centos:6 image segfaults on newer Linux kernels with Spectre V1 mitigation

[terminalmage]

Running a docker run --rm -it centos:6 bash fails with exit status 139 (i.e. bash exits with SIGSEGV) on Linux kernel 4.15.9. Downgrading to 4.14.15 (which is vulnerable to Spectre V1) gets rid of the segfault.

This has been tried both with the latest image pulled from the docker hub, and I also built from the most recent update here on GitHub (https://github.com/CentOS/sig-cloud-instance-images/blob/d2bb3d66e4f4330480f534ed4940e7c89210cfe6/docker/Dockerfile) and that image also fails.

The docker host is Arch Linux running Docker 18.02.0.

[zrhoffman]

Verified in Arch Linux using kernel 4.15.8-1 and Docker 18.02.0. Downgrading to 4.14.15-1 makes docker run --rm -it centos:6.9 bash run as expected.

[mwestphal]

FYI, on 4.15.12-1-ARCH, I have the same behavior except that it exit silently without any error. Downgrading does fix the problem.

[terminalmage]

So it seems that we just need the image to be updated with one that doesn't segfault on newer kernels. @jperrin was the last to update these images, looping him in here.

[sgowie]

While this issue can be circumvented by defining vsyscall=emulate in the bootloader's kernel options, this is unlikely to be the default for all distributions. As more systems adopt the patched kernels, images depending on the existing CentOS 6 line of images will likely fail.

Is it even possible to rebuild the c6-docker.tar.xz blob with binaries and/or libraries that don't require this change? If not, it may be prudent to either provide some guidance on the hub.docker.com, or to remove reference to the incompatible images.

[jperrin]

The images are built from the latest sources available for c6. I don't test them on anything other than CentOS and Fedora hosts. If it's failing on Arch, and you'd like to contribute Arch specific documentation to the docker docs repo CentOS page, I'm happy to ack it there.

[terminalmage]

I would be happy to write docs, but I have no idea what the "docker docs repo CentOS page" is. Can you point me in the right direction?

[sgowie]

@jperrin I think Arch is a red herring here. The kernel changes have been seen in Alpine (moby/moby#28705), and they're slated to drop in Debian 10 (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=874034). I'd look at this as a canary situation instead. A debian test install produces the same results:

sgowie@debian-test-latest:~$ sudo docker run -it centos:centos6.7
Unable to find image 'centos:centos6.7' locally
centos6.7: Pulling from library/centos
cbddbc0189a0: Pull complete 
Digest: sha256:7248c96de4648749c7936f203d983530e7ebdd83c3db6d47278392f18bcd7baf
Status: Downloaded newer image for centos:centos6.7
sgowie@debian-test-latest:~$ echo $?
139
sgowie@debian-test-latest:~$ uname -a
Linux debian-test-latest 4.15.0-3-amd64 #1 SMP Debian 4.15.17-1 (2018-04-19) x86_64 GNU/Linux
sgowie@debian-test-latest:~$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux buster/sid"
NAME="Debian GNU/Linux"
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
sgowie@debian-test-latest:~$ 

[agimenez]

+1 Now fails on Debian testing as well. Is there any way to actually fix this instead of adding a note to the docs to use a less secure configuration?

[albertvaka]

This is a duplicate of #62

[timotheemoulin]

I was having the same issue because of the new Debian 10 kernel.
To solve this, you must enable vsyscall

Edit the file /etc/default/grub
On the line GRUB_CMDLINE_LINUX_DEFAULT="quiet" add the option vsyscall=emulate at the end. The like should now look like GRUB_CMDLINE_LINUX_DEFAULT="quiet vsyscall=emulate"

Then regenerate the grub file sudo update-grub and reboot your computer.

[terminalmage]

Yes, this was commented last May as well.

[mwestphal]

I somehow missed it. Thanks @timotheemoulin @terminalmage and @sgowie for the work around.

[terminalmage]

The CentOS 6 image has not been updated in several years (and with EL6 being end-of-life) I doubt it will ever get an update. Closing.