Error: OCI runtime error: container_linux.go:380: starting container process caused: error adding seccomp filter rule for syscall bdflush: requested action matches default action of filter

[liaobaikai]

[root@localhost home]# cat /etc/redhat-release
CentOS Linux release 7.6.1810 (Core)
[root@localhost home]# podman -v
podman version 3.0.1
[root@localhost home]# docker run -dit --name zk_01 --network master-network --ip 172.20.0.11 zookeeper
Error: OCI runtime error: container_linux.go:380: starting container process caused: error adding seccomp filter rule for syscall bdflush: requested action matches default action of filter

[liaobaikai]

[root@liaobaikai ~]# cat /etc/redhat-release
CentOS Linux release 7.8.2003 (Core)
[root@liaobaikai ~]# podman -v
podman version 3.0.1
[root@liaobaikai ~]# docker run -dit --name zk_03 --network master-network --ip 172.20.0.13 zookeeper
bd622a72e3650c3434cdad235b1f308df4de37da5729674b8bc82379923b227d

[cdoern]

You are using docker not podman as the container_linux error you are getting is a common docker error. Try restarting docker daemon or even better, use podman :-)

[mheon]

That could easily have been Podman with the Docker alias added - that error is out of runc, not Docker itself, so it can easily happen with Podman. Usually points to a too old runc or libseccomp.

…

On Fri, Jul 23, 2021 at 12:16 Charlie Doern ***@***.***> wrote: Closed #11029 <#11029>. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11029 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3AOCEW4MAH5DD54YZGUV3TZGIULANCNFSM5A4HQ3AQ> .

[cdoern]

@mheon I thought -dit was docker only, I will reopen sorry.

[cdoern]

still, container_linux in podman also doesnt have a line 80, so I think this is docker

[mheon]

It’s pointing to a line in the runc codebase, which AFAIK changed heavily recently for the 1.0 release - a refactor to split the code into subpackages. That sounds like a reasonable line number given that. Speaking of runc versions, I suspect upgrading to the most recent will resolve this.

…

On Fri, Jul 23, 2021 at 15:23 Charlie Doern ***@***.***> wrote: still, container_linux also doesnt have a line 80, so I think this is docker — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11029 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3AOCANJUWSSO6WGP5VPI3TZG6SZANCNFSM5A4HQ3AQ> .

[kolyshkin]

Speaking of runc versions, I suspect upgrading to the most recent will resolve this.

It won't. The fix is in opencontainers/runc#3109, but originally that comes from the fact that podman started to generate redundant seccomp rules recently. I have explained why that happens and what is the fix in #11005

[kolyshkin]

I think we can fix it in podman, too.

First, we need containers/common#689 (and cut a v0.38.17 release).
One a release is made, we need to bump containers/common to v0.38.17 in podman v3.2 branch.

#11005 (comment)

[mheon]

OK, this sounds like it needs to be a priority backport. Thanks!

…

On Fri, Jul 23, 2021 at 19:27 Kir Kolyshkin ***@***.***> wrote: I think we can fix it in podman, too. First, we need containers/common#689 <containers/common#689> (and cut a v0.38.17 release). One a release is made, we need to bump containers/common to v0.38.17 in podman v3.2 branch. #11005 (comment) <#11005 (comment)> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#11029 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB3AOCFKDMSA3GB5O275T3TTZH3GFANCNFSM5A4HQ3AQ> .

[liaobaikai]

[root@localhost ~]# /usr/bin/docker -v
podman version 3.0.1
[root@localhost ~]# rpm -qa | grep podman
podman-3.0.1-2.el7.3.1.x86_64
podman-plugins-3.0.1-2.el7.3.1.x86_64
podman-docker-3.0.1-2.el7.3.1.noarch
[root@localhost ~]# rpm -e podman-docker-3.0.1-2.el7.3.1.noarch
[root@localhost ~]# podman run -dit --name zk_01 --network master-network --ip 172.20.0.11 zookeeper
Error: OCI runtime error: container_linux.go:380: starting container process caused: error adding seccomp filter rule for syscall bdflush: requested action matches default action of filter
[root@localhost ~]# runc -v
runc version 1.0.1
commit: ae184aa
spec: 1.0.2-dev
go: go1.15.5
libseccomp: 2.3.1
[root@localhost ~]# podman -v
podman version 3.0.1
[root@localhost ~]#
[root@localhost ~]# podman -v
podman version 3.0.1
[root@localhost ~]# podman info
host:
arch: amd64
buildahVersion: 1.19.4
cgroupManager: systemd
cgroupVersion: v1
conmon:
package: conmon-2.0.29-1.el7.3.1.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.0.29, commit: '
cpus: 6
distribution:
distribution: '"centos"'
version: "7"
eventLogger: journald
hostname: localhost.localdomain
idMappings:
gidmap: null
uidmap: null
kernel: 3.10.0-957.el7.x86_64
linkmode: dynamic
memFree: 370847744
memTotal: 16656515072
ociRuntime:
name: runc
package: runc-1.0.1-0.el7.1.1.x86_64
path: /usr/bin/runc
version: |-
runc version 1.0.1
commit: ae184aa
spec: 1.0.2-dev
go: go1.15.5
libseccomp: 2.3.1
os: linux
remoteSocket:
path: /run/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: false
seccompEnabled: true
selinuxEnabled: false
slirp4netns:
executable: ""
package: ""
version: ""
swapFree: 4153360384
swapTotal: 4160745472
uptime: 18h 10m 35.79s (Approximately 0.75 days)
registries:
search:

• registry.fedoraproject.org
• registry.access.redhat.com
• docker.io
  store:
  configFile: /etc/containers/storage.conf
  containerStore:
  number: 7
  paused: 0
  running: 6
  stopped: 1
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/var/lib/containers/storage
  graphStatus:
  Backing Filesystem: xfs
  Native Overlay Diff: "true"
  Supports d_type: "true"
  Using metacopy: "false"
  imageStore:
  number: 23
  runRoot: /home/var/run/containers/storage
  volumePath: /home/var/lib/containers/storage/volumes
  version:
  APIVersion: 3.0.0
  Built: 1614609040
  BuiltTime: Mon Mar 1 22:30:40 2021
  GitCommit: ""
  GoVersion: go1.15.5
  OsArch: linux/amd64
  Version: 3.0.1

So... This version is relatively new.

Upgrade:
sudo curl -L -o /etc/yum.repos.d/devel:kubic:libcontainers:stable.repo https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/CentOS_7/devel:kubic:libcontainers:stable.repo
sudo yum -y install podman

[kolyshkin]

Opened #11031 to summarize my understanding of the issue.