Skip to content

Revert "Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE#42011

Merged
thaJeztah merged 1 commit into
moby:masterfrom
thaJeztah:remove_capabilities_hack
Aug 4, 2021
Merged

Revert "Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE#42011
thaJeztah merged 1 commit into
moby:masterfrom
thaJeztah:remove_capabilities_hack

Conversation

@thaJeztah

@thaJeztah thaJeztah commented Feb 11, 2021 •
edited
Loading

Copy link
Copy Markdown
Member

fixes #42601

Revert "Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE"

Now that runc v1.0.0-rc93 is used, we can revert this temporary workaround

This reverts commit a38b96b (#41563).

relates to:

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

@thaJeztah thaJeztah added this to the 21.xx milestone Feb 11, 2021
@thaJeztah thaJeztah mentioned this pull request Feb 11, 2021
Merged
AkihiroSuda
AkihiroSuda reviewed Feb 12, 2021
View reviewed changes
Comment thread oci/caps/utils.go Outdated

@AkihiroSuda AkihiroSuda Feb 12, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will break dind (Docker 21 in Docker 20.10). I still think containerd/containerd#5017 is the right approach.

@AkihiroSuda AkihiroSuda Jul 19, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(Might be fine for runc >= rc94, though, as runc >= rc94 does not raise error on unknown caps opencontainers/runc#2854)

@thaJeztah
thaJeztah force-pushed the remove_capabilities_hack branch from 480f9f0 to 9f28ade Compare June 21, 2021 13:03
@thaJeztah thaJeztah mentioned this pull request Jul 7, 2021
Closed
@AkihiroSuda

AkihiroSuda commented Jul 19, 2021

Copy link
Copy Markdown
Member

What's current status?

@thaJeztah
thaJeztah force-pushed the remove_capabilities_hack branch from 9f28ade to f55ef5f Compare July 19, 2021 08:21
@thaJeztah

thaJeztah commented Jul 19, 2021

Copy link
Copy Markdown
Member Author

What's current status?

I rebased to trigger CI again. I think this one should be fine now that we're on runc > rc94, correct?

@thaJeztah

thaJeztah commented Jul 19, 2021

Copy link
Copy Markdown
Member Author

Failure is unrelated; TestCreateParallel tracked through #42582


[2021-07-19T08:35:11.641Z] === Failed
[2021-07-19T08:35:11.641Z] === FAIL: libnetwork/drivers/bridge TestCreateParallel (0.73s)
[2021-07-19T08:35:11.641Z] time="2021-07-19T08:32:14Z" level=warning msg="bridge store not initialized. kv object docker/network/v1.0/bridge/net87/ is not added to the store"
[2021-07-19T08:35:11.641Z] time="2021-07-19T08:32:15Z" level=warning msg="bridge store not initialized. kv object docker/network/v1.0/bridge/net51/ is not added to the store"
[2021-07-19T08:35:11.641Z]     bridge_test.go:1133: Success should be 1 instead: 2

@thaJeztah
thaJeztah force-pushed the remove_capabilities_hack branch from f55ef5f to db8282e Compare July 20, 2021 13:14
@thaJeztah

thaJeztah commented Jul 20, 2021

Copy link
Copy Markdown
Member Author

hmpf

RPC failed; curl 56 GnuTLS recv error (-54): Error in the pull function.
fatal: the remote end hung up unexpectedly
fatal: early EOF
``

@thaJeztah
thaJeztah force-pushed the remove_capabilities_hack branch 2 times, most recently from 8ae145e to 0c87d92 Compare July 29, 2021 12:30
@thaJeztah

thaJeztah commented Jul 29, 2021

Copy link
Copy Markdown
Member Author

@AkihiroSuda @cpuguy83 PTAL

cpuguy83
cpuguy83 approved these changes Jul 29, 2021
View reviewed changes

@cpuguy83 cpuguy83 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@thaJeztah

thaJeztah commented Jul 29, 2021

Copy link
Copy Markdown
Member Author

Failure is unrelated, but looks like that one is flaky as well

 === FAIL: libnetwork/networkdb TestNetworkDBNodeJoinLeaveIteration (5.81s)
[2021-07-29T18:12:43.071Z]     networkdb_test.go:511: Network existence verification failed
[2021-07-29T18:12:43.071Z]     networkdb_test.go:513: The networkNodes list has to have be 2 instead of 1 - [8518394491d6]

@thaJeztah

thaJeztah commented Jul 29, 2021

Copy link
Copy Markdown
Member Author

Opened #42698 to track that one

@thaJeztah
thaJeztah requested a review from AkihiroSuda July 29, 2021 22:54
@thaJeztah
Revert "Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_…
c1c973e 
…RESTORE"

Now that runc v1.0.0-rc93 is used, we can revert this temporary workaround

This reverts commit a38b96b.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
thaJeztah force-pushed the remove_capabilities_hack branch from 0c87d92 to c1c973e Compare August 3, 2021 14:12
@thaJeztah
thaJeztah merged commit e6a3313 into moby:master Aug 4, 2021
@thaJeztah
thaJeztah deleted the remove_capabilities_hack branch August 4, 2021 09:15
@josedonizetti josedonizetti mentioned this pull request Aug 15, 2021
Closed
@tallossos tallossos mentioned this pull request Oct 25, 2021
Closed
@thaJeztah thaJeztah mentioned this pull request Mar 14, 2022
Open
@thaJeztah thaJeztah mentioned this pull request Jul 4, 2022
Closed
@mqasimsarfraz mqasimsarfraz mentioned this pull request Sep 13, 2022
Closed
@mqasimsarfraz

mqasimsarfraz commented Sep 13, 2022

Copy link
Copy Markdown

Hi, Is there a plan to back port this to stable release? The use case for this has been explained here.

@mqasimsarfraz

mqasimsarfraz commented Sep 15, 2022

Copy link
Copy Markdown

@thaJeztah @cpuguy83 any thoughts on above?

@ymanton

ymanton commented Oct 26, 2022

Copy link
Copy Markdown

CRIU has merged patches to use CAP_CHECKPOINT_RESTORE in checkpoint-restore/criu#1930. This allows us to build images containing checkpointed processes that can be restored in containers with far fewer privileges and capabilities. The benefits here are much faster startup and reduced time to first response.

Podman and others support it, so it would really be nice to have Docker support in stable releases finally.

@sam-thibault sam-thibault mentioned this pull request Jan 13, 2023
Open
@tjwatson tjwatson mentioned this pull request Jun 1, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cpuguy83 cpuguy83 cpuguy83 approved these changes
@AkihiroSuda AkihiroSuda Awaiting requested review from AkihiroSuda
+1 more reviewer
@justincormack justincormack justincormack approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

area/runtime Runtime impact/changelog status/4-merge

Projects

None yet

Milestone

23.0.0

Development

Successfully merging this pull request may close these issues.

Unable to create containers with CAP_PERFMON/CAP_BPF/CAP_CHECKPOINT_RESTORE

6 participants

@thaJeztah @AkihiroSuda @mqasimsarfraz @ymanton @justincormack @cpuguy83