Repository navigation
Conversation
When running in a user namespace, DetectUID uses
`busctl --user status` to get the OwnerUID. This fails when /proc
is mounted with hidepid=2, as busctl can't read /proc/<pid> of the
bus peer. In such case runc (which uses DetectUID to decide whether
to use rootless cgroup manager) assumes the UID is 0, and so it fails
to start a container under RootlessKit with systemd cgroup driver:
unable to start unit "runc-xxx.scope" (properties [... {Name:Slice Value:"system.slice"} ...]): ... read unix @->/run/systemd/private: read: connection reset by peer
RootlessKit sets $ROOTLESSKIT_PARENT_EUID (documented since
RootlessKit v0.8.0) for its child process, so use it if set.
Fixes opencontainers/runc#3124.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When running in a user namespace,
DetectUIDusesbusctl --user statusto get the OwnerUID. This fails when/procis mounted withhidepid=2, as busctl can't read/proc/<pid>of the bus peer. In such case runc (which usesDetectUIDto decide whether to use rootless cgroup manager) assumes the UID is 0, and so it fails to start a container under RootlessKit with systemd cgroup driver:RootlessKit sets
$ROOTLESSKIT_PARENT_EUID(documented since RootlessKit v0.8.0) for its child process, so use it if set.Tested manually on CentOS Stream 10 VM (
rootlesskit runc --systemd-cgroup runas a regular user, with/procremounted withhidepid=2): fails without this change, works with it.Fixes opencontainers/runc#3124.