Allow containers access to io_uring syscalls #16796
Description
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
When running mariadb:latest container from docker.io image registry, it can not access io_uring syscalls.
Steps to reproduce the issue:
-
Download and launch the
mariadb:latestcontainer fromdocker.ioimage registry and launch it. -
When you check the container's logs, you'll notice that it can not access
io_uringsyscalls.
Describe the results you received:
$ podman logs mariadb
...
[Warning] mysqld: io_uring_queue_init() failed with ENOSYS: check seccomp filters, and the kernel version (newer than 5.1 required)
[Warning] InnoDB: liburing disabled: falling back to innodb_use_native_aio=OFF
...
Describe the results you expected:
Allow the container access to io_uring syscalls.
Is it possible? I have already tried to search for such information however with no luck.
Additional information you deem important (e.g. issue happens only occasionally):
The issue happens every time the container is launched.
Output of podman version:
Client: Podman Engine
Version: 4.3.1
API Version: 4.3.1
Go Version: go1.19.3
Git Commit: 814b7b003cc630bf6ab188274706c383f9fb9915-dirty
Built: Mon Nov 21 00:25:21 2022
OS/Arch: linux/arm64
Output of podman info:
host:
arch: arm64
buildahVersion: 1.28.0
cgroupControllers:
- cpu
- memory
- pids
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: /usr/bin/conmon is owned by conmon 1:2.1.5-1
path: /usr/bin/conmon
version: 'conmon version 2.1.5, commit: c9f7f19eb82d5b8151fc3ba7fbbccf03fdcd0325'
cpuUtilization:
idlePercent: 91.33
systemPercent: 5.61
userPercent: 3.06
cpus: 4
distribution:
distribution: archarm
version: unknown
eventLogger: journald
hostname: <hostname>
idMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
kernel: 5.19.8-1-aarch64-ARCH
linkmode: dynamic
logDriver: journald
memFree: 144015360
memTotal: 8175919104
networkBackend: cni
ociRuntime:
name: crun
package: /usr/bin/crun is owned by crun 1.7.2-1
path: /usr/bin/crun
version: |-
crun version 1.7.2
commit: 0356bf4aff9a133d655dc13b1d9ac9424706cac4
rundir: /run/user/1000/crun
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
os: linux
remoteSocket:
exists: true
path: /run/user/1000/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /etc/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: /usr/bin/slirp4netns is owned by slirp4netns 1.2.0-1
version: |-
slirp4netns version 1.2.0
commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
libslirp: 4.7.0
SLIRP_CONFIG_VERSION_MAX: 4
libseccomp: 2.5.4
swapFree: 0
swapTotal: 0
uptime: <uptime>
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
- journald
network:
- bridge
- macvlan
- ipvlan
volume:
- local
registries:
search:
- docker.io
store:
configFile: <path>/storage.conf
containerStore:
number: 2
paused: 0
running: 2
stopped: 0
graphDriverName: overlay
graphOptions: {}
graphRoot: <path>
graphRootAllocated: 4000785104896
graphRootUsed: 2821472010240
graphStatus:
Backing Filesystem: btrfs
Native Overlay Diff: "true"
Supports d_type: "true"
Using metacopy: "false"
imageCopyTmpDir: <path>
imageStore:
number: 38
runRoot: /run/user/1000/containers
volumePath: <path>/volumes
version:
APIVersion: 4.3.1
Built: 1668986721
BuiltTime: Mon Nov 21 00:25:21 2022
GitCommit: 814b7b003cc630bf6ab188274706c383f9fb9915-dirty
GoVersion: go1.19.3
Os: linux
OsArch: linux/arm64
Version: 4.3.1
Package info (e.g. output of rpm -q podman or apt list podman or brew info podman):
podman 4.3.1.2
Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide?
Yes
Additional environment details (AWS, VirtualBox, physical, etc.):
Arch Linux ARM 64 bit installed on bare metal.
$ uname -a
Linux <hostname> 5.19.8-1-aarch64-ARCH #1 SMP PREEMPT Thu Sep 8 18:20:33 MDT 2022 aarch64 GNU/Linux