Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE#41563
Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE#41563tiborvass merged 1 commit intomoby:masterfrom
Conversation
thaJeztah
added
area/runtime
|
FWIW, our CI didn't catch this problem because the current ubuntu LTS version are on kernel < 5.8, therefore docker doesn't set these capabilities when using I wonder if a long-term solution would be to;
|
|
CI will likely fail until #41560 is merged |
This prevents docker from setting CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE capabilities on privileged (or CAP_ALL) containers on Kernel 5.8 and up. While these kernels support these capabilities, the current release of runc ships with an older version of /gocapability/capability, and does not know about them, causing an error to be produced. We can remove this restriction once opencontainers/runc@6dfbe9b is included in a runc release and once we stop supporting containerd 1.3.x (which ships with runc v1.0.0-rc92). Thanks to Anca Iordache for reporting. Signed-off-by: Sebastiaan van Stijn <[email protected]>
thaJeztah
force-pushed
the
hold_that_cap
branch
from
548d60d to
a38b96b
Compare
|
Rebased to get the fix from #41560 in |
|
This is unfortunate. |
|
Yes, it is; not sure what a better solution is for now (besides hoping on a new runc release soon, and that to be included in containerd 1.3.x) What do you think of my idea for an |
|
opened docker/docker-ce-packaging#506, so that for v20.10, we only have to consider containerd v1.4.x to be updated to a newer runc version |
4 participants
fixes #41562
This prevents docker from setting
CAP_PERFMON,CAP_BPF, andCAP_CHECKPOINT_RESTOREcapabilities on
--privileged(orCAP_ALL) containers on Kernel 5.8 and up.While these kernels support these capabilities, the current release of runc ships with an older version of gocapability/capability, and does not know about them, causing an error to be produced.
We can remove this restriction once opencontainers/runc@6dfbe9b is included in a runc release and once we stop supporting containerd 1.3.x (which ships with runc v1.0.0-rc92).
Thanks to @aiordache for reporting.
- Description for the changelog
- A picture of a cute animal (not mandatory but encouraged)