveat",
"exit",
"exit_group",
"faccessat",
"fadvise64",
"fadvise64_64",
"fallocate",
"fanotify_mark",
"fchdir",
"fchmod",
"fchmodat",
"fchown",
"fchown32",
"fchownat",
"fcntl",
"fcntl64",
"fdatasync",
"fgetxattr",
"flistxattr",
"flock",
"fork",
"fremovexattr",
"fsetxattr",
"fstat",
"fstat64",
"fstatat64",
"fstatfs",
"fstatfs64",
"fsync",
"ftruncate",
"ftruncate64",
"futex",
"futimesat",
"getcpu",
"getcwd",
"getdents",
"getdents64",
"getegid",
"getegid32",
"geteuid",
"geteuid32",
"getgid",
"getgid32",
"getgroups",
"getgroups32",
"getitimer",
"getpeername",
"getpgid",
"getpgrp",
"getpid",
"getppid",
"getpriority",
"getrandom",
"getresgid",
"getresgid32",
"getresuid",
"getresuid32",
"getrlimit",
"get_robust_list",
"getrusage",
"getsid",
"getsockname",
"getsockopt",
"get_thread_area",
"gettid",
"gettimeofday",
"getuid",
"getuid32",
"getxattr",
"inotify_add_watch",
"inotify_init",
"inotify_init1",
"inotify_rm_watch",
"io_cancel",
"ioctl",
"io_destroy",
"io_getevents",
"io_pgetevents",
"ioprio_get",
"ioprio_set",
"io_setup",
"io_submit",
"io_uring_enter",
"io_uring_register",
"io_uring_setup",
"ipc",
"kill",
"lchown",
"lchown32",
"lgetxattr",
"link",
"linkat",
"listen",
"listxattr",
"llistxattr",
"_llseek",
"lremovexattr",
"lseek",
"lsetxattr",
"lstat",
"lstat64",
"madvise",
"memfd_create",
"mincore",
"mkdir",
"mkdirat",
"mknod",
"mknodat",
"mlock",
"mlock2",
"mlockall",
"mmap",
"mmap2",
"mprotect",
"mq_getsetattr",
"mq_notify",
"mq_open",
"mq_timedreceive",
"mq_timedsend",
"mq_unlink",
"mremap",
"msgctl",
"msgget",
"msgrcv",
"msgsnd",
"msync",
"munlock",
"munlockall",
"munmap",
"nanosleep",
"newfstatat",
"_newselect",
"open",
"openat",
"pause",
"pipe",
"pipe2",
"poll",
"ppoll",
"prctl",
"pread64",
"preadv",
"preadv2",
"prlimit64",
"pselect6",
"pwrite64",
"pwritev",
"pwritev2",
"read",
"readahead",
"readlink",
"readlinkat",
"readv",
"recv",
"recvfrom",
"recvmmsg",
"recvmsg",
"remap_file_pages",
"removexattr",
"rename",
"renameat",
"renameat2",
"restart_syscall",
"rmdir",
"rt_sigaction",
"rt_sigpending",
"rt_sigprocmask",
"rt_sigqueueinfo",
"rt_sigreturn",
"rt_sigsuspend",
"rt_sigtimedwait",
"rt_tgsigqueueinfo",
"sched_getaffinity",
"sched_getattr",
"sched_getparam",
"sched_get_priority_max",
"sched_get_priority_min",
"sched_getscheduler",
"sched_rr_get_interval",
"sched_setaffinity",
"sched_setattr",
"sched_setparam",
"sched_setscheduler",
"sched_yield",
"seccomp",
"select",
"semctl",
"semget",
"semop",
"semtimedop",
"send",
"sendfile",
"sendfile64",
"sendmmsg",
"sendmsg",
"sendto",
"setfsgid",
"setfsgid32",
"setfsuid",
"setfsuid32",
"setgid",
"setgid32",
"setgroups",
"setgroups32",
"setitimer",
"setpgid",
"setpriority",
"setregid",
"setregid32",
"setresgid",
"setresgid32",
"setresuid",
"setresuid32",
"setreuid",
"setreuid32",
"setrlimit",
"set_robust_list",
"setsid",
"setsockopt",
"set_thread_area",
"set_tid_address",
"setuid",
"setuid32",
"setxattr",
"shmat",
"shmctl",
"shmdt",
"shmget",
"shutdown",
"sigaltstack",
"signalfd",
"signalfd4",
"sigprocmask",
"sigreturn",
"socket",
"socketcall",
"socketpair",
"splice",
"stat",
"stat64",
"statfs",
"statfs64",
"statx",
"symlink",
"symlinkat",
"sync",
"sync_file_range",
"syncfs",
"sysinfo",
"tee",
"tgkill",
"time",
"timer_create",
"timer_delete",
"timerfd_create",
"timerfd_gettime",
"timerfd_settime",
"timer_getoverrun",
"timer_gettime",
"timer_settime",
"times",
"tkill",
"truncate",
"truncate64",
"ugetrlimit",
"umask",
"uname",
"unlink",
"unlinkat",
"utime",
"utimensat",
"utimes",
"vfork",
"vmsplice",
"wait4",
"waitid",
"waitpid",
"write",
"writev"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {},
"excludes": {}
},
{
"names": [
"ptrace"
],
"action": "SCMP_ACT_ALLOW",
"args": null,
"comment": "",
"includes": {
"minKernel": "4.8"
},
"excludes": {}
},
{
"names": [
"personality"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 0,
"valueTwo": 0,
"op": "SCMP_CMP_EQ"
}
],
"comment": "",
"includes": {},
"excludes": {}
},
{
"names": [
"personality"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 8,
"valueTwo": 0,
"op": "SCMP_CMP_EQ"
}
],
"comment": "",
"includes": {},
"excludes": {}
},
{
"names": [
"personality"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 131072,
"valueTwo": 0,
"op": "SCMP_CMP_EQ"
}
],
"comment": "",
"includes": {},
"excludes": {}
},
{
"names": [
"personality"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 131080,
"valueTwo": 0,
"op": "SCMP_CMP_EQ"
}
],
"comment": "",
"includes": {},
"excludes": {}
},
{
"names": [
"personality"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 4294967295,
"valueTwo": 0,
"op": "SCMP_CMP_EQ"
}
],
"comment": "",
"includes": {},
"excludes": {}
},
{
"names": [
"sync_file_range2"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"arches": [
"ppc64le"
]
},
"excludes": {}
},
{
"names": [
"arm_fadvise64_64",
"arm_sync_file_range",
"sync_file_range2",
"breakpoint",
"cacheflush",
"set_tls"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"arches": [
"arm",
"arm64"
]
},
"excludes": {}
},
{
"names": [
"arch_prctl"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"arches": [
"amd64",
"x32"
]
},
"excludes": {}
},
{
"names": [
"modify_ldt"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"arches": [
"amd64",
"x32",
"x86"
]
},
"excludes": {}
},
{
"names": [
"s390_pci_mmio_read",
"s390_pci_mmio_write",
"s390_runtime_instr"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"arches": [
"s390",
"s390x"
]
},
"excludes": {}
},
{
"names": [
"open_by_handle_at"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_DAC_READ_SEARCH"
]
},
"excludes": {}
},
{
"names": [
"bpf",
"clone",
"fanotify_init",
"lookup_dcookie",
"mount",
"name_to_handle_at",
"perf_event_open",
"quotactl",
"setdomainname",
"sethostname",
"setns",
"syslog",
"umount",
"umount2",
"unshare"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_ADMIN"
]
},
"excludes": {}
},
{
"names": [
"clone"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 0,
"value": 2114060288,
"valueTwo": 0,
"op": "SCMP_CMP_MASKED_EQ"
}
],
"comment": "",
"includes": {},
"excludes": {
"caps": [
"CAP_SYS_ADMIN"
],
"arches": [
"s390",
"s390x"
]
}
},
{
"names": [
"clone"
],
"action": "SCMP_ACT_ALLOW",
"args": [
{
"index": 1,
"value": 2114060288,
"valueTwo": 0,
"op": "SCMP_CMP_MASKED_EQ"
}
],
"comment": "s390 parameter ordering for clone is different",
"includes": {
"arches": [
"s390",
"s390x"
]
},
"excludes": {
"caps": [
"CAP_SYS_ADMIN"
]
}
},
{
"names": [
"reboot"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_BOOT"
]
},
"excludes": {}
},
{
"names": [
"chroot"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_CHROOT"
]
},
"excludes": {}
},
{
"names": [
"delete_module",
"init_module",
"finit_module",
"query_module"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_MODULE"
]
},
"excludes": {}
},
{
"names": [
"acct"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_PACCT"
]
},
"excludes": {}
},
{
"names": [
"kcmp",
"process_vm_readv",
"process_vm_writev",
"ptrace"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_PTRACE"
]
},
"excludes": {}
},
{
"names": [
"iopl",
"ioperm"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_RAWIO"
]
},
"excludes": {}
},
{
"names": [
"settimeofday",
"stime",
"clock_settime"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_TIME"
]
},
"excludes": {}
},
{
"names": [
"vhangup"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_TTY_CONFIG"
]
},
"excludes": {}
},
{
"names": [
"get_mempolicy",
"mbind",
"set_mempolicy"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYS_NICE"
]
},
"excludes": {}
},
{
"names": [
"syslog"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
"comment": "",
"includes": {
"caps": [
"CAP_SYSLOG"
]
},
"excludes": {}
}
]
}
which is apparently a valid json (checked via internet tools).
Thanks for helping !
manicole
on 26 Feb 2020
sorry, it's unclear, does that mean it's still not working or it works now?
haircommander
on 26 Feb 2020
also, what's the value of seccomp_profile in /etc/crio/crio.conf?
haircommander
on 26 Feb 2020
I investigated further thanks to your explanation.
It wasn't working at first, then I checked the seccomp_profile value in my Kubespray files, especially in _roles/container-engine/cri-o/templates/crio.conf.j2_ :
{% if ansible_os_family == "ClearLinux" or ansible_os_family == "RedHat" %}
seccomp_profile = "/usr/share/defaults/crio/seccomp.json"
{% else %}
seccomp_profile = "/etc/crio/seccomp.json"
{% endif %}
which led me to check _/usr/share/defaults/crio/seccomp.json_.
I realized the file was missing on one of my node. I created it and it seems to work now.
manicole
on 27 Feb 2020
by the way, we've deprecated the projectatomic ppa, and now are moving our packaging efforts to openSUSE's OBS Kubic repo:
https://build.opensuse.org/project/show/devel:kubic:libcontainers:stable
you may have more luck with that
No you won't, I used that repo to install cri-o-1.17 and still had to create the link on ubuntu 18.04
sudo ln -s /usr/lib/cri-o-runc/sbin/runc /usr/bin/runc
brunswyck
on 5 Mar 2020
@haircommander remind me, what's the right place to set runc path?
The crio.conf I install has:
[crio.runtime.runtimes.runc]
runtime_path = "/usr/lib/cri-o-runc/sbin/runc"
runtime_type = ""
lsm5
on 5 Mar 2020
by default, we read runc from $PATH now, so I'd recommend setting runtime_path to empty, and installing it there.
haircommander
on 5 Mar 2020
by default, we read runc from $PATH now, so I'd recommend setting runtime_path to empty, and installing it there.
Yes, I would also say let's install runc in /usr/sbin.
saschagrunert
on 5 Mar 2020
by default, we read runc from $PATH now, so I'd recommend setting runtime_path to empty, and installing it there.
Yes, I would also say let's install runc in
/usr/sbin.
the problem with that is it will then conflict with debian/ubuntu's own runc which people have complained about in the past. So, if the distro's runc is good enough (I've also heard of issues where it was too old), I can just get rid of the cri-o-runc package.
lsm5
on 5 Mar 2020
by default, we read runc from $PATH now, so I'd recommend setting runtime_path to empty, and installing it there.
Yes, I would also say let's install runc in
/usr/sbin.the problem with that is it will then conflict with debian/ubuntu's own runc which people have complained about in the past. So, if the distro's runc is good enough (I've also heard of issues where it was too old), I can just get rid of the cri-o-runc package.
what verification exists in the obs pipeline? I'm fine with it if some tests are run to verify that'll work. If that doesn't work, we can ship in /usr/lib/cri-o-runc/sbin/runc and then override the runtime_path to that.
haircommander
on 5 Mar 2020
what verification exists in the obs pipeline? I'm fine with it if some tests are run to verify that'll work. If that doesn't work, we can ship in
/usr/lib/cri-o-runc/sbin/runcand then override the runtime_path to that.
@haircommander Nothing so far. Maybe I can change the debian packaging rules to run tests. Could you suggest any good tests for this?
lsm5
on 5 Mar 2020
what verification exists in the obs pipeline? I'm fine with it if some tests are run to verify that'll work. If that doesn't work, we can ship in
/usr/lib/cri-o-runc/sbin/runcand then override the runtime_path to that.@haircommander Nothing so far. Maybe I can change the debian packaging rules to run tests. Could you suggest any good tests for this?
at the very least the integration tests (make integration) would hopefully catch any egregious regressions. Ideally we'd run the whole e2e, but that's a lot of set up.
haircommander
on 5 Mar 2020
what verification exists in the obs pipeline? I'm fine with it if some tests are run to verify that'll work. If that doesn't work, we can ship in
/usr/lib/cri-o-runc/sbin/runcand then override the runtime_path to that.@haircommander Nothing so far. Maybe I can change the debian packaging rules to run tests. Could you suggest any good tests for this?
at the very least the integration tests (
make integration) would hopefully catch any egregious regressions. Ideally we'd run the whole e2e, but that's a lot of set up.
cool, i'll try this later today and report back.
lsm5
on 5 Mar 2020
I figured I'd just use distro's runc as the default dep and have cri-o-runc as the second choice. I'll add tests later when I have fewer distractions. But hope this is good enough for now.
Changes are in the testing repo for now. https://build.opensuse.org/package/show/devel:kubic:libcontainers:testing/cri-o-1.17 . If this looks ok, I'll change the stable repo too. PTAL.
lsm5
on 7 Mar 2020
Any update on this? Still seeing this behavior with 1.17.3~2.
marshallford
on 24 Apr 2020
Any update on this? Still seeing this behavior with
1.17.3~2.
@marshallford is it possible you could give the package in the testing repo a try?
lsm5
on 24 Apr 2020
I guess I'll update the one in stable with the changes in testing since nobody else seems to have complained since I posted the link.
lsm5
on 24 Apr 2020
I figured I'd just use distro's runc as the default dep and have cri-o-runc as the second choice. I'll
add tests later when I have fewer distractions. But hope this is good enough for now.Changes are in the testing repo for now.
https://build.opensuse.org/package/show/devel:kubic:libcontainers:testing/cri-o-1.17 . If this looks
ok, I'll change the stable repo too. PTAL.
Hey @lsm5,
Just tested from the repo you pointed and still see the issue. Maybe something I am missing? Let's work together to solve this one for 1.17-4. :)
dougsland
on 26 Apr 2020
It looks that runc is installed in find / -name runc on Ubuntu 19.10:
/usr/bin/runc
_version: 1.0.1-dev_
_crio version 1.16.6_
(arch: armv7l)
b23prodtm
on 23 May 2020
It looks that runc is installed in find / -name runc on Ubuntu 19.10:
/usr/bin/runc_version: 1.0.1-dev_
_crio version 1.16.6_
(arch: armv7l)
@b23prodtm thanks for the reply. Yes, recently we have updated the repos. Everything should be working out-of-the-box.
@outcoldman Please consider re-testing and closing this report.
Thanks!
dougsland
on 24 May 2020
Related issues
mrunalp
·
4Comments
runcom
·
9Comments
feiskyer
·
5Comments
baichinger
·
6Comments
afbjorklund
·
8Comments
Most helpful comment
To link the binary, use
ln:The
-smake the link, a symbolic link.From the binary
/usr/sbin/runcAnd create a link at
/usr/bin/runc