podman can not run a container with a symlinked /etc dir #12189
Comments
|
Can you provide more details on the container you're running (ideally a command that reproduces)? Podman should not be dealing with |
|
hey, thank you for your response, i am not sure what is needed from your side, but just try to run: the error message is coming from the sourcecode i referred to. |
|
This is happening just because /etc->/system/etc. So easy to setup. This most likely is an error happening in crun. @giuseppe WDYT? |
|
This issue, seems to be the hard links I think if you change the /etc->/system/etc to /etc->../system/etc, it would fix the problem. |
|
@nalind Do we have anything to does a choot.Symlink? |
|
Not directly, but since the link is already there in this case, As an aside, the image includes SELinux labels (i.e., "security.selinux" xattrs) for many of its contents, which I didn't think was recommended. |
|
i tried to workaround by creating a symlink in /system/etc/mtab to /proc/mount, as an extra step from the original container, but that didnt help, mkdir /etc is still tried and container start aborts. I am happy to have a workaround, for a container having /etc a symlink, but so far, i did not find a combination that worksaround /etc as a symlink |
|
Again, are we sure this is actually Podman? We should not be doing anything with |
|
The phrase "error creating mtab directory" suggests it's roughly around here. |
|
That's only within the container's filesystem - I see no evidence this is related to |
|
Ahhh, nevermind, it's symlinked inside the container. |
|
Yes the issue is inside of the container we have etc->/system/etc. This is why we should be doing this within a chroot. Would work. |
|
I think moby performs unlink before creating @wuxxin Could you please try following diff on latest main. I am not able to use image diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index fbc2c1f38..0f2fac476 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -39,6 +39,7 @@ import (
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
+ "golang.org/x/sys/unix"
)
const (
@@ -1597,6 +1598,10 @@ func (c *Container) mountStorage() (_ string, deferredErr error) {
// If /etc/mtab does not exist in container image, then we need to
// create it, so that mount command within the container will work.
+
+ //try unlink any previous symlinks if they are present
+ unix.Unlink(filepath.Join(mountPoint, "/etc/mtab"))
+
mtab := filepath.Join(mountPoint, "/etc/mtab")
if err := idtools.MkdirAllAs(filepath.Dir(mtab), 0755, c.RootUID(), c.RootGID()); err != nil {
return "", errors.Wrap(err, "error creating mtab directory") |
I'd play safe here and handle the error. If the |
another solution would be to use |
|
@flouthoc happy to help, but i used podman from the ppa, i did not build it myself so far, (to attach the diff), but i can try in the next days, but its not a quick thing i can do. |
|
@giuseppe Does RHEL8 has saveSymlink? Also I don't see how the unlink does anything. What would happen if etc->/etc inside of the container, does this image cause us to override the hosts /etc/mtab? |
openat2 is available on RHEL8.
|
|
Care to open a PR to fix this? |
|
I tried following diff for running this container. Container runs successfully but diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index fbc2c1f38..0f2fac476 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -39,6 +39,7 @@ import (
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
+ "golang.org/x/sys/unix"
)
const (
@@ -1597,6 +1598,10 @@ func (c *Container) mountStorage() (_ string, deferredErr error) {
// If /etc/mtab does not exist in container image, then we need to
// create it, so that mount command within the container will work.
+
+ //try unlink any previous symlinks if they are present
+ unix.Unlink(filepath.Join(mountPoint, "/etc/mtab"))
+ unix.Unlink(filepath.Join(mountPoint, "/etc"))
+
mtab := filepath.Join(mountPoint, "/etc/mtab")
if err := idtools.MkdirAllAs(filepath.Dir(mtab), 0755, c.RootUID(), c.RootGID()); err != nil {
return "", errors.Wrap(err, "error creating mtab directory") |
|
I can see on redroid github issues similar crash reports for other platforms as well. But really hard to identify quickly now if its crashing because podman or because of my host configuration since its leaving no logs behind. I get almost 0 logs. |
this doesn't seem correct. Why a container image cannot have a symlink for |
|
@giuseppe After unlinking |
|
I'll open a PR to fix this issue |
|
PR: #12267 After the PR still requires that the target for the |
make sure the /etc/mtab symlink is created inside the rootfs when /etc is a symlink. Closes: containers#12189 [NO NEW TESTS NEEDED] there is already a test case Signed-off-by: Giuseppe Scrivano <[email protected]>
make sure the /etc/mtab symlink is created inside the rootfs when /etc is a symlink. Closes: containers#12189 [NO NEW TESTS NEEDED] there is already a test case Signed-off-by: Giuseppe Scrivano <[email protected]>
github-actions
bot
added
the
locked - please file new issue/PR
/kind bug
Description
while trying out https://github.com/remote-android/redroid-doc (a GPU accelerated AIC (Android In Container) solution) running on podman (rootful), podman throws an error:
A look inside the container revealed that redroid uses symlinks for:
and some android related symlinks in the root directory including the symlink of /etc to /system/etc.
while tracing the error message to the corresponding source code i found that it looks like this error message was introduced since #10270 which fixed #10263 .
the corresponding code creates the directory of /etc/mtab but somehow fails if /etc exists and is a symlink.
it is still in the current main branch (which includes the original modification and also the later added pull request #10765) , see: https://github.com/containers/podman/blob/main/libpod/container_internal.go#L1583
Steps to reproduce the issue:
Describe the results you received:
podman[3459841]: Error: error creating mtab directory: mkdir /var/lib/containter....
Describe the results you expected:
podman starts the container
Additional information you deem important (e.g. issue happens only occasionally):
this was probably working before #10270 introduced creation of /etc inside the container.
Output of
podman version:Output of
podman info --debug:Package info (e.g. output of
rpm -q podmanorapt list podman):Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/master/troubleshooting.md)
No (as the github states 3.4.1 as latest and the ppa is only at 3.3.1)
The text was updated successfully, but these errors were encountered: