Sysbox v0.7.0 fails on Ubuntu 24.04 with kernel 6.x and containerd v2

[chauhan-naveen]

I installed Sysbox v0.7.0 on Ubuntu 24.04 EKS worker nodes . The installation completes successfully, but any pod configured to use the sysbox-runc RuntimeClass fails to start.

Pods using the default runtime start successfully. The issue only occurs when using the Sysbox runtime.

Below is the error message

Failed to create pod sandbox: rpc error: code = Unknown desc = failed to start sandbox "e73c470a8c46b14c3c4ec6335d5e75dcbb5b1972f84ea458d06426db705c658a": failed to create containerd task: failed to create shim task: OCI runtime create failed: container_linux.go:439: starting container process caused: process_linux.go:608: container init caused: rootfs_linux.go:76: setting up rootfs mounts caused: rootfs_linux.go:1276: mounting "sysfs" to rootfs "/run/containerd/io.containerd.runtime.v2.task/k8s.io/e73c470a8c46b14c3c4ec6335d5e75dcbb5b1972f84ea458d06426db705c658a/rootfs" at "sys" caused: mount through procfd: operation not permitted

Failed to create pod sandbox: rpc error: code = Unknown desc = failed to start sandbox "774d244c8fe34bf7ef7f6e63cccc1026db2c8f581892ffbf14106c8e3d8e0e42": failed to create containerd task: failed to create shim task: OCI runtime create failed: container_linux.go:439: starting container process caused: process_linux.go:608: container init caused: rootfs_linux.go:76: setting up rootfs mounts caused: rootfs_linux.go:1276: mounting "sysfs" to rootfs "/run/containerd/io.containerd.runtime.v2.task/k8s.io/774d244c8fe34bf7ef7f6e63cccc1026db2c8f581892ffbf14106c8e3d8e0e42/rootfs" at "sys" caused: mount through procfd: operation not permitted

Sysbox version: v0.7.0-0
OS: Ubuntu 24.04
EKS Version: 1.35
Containerd version: v2 2.2.1
Kernel version: 6.17.0-1019-aws
AppArmor is enabled: kernel.apparmor_restrict_unprivileged_userns = 1

The issue is reproducible for every pod using the sysbox-runc RuntimeClass. Please let me know if any additional logs or diagnostics would help with troubleshooting.

[giesberge]

See #997

Either build yor version of the docker container or create a patching daemon. I'm testing now but 0.7.1 should fix this

[chauhan-naveen]

after installing Sysbox v0.7.1 (using ghcr.io/nestybox/sysbox-deploy-k8s:v0.7.1-0_amd64 image on EKS Ubuntu 24.04 nodes), the original error is gone for mount through procfd: operation not permitted

However, pods still fail to start with a new error:
OCI runtime create failed: container_linux.go:439: starting container process caused: process_linux.go:608: container init caused: write sysctl key net.ipv4.ip_unprivileged_port_start: write /proc/sys/net/ipv4/ip_unprivileged_port_start: permission denied