-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ansible + podman not working #4813
Comments
I have also opened a bug for the ansible devs |
@daniel-wtd I think it should have been fixed in d40b450 |
@daniel-wtd please paste your "ansible --version" |
Thanks for having a look. Below you can find my ansible version
|
@daniel-wtd thanks, also the same. Do you have a possibility to try it on a fresh system? I'll try to do the same today on f31 |
yep, will do this today in the evening (CET) and report back to you. |
I have tested it a on 2 fresh installations minute ago:
and got the same result. |
minor addition: on the same host running the exact same stuff as root is working perfectly fine. |
OK, I reproduced it on the fresh fedora31 system: fedora@localhost ~]$ podman run -d --rm --name instance fedora:31 sleep 1h
9f894952cb740f2d7aae0ccb5e4e688dfe256f04835693acbbf86e103c3bc716
[fedora@localhost ~]$ podman cp /home/fedora/myfile instance:/root/
Error: cannot copy into running rootless container with pause set - pass --pause=false to force copying
[fedora@localhost ~]$ podman cp --pause=false /home/fedora/myfile instance:/root/
[fedora@localhost ~]$ podman version
Version: 1.6.2
RemoteAPI Version: 1
Go Version: go1.13.1
OS/Arch: linux/amd64 @mheon @rhatdan any ideas why it works on fedora30 with d40b450 but doesn't work on fedora31? With same podman version 1.6.2 |
CGroups v2, maybe? Pause requires CGroups which for rootless containers are
only available on v2.
…On Thu, Jan 9, 2020, 07:07 Sergey ***@***.***> wrote:
OK, I reproduced it on the fresh fedora31 system:
***@***.*** ~]$ podman run -d --rm --name instance fedora:31 sleep 1h
9f894952cb740f2d7aae0ccb5e4e688dfe256f04835693acbbf86e103c3bc716
***@***.*** ~]$ podman cp /home/fedora/myfile instance:/root/
Error: cannot copy into running rootless container with pause set - pass --pause=false to force copying
***@***.*** ~]$ podman cp --pause=false /home/fedora/myfile instance:/root/
***@***.*** ~]$ podman version
Version: 1.6.2
RemoteAPI Version: 1
Go Version: go1.13.1
OS/Arch: linux/amd64
@mheon <https://github.com/mheon> @rhatdan <https://github.com/rhatdan>
any ideas why it works on fedora30 with d40b450
<d40b450>
but doesn't work on fedora31? With same podman version 1.6.2
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#4813>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AB3AOCED23EI3FZ2FMKAAULQ44HQ5ANCNFSM4KEEZUHQ>
.
|
@mheon yeah, seems like it's cgroups. It works fine with cgroups v1, but doesn't work with v2. Still not sure why it ignores default setting from d40b450
|
Might be a good idea. |
@giuseppe We expect pause to work rootless on v2, correct? |
yes, pause should work on cgroup v2 as rootless as well |
As I see in code |
It sounds like we expect pause to work for CGroups v2, so the fact that it's not is probably a bug |
@mheon so should we stop to require |
If pause can be performed in rootless depends whether we are using cgroups v2, the systemd manager and the freezer controller is available (it wasn't on older kernels for cgroup v2). The last condition can fail for root as well. I think we should just drop the check and let the OCI runtime complain if pause cannot be performed. |
rootless containers can use pause on cgroups v2. Whether it is possible or not to use pause depends from multiple conditions, such as: - be on a cgroup v2 unified hierarchy, - using systemd cgroup manager, - the kernel has the freezer controller, The last one may fail for root as well. Instead of trying to catch all the possible conditions in Podman, let the OCI runtime complain if pause cannot be performed. Closes: containers#4813 Signed-off-by: Giuseppe Scrivano <[email protected]>
PR here: #4828 |
@giuseppe thanks! Will it be ported to 1.6.2 or later? Because if I change ansible plugin to use "--pause false" now, it might be broken for later podman? Or I miss something? |
Probably not. Anything not long term should move rapidly to 1.7.0, while
long term releases are on a critical security or bugfix basis.
…On Mon, Jan 13, 2020, 04:05 Giuseppe Scrivano ***@***.***> wrote:
@giuseppe <https://github.com/giuseppe> thanks! Will it be ported to
1.6.2 or later? Because if I change ansible plugin to use "--pause false"
now, it might be broken for later podman? Or I miss something?
I don't think this will be back ported as it is not a security problem.
@mheon <https://github.com/mheon> or we could backport it?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#4813>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AB3AOCG2CTNFD5XFY5FL2YLQ5QVGFANCNFSM4KEEZUHQ>
.
|
Yes no back porting, unless absolutely necessary. |
I merged the fix for this in Ansible (ansible/ansible#66583) and opened a backport to |
with 1.8.0 on fedora, everything is working fine :) |
Awesome. |
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
I am using ansible to interact with podman via ansible podman connector. when using a rootless container, I am not able to execute any command via ansible and will get some errors. The command that should be executed is a simple
cat /etc/hostname
This may not be 100% related to podman, but maybe to the ansible code (podman connector), since
podman cp
works in general.Errors:
Steps to reproduce the issue:
instance = name of the container
inventory file = a plain file with the word
instance
in itDescribe the results you received:
Describe the results you expected:
either a working execution or some hints, how to manipulate the "pause" behaviour.
Output of
podman version
:Output of
podman info --debug
:Package info (e.g. output of
rpm -q podman
orapt list podman
):The text was updated successfully, but these errors were encountered: