mqueue msg_max in rootless container
Hallo! I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error: Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied and container is not created. My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container? Best regards, -- \ / | | (OvO) | Михаил Иванов | (^^^) | | \^/ | E-mail: ivans@isle.spb.ru | ^ ^ | |
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256? $ cat /proc/sys/fs/mqueue/msg_max 10
On 5/20/21 14:09, Michael Ivanov wrote:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10
Ok I just recreated it, I think the issue is that we create a new procfs within the container, But it looks like this should be namespaced. Works in rootfull mode, but not in rootless. # podman run --sysctl 'fs.mqueue.msg_max=256' fedora cat /proc/sys/fs/mqueue/msg_max 256 # exit podman (kube) $ podman run --sysctl 'fs.mqueue.msg_max=256' fedora cat /proc/sys/fs/mqueue/msg_max 256 Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied bash: 256: command not found... If this is blocked by the kernel, it might be a kernel bug. Since theoretically this is a namespaced object and should be modifiable within the container at least up to the size the user is able to use. Giuseppe what do you think?
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
-- \ / | | (OvO) | Михаил Иванов | (^^^) | | \^/ | E-mail:ivans@isle.spb.ru | ^ ^ | |
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
/proc/sys/fs/mqueue/msg_max is IPC namespaced but it is always owned by root in the initial user namespace. A rootless container doesn't have enough privileges to write to it. You can verify it with: $ podman run --rm fedora stat /proc/sys/fs/mqueue/msg_max File: /proc/sys/fs/mqueue/msg_max Size: 0 Blocks: 0 IO Block: 1024 regular empty file Device: 7bh/123d Inode: 3634162 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody) So given the current limitation in the kernel, you have two possible choices to workaround it: 1) run with --ipc host 2) get some help from root in the host: $ sudo nsenter -i -t $CONTAINER_PID sh -c 'echo $NEW_MSG_MAX > /proc/sys/fs/mqueue/msg_max' Giuseppe Michael Ivanov <ivans@isle.spb.ru> writes:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10 _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Hi Michael, Michael Ivanov <ivans@isle.spb.ru> writes:
Yes!!!
--ipc host did it thanks a lot! Option with nsenter looks more preferrable to me, but as I understand I need first to start the container up, then run nsenter at host to change the mqueue settings and then somehow signal the container tht it can proceed with actual application. Is it possible to run nsenter during image build with buildah - I guess not?
yes, that is a runtime setting that should be applied once the container is already running. You cannot set it at build time. Regards, Giuseppe
Best regards and thanks again!
On 20.05.2021 23:10, Giuseppe Scrivano wrote:
/proc/sys/fs/mqueue/msg_max is IPC namespaced but it is always owned by root in the initial user namespace. A rootless container doesn't have enough privileges to write to it.
You can verify it with:
$ podman run --rm fedora stat /proc/sys/fs/mqueue/msg_max File: /proc/sys/fs/mqueue/msg_max Size: 0 Blocks: 0 IO Block: 1024 regular empty file Device: 7bh/123d Inode: 3634162 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody)
So given the current limitation in the kernel, you have two possible choices to workaround it:
1) run with --ipc host 2) get some help from root in the host:
$ sudo nsenter -i -t $CONTAINER_PID sh -c 'echo $NEW_MSG_MAX > /proc/sys/fs/mqueue/msg_max'
Giuseppe
Michael Ivanov <ivans@isle.spb.ru> writes:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10 _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Yes!!!
--ipc host did it thanks a lot! Option with nsenter looks more preferrable to me, but as I understand I need first to start the container up, then run nsenter at host to change the mqueue settings and then somehow signal the container tht it can proceed with actual application. Is it possible to run nsenter during image build with buildah - I guess not?
Best regards and thanks again! I have opened an internal discussion on this with the User Namespace
On 5/20/21 16:39, Michael Ivanov wrote: maintainer of the kernel. We will see if anything comes of it.
On 20.05.2021 23:10, Giuseppe Scrivano wrote:
/proc/sys/fs/mqueue/msg_max is IPC namespaced but it is always owned by root in the initial user namespace. A rootless container doesn't have enough privileges to write to it.
You can verify it with:
$ podman run --rm fedora stat /proc/sys/fs/mqueue/msg_max File: /proc/sys/fs/mqueue/msg_max Size: 0 Blocks: 0 IO Block: 1024 regular empty file Device: 7bh/123d Inode: 3634162 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody)
So given the current limitation in the kernel, you have two possible choices to workaround it:
1) run with --ipc host 2) get some help from root in the host:
$ sudo nsenter -i -t $CONTAINER_PID sh -c 'echo $NEW_MSG_MAX > /proc/sys/fs/mqueue/msg_max'
Giuseppe
Michael Ivanov<ivans@isle.spb.ru> writes:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10 _______________________________________________ Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
-- \ / | | (OvO) | Михаил Иванов | (^^^) | Тел.: +7(911) 223-1300 | \^/ | E-mail:ivans@isle.spb.ru | ^ ^ | |
Hallo Daniel, sorry, did anything change about this problem in these two years? Or --ipc host is still the only option? :-( Best regards, On 21.05.2021 16:11, Daniel Walsh wrote:
Yes!!!
--ipc host did it thanks a lot! Option with nsenter looks more preferrable to me, but as I understand I need first to start the container up, then run nsenter at host to change the mqueue settings and then somehow signal the container tht it can proceed with actual application. Is it possible to run nsenter during image build with buildah - I guess not?
Best regards and thanks again! I have opened an internal discussion on this with the User Namespace
On 5/20/21 16:39, Michael Ivanov wrote: maintainer of the kernel. We will see if anything comes of it.
On 20.05.2021 23:10, Giuseppe Scrivano wrote:
/proc/sys/fs/mqueue/msg_max is IPC namespaced but it is always owned by root in the initial user namespace. A rootless container doesn't have enough privileges to write to it.
You can verify it with:
$ podman run --rm fedora stat /proc/sys/fs/mqueue/msg_max File: /proc/sys/fs/mqueue/msg_max Size: 0 Blocks: 0 IO Block: 1024 regular empty file Device: 7bh/123d Inode: 3634162 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody)
So given the current limitation in the kernel, you have two possible choices to workaround it:
1) run with --ipc host 2) get some help from root in the host:
$ sudo nsenter -i -t $CONTAINER_PID sh -c 'echo $NEW_MSG_MAX > /proc/sys/fs/mqueue/msg_max'
Giuseppe
Michael Ivanov<ivans@isle.spb.ru> writes:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10 _______________________________________________ Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
-- \ / | | (OvO) | Михаил Иванов | (^^^) | Тел.: +7(911) 223-1300 | \^/ | E-mail:ivans@isle.spb.ru | ^ ^ | |
Nothing has changed that I know of. Giuseppe any ideas? On 11/25/23 10:55, Михаил Иванов wrote:
Hallo Daniel, sorry, did anything change about this problem in these two years? Or --ipc host is still the only option? :-( Best regards, On 21.05.2021 16:11, Daniel Walsh wrote:
Yes!!!
--ipc host did it thanks a lot! Option with nsenter looks more preferrable to me, but as I understand I need first to start the container up, then run nsenter at host to change the mqueue settings and then somehow signal the container tht it can proceed with actual application. Is it possible to run nsenter during image build with buildah - I guess not?
Best regards and thanks again! I have opened an internal discussion on this with the User Namespace
On 5/20/21 16:39, Michael Ivanov wrote: maintainer of the kernel. We will see if anything comes of it.
On 20.05.2021 23:10, Giuseppe Scrivano wrote:
/proc/sys/fs/mqueue/msg_max is IPC namespaced but it is always owned by root in the initial user namespace. A rootless container doesn't have enough privileges to write to it.
You can verify it with:
$ podman run --rm fedora stat /proc/sys/fs/mqueue/msg_max File: /proc/sys/fs/mqueue/msg_max Size: 0 Blocks: 0 IO Block: 1024 regular empty file Device: 7bh/123d Inode: 3634162 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody)
So given the current limitation in the kernel, you have two possible choices to workaround it:
1) run with --ipc host 2) get some help from root in the host:
$ sudo nsenter -i -t $CONTAINER_PID sh -c 'echo $NEW_MSG_MAX > /proc/sys/fs/mqueue/msg_max'
Giuseppe
Michael Ivanov<ivans@isle.spb.ru> writes:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10 _______________________________________________ Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
-- \ / | | (OvO) | Михаил Иванов | (^^^) | Тел.: +7(911) 223-1300 | \^/ | E-mail:ivans@isle.spb.ru | ^ ^ | |
nothing has changed that I know of, I've tried with the 6.7.0-0 kernel and I get the same behavior. Daniel Walsh <dwalsh@redhat.com> writes:
Nothing has changed that I know of. Giuseppe any ideas?
On 11/25/23 10:55, Михаил Иванов wrote:
Hallo Daniel, sorry, did anything change about this problem in these two years? Or --ipc host is still the only option? :-( Best regards, On 21.05.2021 16:11, Daniel Walsh wrote:
On 5/20/21 16:39, Michael Ivanov wrote:
Yes!!!
--ipc host did it thanks a lot! Option with nsenter looks more preferrable to me, but as I understand I need first to start the container up, then run nsenter at host to change the mqueue settings and then somehow signal the container tht it can proceed with actual application. Is it possible to run nsenter during image build with buildah - I guess not?
Best regards and thanks again!
I have opened an internal discussion on this with the User Namespace maintainer of the kernel. We will see if anything comes of it.
On 20.05.2021 23:10, Giuseppe Scrivano wrote:
/proc/sys/fs/mqueue/msg_max is IPC namespaced but it is always owned by root in the initial user namespace. A rootless container doesn't have enough privileges to write to it.
You can verify it with:
$ podman run --rm fedora stat /proc/sys/fs/mqueue/msg_max File: /proc/sys/fs/mqueue/msg_max Size: 0 Blocks: 0 IO Block: 1024 regular empty file Device: 7bh/123d Inode: 3634162 Links: 1 Access: (0644/-rw-r--r--) Uid: (65534/ nobody) Gid: (65534/ nobody)
So given the current limitation in the kernel, you have two possible choices to workaround it:
1) run with --ipc host 2) get some help from root in the host:
$ sudo nsenter -i -t $CONTAINER_PID sh -c 'echo $NEW_MSG_MAX > /proc/sys/fs/mqueue/msg_max'
Giuseppe
Michael Ivanov<ivans@isle.spb.ru> writes:
Yes it is 256:
island:backend [master]> cat /proc/sys/fs/mqueue/msg_max 256
On 20.05.2021 21:00, Daniel Walsh wrote:
On 5/20/21 08:29, Michael Ivanov wrote:
Hallo!
I'm trying to run my application in podman rootless container and I stumble on following problem: my program needs /proc/sys/fs/mqueue/msg_max to be at least 256, but in running container this value is just 10. When I try to specify this parameter while running the image (--sysctl 'fs.mqueue.msg_max=256') I get the following error:
Error: open /proc/sys/fs/mqueue/msg_max: Permission denied: OCI permission denied
and container is not created.
My host where container is being run has this parameter set to 256. How can I expose current host setting for msg_max to my container?
Best regards,
When you login to your user account is is et to 256?
$ cat /proc/sys/fs/mqueue/msg_max 10 _______________________________________________ Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
_______________________________________________ Podman mailing list --podman@lists.podman.io To unsubscribe send an email topodman-leave@lists.podman.io
-- \ / | | (OvO) | Михаил Иванов | (^^^) | Тел.: +7(911) 223-1300 | \^/ | E-mail:ivans@isle.spb.ru | ^ ^ | |
participants (4)
-
Daniel Walsh -
Giuseppe Scrivano -
Michael Ivanov -
Михаил Иванов