Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 737998 - >=sys-libs/libseccomp-2.4.3: is blocking functionality in docker containers on armv7
Summary: >=sys-libs/libseccomp-2.4.3: is blocking functionality in docker containers o...
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: ARM Linux
: Normal normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: glibc-2.31
  Show dependency tree
 
Reported: 2020-08-19 10:33 UTC by Stefan Langenmaier
Modified: 2020-11-27 12:59 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (file_737998.txt,4.77 KB, text/plain)
2020-08-19 10:33 UTC, Stefan Langenmaier
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Langenmaier 2020-08-19 10:33:29 UTC
Created attachment 655470 [details]
emerge --info

I noticed issues with some of my containers since upgrading libseccomp (I have tested 2.4.3 and 2.5.0).

Originally it failed for my while installing glibc and I found this issue:

https://github.com/moby/moby/issues/40734

The error shows up in different ways.

When I try to start a mariadb service I get the following response and it's using 100% CPU

# /etc/init.d/mysql restart
 * No permission to apply cgroup settings
 * Starting mysql ...
 * start-stop-daemon: nanosleep: Operation not permitted       

When I try to start a Java app in the container it also uses 100% CPU and I saw the following message:

OpenJDK Client VM warning: No monotonic clock was available

When I start a Python app I saw the following message:

Fatal Python error: _Py_InitializeMainInterpreter: can't initialize time
PermissionError: [Errno 1] Operation not permitted


In case I start the container with the "--privileged" or the "--security-opt seccomp=unconfined" option, the  applications/container are working without and issue.
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2020-11-19 09:43:33 UTC
Does this still happen with libseccomp-2.4.4 and/or libseccomp-2.5.1?
Comment 2 Stefan Langenmaier 2020-11-19 12:00:21 UTC
Thanks for following up. I can no longer reproduce the problem since I have update to the latest docker version (app-emulation/docker-19.03.13-r2).

I'm still using sys-libs/libseccomp-2.4.3.
Comment 3 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2020-11-27 12:59:30 UTC
Marking this bug as obsolete because it's an issue with docker which seems to be fixed meanwhile.