[go: nahoru, domu]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

runsc --platform=systrap fails with "panic: seccomp failed: invalid argument" #10633

Closed
q53 opened this issue Jul 8, 2024 · 3 comments · Fixed by #10653
Closed

runsc --platform=systrap fails with "panic: seccomp failed: invalid argument" #10633

q53 opened this issue Jul 8, 2024 · 3 comments · Fixed by #10653
Assignees
@avagin
Labels
area: platform Issue related to platforms (kvm, ptrace) platform: kvm Issue related to the kvm platform type: bug Something isn't working

Comments

@q53
Copy link
q53 commented Jul 8, 2024 •
edited

Description

# cat /etc/docker/daemon.json
{
    "runtimes": {
        "runsc": {
            "path": "/usr/local/bin/runsc",
            "runtimeArgs": [
                "--platform=systrap"
            ]
        },
        "runsc-ptrace": {
            "path": "/usr/local/bin/runsc",
            "runtimeArgs": [
                "--platform=ptrace"
            ]
        },

        "runsc-kvm": {
            "path": "/usr/local/bin/runsc",
            "runtimeArgs": [
                "--platform=kvm"
            ]
        },

        "runsc-debug": {
            "path": "/usr/local/bin/runsc",
            "runtimeArgs": [
                "--platform=systrap",
                "--debug",
                "--debug-log=/tmp/runsc-debug.log"
            ]
        }
    }
}

# runsc --version
runsc version release-20240624.0
spec: 1.1.0-rc.1

## uname -r
4.18.0-425.10.1.el8_7.x86_64

# cat /etc/redhat-release 
AlmaLinux release 8.8 (Sapphire Caracal)

# docker -D -l debug run -i --runtime runsc  --rm --name=test docker.io/library/registry:latest 
DEBU[0000] [hijack] End of stdout

At least release-20240305.0 is not affected.
Works without issues on Rocky Linux release 9.4 5.14.0-427.13.1.el9_4.x86_64.

Steps to reproduce

docker -D -l debug run -i --runtime runsc --rm --name=test docker.io/library/registry:latest

runsc version

release-20240624.0

docker version (if using docker)

Client: Docker Engine - Community
 Version:    26.1.3
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.11.2
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.21.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose
  scan: Docker Scan (Docker Inc.)
    Version:  v0.23.0
    Path:     /usr/libexec/docker/cli-plugins/docker-scan

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 1
 Server Version: 26.1.3
 Storage Driver: overlay2
  Backing Filesystem: xfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc runsc runsc-debug runsc-kvm runsc-ptrace
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc version: v1.1.9-0-gccaecfc
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
 Kernel Version: 4.18.0-425.10.1.el8_7.x86_64
 Operating System: AlmaLinux 8.8 (Sapphire Caracal)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 17.34GiB
 Name: localhost
 ID: 83a369a6-cf0a-4b50-acac-9d12021b3b66
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Username: dockerq53
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

uname

4.18.0-425.10.1.el8_7.x86_64 #1 SMP Thu Jan 12 10:05:00 EST 2023

kubectl (if using Kubernetes)

No response

repo state (if built from source)

No response

runsc debug logs (if available)

runsc-debug.log
@q53 q53 added the type: bug Something isn't working label Jul 8, 2024
@q53 q53 mentioned this issue Jul 9, 2024
Closed
@EtiennePerot
Copy link
Contributor

It looks like it's failing in installSeccompNotify, which uses SECCOMP_IOCTL_NOTIF_* in seccomp rules. I think this was introduced in 32bbb18 and depends on a kernel feature that was introduced in Linux 5.0.

@avagin, should this either have fallback code for older kernels, or should Systrap explicitly drop support for old kernels? (Linux 5.0 is more than a half-decade old.)

@avagin avagin self-assigned this Jul 11, 2024
@avagin avagin added the platform: kvm Issue related to the kvm platform label Jul 11, 2024
copybara-service bot pushed a commit that referenced this issue Jul 11, 2024
@avagin @gvisor-bot
systrap: don't fail if seccomp_unotify isn't supported
03e1b70 
Fixes #10633

PiperOrigin-RevId: 651552693
@copybara-service copybara-service bot mentioned this issue Jul 11, 2024
Merged
@avagin avagin added the area: platform Issue related to platforms (kvm, ptrace) label Jul 12, 2024
copybara-service bot pushed a commit that referenced this issue Jul 16, 2024
@avagin @gvisor-bot
systrap: don't fail if seccomp_unotify isn't supported
f9957aa 
Fixes #10633

PiperOrigin-RevId: 651552693
copybara-service bot pushed a commit that referenced this issue Jul 16, 2024
@avagin @gvisor-bot
systrap: don't fail if seccomp_unotify isn't supported
9f2f7c5 
Fixes #10633

PiperOrigin-RevId: 651552693
@avagin
Copy link
Collaborator
avagin commented Jul 16, 2024

@q53 The fix has been commited. Could you verify that it works in your environment?

@q53
Copy link
Author
q53 commented Jul 16, 2024

@avagin Looks like it works.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@avagin avagin

Labels
area: platform Issue related to platforms (kvm, ptrace) platform: kvm Issue related to the kvm platform type: bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

systrap: don't fail if seccomp_unotify isn't supported google/gvisor
3 participants
@avagin @EtiennePerot @q53