Description
Similarly as in #41457, process fails to start with docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "/run/user/1002/docker.sock" to rootfs at "/home/app_docker/.local/share/docker/fuse-overlayfs/24a81be0bbbae07387f84498c51623a2faf39c5b5b1b5c4222c478fb9899337e/merged/var/run/docker.sock" caused: operation not permitted: unknown. on rootless docker.
Steps to reproduce the issue:
- rootless docker
docker run --rm -v /run/user/1002/docker.sock:/var/run/docker.sock:ro hello-world
Describe the results you received:
docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting contain er process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "/run/user/1002/docker.sock" to rootfs at "/home/app_docker/.local/share/docker/fuse-overlayfs/24a81be0bbbae07387f84498c51623a2faf39c5b5b1b5c4222c478fb9899337e/merged/var/run/docker.sock" caused: operation not permitted: unknown.
Describe the results you expected:
Should not fail
Additional information you deem important (e.g. issue happens only occasionally):
I found this issue when trying to run Docker Bench for Security as
docker run \
--rm \
--net host \
--pid host \
--userns host \
--cap-add audit_control \
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
-v /home/lowly_user/bin/containerd:/usr/bin/containerd:ro \
-v /home/lowly_user/bin/runc:/usr/bin/runc:ro \
-v /usr/lib/systemd:/usr/lib/systemd:ro \
-v /var/lib:/var/lib:ro \
-v /run/user/1002/docker.sock:/var/run/docker.sock:ro \
--label docker_bench_security \
docker/docker-bench-security
and after triming down some pieces I found this (new?) error. Maybe it is duplicate of linked #41457, but I cannot tell.
Output of docker version:
Client: Docker Engine - Community
Version: 20.10.1
API version: 1.41
Go version: go1.13.15
Git commit: 831ebea
Built: Tue Dec 15 04:28:35 2020
OS/Arch: linux/amd64
Context: default
Experimental: true
Server: Docker Engine - Community
Engine:
Version: 20.10.1
API version: 1.41 (minimum version 1.12)
Go version: go1.13.15
Git commit: f001486
Built: Tue Dec 15 04:32:28 2020
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v1.4.3
GitCommit: 269548fa27e0089a8b8278fc4fc781d7f65a939b
runc:
Version: 1.0.0-rc92
GitCommit: ff819c7e9184c13b7c2607fe6c30ae19403a7aff
docker-init:
Version: 0.19.0
GitCommit: de40ad0
Output of docker info:
Client:
Context: default
Debug Mode: false
Server:
Containers: 1
Running: 0
Paused: 0
Stopped: 1
Images: 4
Server Version: 20.10.1
Storage Driver: fuse-overlayfs
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
Default Runtime: runc
Init Binary: docker-init
containerd version: 269548fa27e0089a8b8278fc4fc781d7f65a939b
runc version: ff819c7e9184c13b7c2607fe6c30ae19403a7aff
init version: de40ad0
Security Options:
seccomp
Profile: default
rootless
cgroupns
Kernel Version: 4.18.0-193.19.1.el8_2.x86_64
Operating System: CentOS Linux 8 (Core)
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 7.626GiB
Name: <redacted>
ID: ZBAT:LVV3:5XV7:RRP3:B2EW:X2BN:BLJE:5AZL:LECA:WBZJ:GALX:B6CH
Docker Root Dir: /home/lowly_user/.local/share/docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine
WARNING: No kernel memory TCP limit support
WARNING: No oom kill disable support
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: Support for cgroup v2 is experimental
WARNING: No blkio weight support
WARNING: No blkio weight_device support
WARNING: No blkio throttle.read_bps_device support
WARNING: No blkio throttle.write_bps_device support
WARNING: No blkio throttle.read_iops_device support
WARNING: No blkio throttle.write_iops_device support
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
Additional environment details (AWS, VirtualBox, physical, etc.):
None I am aware of and of importance.
Description
Similarly as in #41457, process fails to start with
docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "/run/user/1002/docker.sock" to rootfs at "/home/app_docker/.local/share/docker/fuse-overlayfs/24a81be0bbbae07387f84498c51623a2faf39c5b5b1b5c4222c478fb9899337e/merged/var/run/docker.sock" caused: operation not permitted: unknown.on rootless docker.Steps to reproduce the issue:
docker run --rm -v /run/user/1002/docker.sock:/var/run/docker.sock:ro hello-worldDescribe the results you received:
docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting contain er process caused: process_linux.go:459: container init caused: rootfs_linux.go:59: mounting "/run/user/1002/docker.sock" to rootfs at "/home/app_docker/.local/share/docker/fuse-overlayfs/24a81be0bbbae07387f84498c51623a2faf39c5b5b1b5c4222c478fb9899337e/merged/var/run/docker.sock" caused: operation not permitted: unknown.Describe the results you expected:
Should not fail
Additional information you deem important (e.g. issue happens only occasionally):
I found this issue when trying to run Docker Bench for Security as
and after triming down some pieces I found this (new?) error. Maybe it is duplicate of linked #41457, but I cannot tell.
Output of
docker version:Output of
docker info:Additional environment details (AWS, VirtualBox, physical, etc.):
None I am aware of and of importance.