clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1)
Hi, I've just build an image with buildah, this image seems to work as expected as I can start the application inside the build container. But as soon as I try to run this image with "podman run", I get an "Operation not permitted" error about clock_gettime(CLOCK_MONOTONIC, _). This is the command used to run the image with buildah: $ buildah run $(buildah from ejabberd:armv7-21.01) \ /usr/local/sbin/ejabberdctl foreground < ... the application starts without error> And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64. $ buildah --version buildah version 1.19.2 (image-spec 1.0.1-dev, runtime-spec 1.0.2-dev) $ podman --version podman version 2.1.1 I've already build and run a couple of images on this architecture, and never seen this error before. Any idea what I'm doing wrong? Thanks. -- Laurent Meunier <laurent@deltalima.net>
On 1/29/21 11:40, Laurent Meunier wrote:
Hi,
I've just build an image with buildah, this image seems to work as expected as I can start the application inside the build container. But as soon as I try to run this image with "podman run", I get an "Operation not permitted" error about clock_gettime(CLOCK_MONOTONIC, _).
This is the command used to run the image with buildah: $ buildah run $(buildah from ejabberd:armv7-21.01) \ /usr/local/sbin/ejabberdctl foreground < ... the application starts without error>
And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted
I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64.
$ buildah --version buildah version 1.19.2 (image-spec 1.0.1-dev, runtime-spec 1.0.2-dev)
$ podman --version podman version 2.1.1
I've already build and run a couple of images on this architecture, and never seen this error before. Any idea what I'm doing wrong?
Thanks.
Check seccomp or SELinux. Look into /var/log/audit/audit.log to see if there are any messages about them in there.
On 30/01/2021 14:00, Daniel Walsh wrote:
On 1/29/21 11:40, Laurent Meunier wrote:
And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted
I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64.
Check seccomp or SELinux.
Look into /var/log/audit/audit.log to see if there are any messages about them in there.
Hi Daniel, Thanks for your reply, but SELinux is not installed on my rpi3 and the audit.log file is not present. I think this error is related to the musl upgrade to 1.2 coming with Alpine 3.13 (see: https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.13.0#musl_1.2). With Alpine 3.12 as my base image, I can't reproduce the error and the application starts fine. I'll stay with Alpine 3.12 in the meantime. That being said, I still don't understand why buildah is working fine with Alpine 3.13 but podman not. Best regards. -- Laurent Meunier <laurent@deltalima.net>
On 2/1/21 03:48, Laurent Meunier wrote:
On 30/01/2021 14:00, Daniel Walsh wrote:
On 1/29/21 11:40, Laurent Meunier wrote:
And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted
I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64.
Check seccomp or SELinux.
Look into /var/log/audit/audit.log to see if there are any messages about them in there.
Hi Daniel,
Thanks for your reply, but SELinux is not installed on my rpi3 and the audit.log file is not present.
I think this error is related to the musl upgrade to 1.2 coming with Alpine 3.13 (see: https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.13.0#musl_1.2). With Alpine 3.12 as my base image, I can't reproduce the error and the application starts fine. I'll stay with Alpine 3.12 in the meantime.
That being said, I still don't understand why buildah is working fine with Alpine 3.13 but podman not.
Best regards.
Try running podman with `--security-opt seccomp=unconfined`. This will tell you whether this is a seccomp issue or not. Not sure if Buildah is loading seccomp policy.
On 01/02/2021 20:45, Daniel Walsh wrote:
On 2/1/21 03:48, Laurent Meunier wrote:
On 30/01/2021 14:00, Daniel Walsh wrote:
On 1/29/21 11:40, Laurent Meunier wrote:
And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted
I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64.
Check seccomp or SELinux.
Look into /var/log/audit/audit.log to see if there are any messages about them in there.
Hi Daniel,
Thanks for your reply, but SELinux is not installed on my rpi3 and the audit.log file is not present.
I think this error is related to the musl upgrade to 1.2 coming with Alpine 3.13 (see: https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.13.0#musl_1.2).
With Alpine 3.12 as my base image, I can't reproduce the error and the application starts fine. I'll stay with Alpine 3.12 in the meantime.
That being said, I still don't understand why buildah is working fine with Alpine 3.13 but podman not.
Best regards.
Try running podman with `--security-opt seccomp=unconfined`. This will tell you whether this is a seccomp issue or not. Not sure if Buildah is loading seccomp policy.
I confirm that running podman with `--security-opt seccomp=unconfined` fix my issue. The container starts without errors and the application works as expected with Alpine 3.13
On 2/2/21 01:52, Laurent Meunier wrote:
On 01/02/2021 20:45, Daniel Walsh wrote:
On 2/1/21 03:48, Laurent Meunier wrote:
On 30/01/2021 14:00, Daniel Walsh wrote:
On 1/29/21 11:40, Laurent Meunier wrote:
And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted
I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64.
Check seccomp or SELinux.
Look into /var/log/audit/audit.log to see if there are any messages about them in there.
Hi Daniel,
Thanks for your reply, but SELinux is not installed on my rpi3 and the audit.log file is not present.
I think this error is related to the musl upgrade to 1.2 coming with Alpine 3.13 (see: https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.13.0#musl_1.2).
With Alpine 3.12 as my base image, I can't reproduce the error and the application starts fine. I'll stay with Alpine 3.12 in the meantime.
That being said, I still don't understand why buildah is working fine with Alpine 3.13 but podman not.
Best regards.
Try running podman with `--security-opt seccomp=unconfined`. This will tell you whether this is a seccomp issue or not. Not sure if Buildah is loading seccomp policy.
I confirm that running podman with `--security-opt seccomp=unconfined` fix my issue. The container starts without errors and the application works as expected with Alpine 3.13 _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
So the question is should CLOCK_MONOTONIC be allowed by default, what does this syscall allow?
On 2/2/21 01:52, Laurent Meunier wrote:
On 01/02/2021 20:45, Daniel Walsh wrote:
On 2/1/21 03:48, Laurent Meunier wrote:
On 30/01/2021 14:00, Daniel Walsh wrote:
On 1/29/21 11:40, Laurent Meunier wrote:
And the command to run the same image with podman: $ podman run -it --rm --entrypoint /usr/local/sbin/ejabberdctl \ ejabberd:armv7-21.01 foreground clock_gettime(CLOCK_MONOTONIC, _) failed: Operation not permitted (1) Aborted
I think this is related to the host architecture (armv7 / raspberry pi 3 / raspbian) as I can't reproduce it on amd64.
Check seccomp or SELinux.
Look into /var/log/audit/audit.log to see if there are any messages about them in there.
Hi Daniel,
Thanks for your reply, but SELinux is not installed on my rpi3 and the audit.log file is not present.
I think this error is related to the musl upgrade to 1.2 coming with Alpine 3.13 (see: https://wiki.alpinelinux.org/wiki/Release_Notes_for_Alpine_3.13.0#musl_1.2).
With Alpine 3.12 as my base image, I can't reproduce the error and the application starts fine. I'll stay with Alpine 3.12 in the meantime.
That being said, I still don't understand why buildah is working fine with Alpine 3.13 but podman not.
Best regards.
Try running podman with `--security-opt seccomp=unconfined`. This will tell you whether this is a seccomp issue or not. Not sure if Buildah is loading seccomp policy.
I confirm that running podman with `--security-opt seccomp=unconfined` fix my issue. The container starts without errors and the application works as expected with Alpine 3.13 _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Do you see anything in the journal or messages about seccomp denials?
participants (2)
-
Daniel Walsh -
Laurent Meunier