[Bug 1533833] Re: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller
strangely enough, adding the aa_allow_incomplete option doesn't seem to make a difference; container startup keeps failing at the same point. In any case, it does seem to initialize the container correctly, and I seem to hit a different issue. The entire cgroup thing seems to work now, at least: lxc-start 1455916829.396 INFO lxc_start - start.c:lxc_init:474 - 'aansluitform-deploy' is initialized lxc-start 1455916829.396 DEBUGlxc_start - start.c:__lxc_start:1186 - Not dropping cap_sys_boot or watching utmp lxc-start 1455916829.396 INFO lxc_start - start.c:resolve_clone_flags:883 - Cloning a new user namespace lxc-start 1455916829.396 INFO lxc_cgroup - cgroup.c:cgroup_init:65 - cgroup driver cgmanager initing for aansluitform-deploy lxc-start 1455916829.507 NOTICE lxc_start - start.c:do_start:699 - switching to gid/uid 0 in new user namespace lxc-start 1455916829.509 DEBUGlxc_conf - conf.c:setup_rootfs:1295 - mounted '/home/bas/.local/share/lxc/aansluitform-deploy/rootfs' on '/usr/lib/x86_64-linux-gnu/lxc' lxc-start 1455916829.509 INFO lxc_conf - conf.c:setup_utsname:928 - 'aansluitform-deploy' hostname has been setup lxc-start 1455916829.509 DEBUGlxc_conf - conf.c:setup_netdev:2595 - 'eth0' has been setup lxc-start 1455916829.509 INFO lxc_conf - conf.c:setup_network:2616 - network has been setup lxc-start 1455916829.509 INFO lxc_conf - conf.c:mount_autodev:1157 - Mounting container /dev lxc-start 1455916829.509 INFO lxc_conf - conf.c:mount_autodev:1179 - Mounted tmpfs onto /usr/lib/x86_64-linux-gnu/lxc/dev lxc-start 1455916829.509 INFO lxc_conf - conf.c:mount_autodev:1197 - Mounted container /dev which seems to pass the point where it failed before. A little bit later, it now fails with lxc-start 1455916829.616 WARN lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:167 - Incomplete AppArmor support in your kernel lxc-start 1455916829.616 ERRORlxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:183 - No such file or directory - failed to change apparmor profile to lxc-container-default lxc-start 1455916829.616 ERRORlxc_sync - sync.c:__sync_wait:51 - invalid sequence number 1. expected 4 lxc-start 1455916829.616 ERRORlxc_start - start.c:__lxc_start:1213 - failed to spawn 'aansluitform-deploy' lxc-start 1455916829.616 WARN lxc_commands - commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to receive response lxc-start 1455916829.616 WARN lxc_cgmanager - cgmanager.c:cgm_get:994 - do_cgm_get exited with error lxc-start 1455916829.616 ERRORlxc_cgmanager - cgmanager.c:cgm_remove_cgroup:523 - call to cgmanager_remove_sync failed: invalid request lxc-start 1455916829.616 ERRORlxc_cgmanager - cgmanager.c:cgm_remove_cgroup:525 - Error removing all:lxc/aansluitform-deploy-10 lxc-start 1455916834.621 ERRORlxc_start_ui - lxc_start.c:main:344 - The container failed to start. lxc-start 1455916834.621 ERRORlxc_start_ui - lxc_start.c:main:346 - To get more details, run the container in foreground mode. lxc-start 1455916834.621 ERRORlxc_start_ui - lxc_start.c:main:348 - Additional information can be obtained by setting the --logfile and --logpriority options. even if the apparmor setting is set in the config file. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1533833] Re: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller
I've downgraded systemd to 225-1ubuntu9.1 from wily/proposed. Kernel is still linux-image-4.5.0-040500rc4-generic and lxc is 1.1.5-0ubuntu0.15.10.3 from wily-updates. Unfortunately, when I now start the lxc container, I seem to hit a different bug. I get: lxc-start 1455870309.289 INFO lxc_conf - conf.c:setup_tty:1080 - 4 tty(s) has been setup lxc-start 1455870309.289 INFO lxc_conf - conf.c:setup_personality:1473 - set personality to '0x0' lxc-start 1455870309.289 DEBUGlxc_conf - conf.c:setup_caps:2279 - drop capability 'mac_admin' (33) lxc-start 1455870309.289 DEBUGlxc_conf - conf.c:setup_caps:2279 - drop capability 'mac_override' (32) lxc-start 1455870309.289 DEBUGlxc_conf - conf.c:setup_caps:2279 - drop capability 'sys_time' (25) lxc-start 1455870309.289 DEBUGlxc_conf - conf.c:setup_caps:2279 - drop capability 'sys_module' (16) lxc-start 1455870309.289 DEBUGlxc_conf - conf.c:setup_caps:2288 - capabilities have been setup lxc-start 1455870309.289 NOTICE lxc_conf - conf.c:lxc_setup:4026 - 'aansluitform-deploy' is setup. lxc-start 1455870309.289 WARN lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:167 - Incomplete AppArmor support in your kernel lxc-start 1455870309.289 ERRORlxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:169 - If you really want to start this container, set lxc-start 1455870309.289 ERRORlxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:170 - lxc.aa_allow_incomplete = 1 lxc-start 1455870309.289 ERRORlxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:171 - in your container configuration file lxc-start 1455870309.289 ERRORlxc_sync - sync.c:__sync_wait:51 - invalid sequence number 1. expected 4 lxc-start 1455870309.289 ERRORlxc_start - start.c:__lxc_start:1213 - failed to spawn 'aansluitform-deploy' lxc-start 1455870309.290 ERRORlxc_cgmanager - cgmanager.c:cgm_remove_cgroup:523 - call to cgmanager_remove_sync failed: invalid request lxc-start 1455870309.290 ERRORlxc_cgmanager - cgmanager.c:cgm_remove_cgroup:525 - Error removing all:lxc/aansluitform-deploy-8 lxc-start 1455870309.317 WARN lxc_commands - commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to receive response lxc-start 1455870309.317 WARN lxc_cgmanager - cgmanager.c:cgm_get:994 - do_cgm_get exited with error lxc-start 1455870314.321 ERRORlxc_start_ui - lxc_start.c:main:344 - The container failed to start. lxc-start: lxc_start.c: main: 344 The container failed to start. lxc-start 1455870314.321 ERRORlxc_start_ui - lxc_start.c:main:346 - To get more details, run the container in foreground mode. lxc-start: lxc_start.c: main: 346 To get more details, run the container in foreground mode. lxc-start 1455870314.321 ERRORlxc_start_ui - lxc_start.c:main:348 - Additional information can be obtained by setting the --logfile and --logpriority options. lxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options. When adding the suggested apparmor parameter to the config file, the apparmor error disappear, but the cgmanager errors are identical (but different than before)... Any ideas? -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1533833] Re: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller
This was systemd and kernel from xenial. I'll try again tomorrov with the wily-proposed systemd and xenial kernel. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1533833] Re: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller
I've just tried with an upstream 4.5.0-rc4 kernel (which does boot on my laptop). Unfortunately, it doesn't work yet. linux-image linux-image-4.5.0-040500rc4-generic systemd 229-1ubuntu2 lxc 1.1.5-0ubuntu0.15.10.3 starting a container gives: lxc-start 1455712091.086 DEBUGlxc_console - console.c:lxc_console_peer_default:536 - no console peer lxc-start 1455712091.092 INFO lxc_monitor - monitor.c:lxc_monitor_sock_name:178 - using monitor sock name lxc/1139bd77ce7a3a6c//home/bas/.local/share/lxc lxc-start 1455712091.132 INFO lxc_start - start.c:lxc_init:474 - 'aansluitform-deploy' is initialized lxc-start 1455712091.132 DEBUGlxc_start - start.c:__lxc_start:1186 - Not dropping cap_sys_boot or watching utmp lxc-start 1455712091.133 INFO lxc_start - start.c:resolve_clone_flags:883 - Cloning a new user namespace lxc-start 1455712091.133 INFO lxc_cgroup - cgroup.c:cgroup_init:65 - cgroup driver cgmanager initing for aansluitform-deploy lxc-start 1455712091.138 ERRORlxc_cgmanager - cgmanager.c:lxc_cgmanager_enter:698 - call to cgmanager_move_pid_sync failed: invalid request lxc-start 1455712091.138 ERRORlxc_start - start.c:__lxc_start:1213 - failed to spawn 'aansluitform-deploy' lxc-start 1455712091.163 WARN lxc_commands - commands.c:lxc_cmd_rsp_recv:172 - command get_init_pid failed to receive response lxc-start 1455712091.164 WARN lxc_cgmanager - cgmanager.c:cgm_get:994 - do_cgm_get exited with error lxc-start 1455712096.169 ERRORlxc_start_ui - lxc_start.c:main:344 - The container failed to start. -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
Re: [Bug 1533833] Re: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi Martin, > On 11-02-16 10:24, Martin Pitt wrote: >> Bas, any chance to test the update in -proposed so that we can >> release that? > > I'll try to test it later this week, if that's ok. Unfortunately, the xenial 4.4 kernel won't boot for me at the moment (keyboard doesn't work while inputting disk decryption key), so I can't test if thisis fixed... Gr, Bas. -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJWw4LgAAoJENGDpRe/qY3mp+QQAM5EESKhWB5MjZUn3cvDh+ku IGKEqKjDg+luKuHxvHHiXh1KNNCdHCffko33Qa2LSMsivX1WHNocN+n7Hvv1Wq0N DmUHqth5b+BefemEF+sfJVz+gyV6W9r37QtJxKbjb8pUr05vnlzdMma7qF9qkZmv rA+bOQbjP20JSuohWvMM0tRC9+gNX4GBiZYD/8Ac3WGMLA8l2FNXjnCrWFgyb+oF hhPcgudcv9L2JAx+7JlXs7oNMoXjQ57k/d1dIQW+uyGL/24X2CV1btcEmznowYMo lYZPP99i3PpsmhnhwAd+VYYPd1o1052HfkEYIx/dVMoK5usxgpcwl5wsdgFLaTog hpPA/poC7RCIFdGpXFt31dhjQMIOR4mQ41NiuJtPxXrp5H3Bu5Q0bCgq3o5WJMNw 85bzJ5uxE3cGFDSeeBb/j8gxeK1yW1hqP5t051f40C98sfX4hyOyZmuKLyakKyW9 I/h8kQOFaLFi8MlmcV6MnA0E66nIO5J+ODWeSmdAeMLWAzA9b911YfecCB8PMboq RtR/ddc0/cttmtDWgQ8sz3lO7d2vNwzWqMIJW2qDy4IexK9jOIlHiOw9CLuJdjqm f2sfZZWhNjeGIddAJ0tZB6TKmCHuZ07XYeaiyOaFTGSTF5MhDmPtyV7/51d6pOU4 QqbgijCYBiyM1m04NNep =HBJX -END PGP SIGNATURE- -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
Re: [Bug 1533833] Re: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Hi Martin, On 11-02-16 10:24, Martin Pitt wrote: > Bas, any chance to test the update in -proposed so that we can > release that? I'll try to test it later this week, if that's ok. Best regards, Bas. - -- And what shoulder and what art Could twist the sinews of thy heart? And when thy heart began to beat What dread hand and what dread feet? -BEGIN PGP SIGNATURE- Version: GnuPG v2 iQIcBAEBCAAGBQJWwaVGAAoJENGDpRe/qY3m3hEP/Rl0oDvDYBiVQLr8L0ziSW4B CC19e9WaR76hhtuKnPpARqY9KteOeIOfJ2JC37DoAIi39k6I3ze5r61KGqxmB72W Kgajvjy3AcqzWOxEAZC5wEJX9wMI/cT8vSgtUjhQT8TIsTKsGCXXDzBlICzQ51eU CfkFtDJPrTJtkxS/IewomwvQwEy+vYM9sdBAVt/eEeBB2h0V0oNlD5k41p5p80ll 1Go9C9b0KHN0fWmkrjcT69b0GJG94/tsLbP/vMCsOpcH9f1RiLz02ruBSeNsrB8s OUD9xi+hbB55Qvg3dtHjD0InqOn2eOxp+UOoeIwr4IbOP15IenK/7wLVQAvzi0yO GysISesys69zRAAWOEpFHyHb/YX9DBlnRcEO+cRCRXCDV8mod4Y/CUWFPMk37Plv +HCJhl3dlf8eZc3YKXOSCfL70ue25JXo/s+/KKoAai4cQyuWzGZ1cMk4RGQRjnhT 26WL2pOAnB02UqmVTcO4xRx452AFVZbOG0+qi1CdzvTc1zlgRYQrGZPzz2h2fsA3 /+iZzMfcd1N45kr/UMavslhWgkye6wJ5hRJdyMG+n6lyNo3oqGMLyvTuC5v8xVbV m5UaHDULX3NDkk9d1joMsw02qzTuMIZuPdlzTHPr/VPpw15B0b+x4gzHbOxPsACx DKLdRCkiKPUEkXMY2Fbl =oRTc -END PGP SIGNATURE- -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start, need to put sessions into "pids" cgroup controller To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1533833] Re: unprivileged lxc containers won't start
Ah, right, that explains things: I'm running a xenial kernel, I think. For completeness sake, these are the versions: [bas@miranda]~> uname -a Linux miranda 4.3.0-5-generic #16-Ubuntu SMP Wed Dec 16 23:33:25 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux [bas@miranda]~> dpkg -l linux-image-\* systemd Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-==---= un linux-image-3. (no description available) ii linux-image-4. 4.2.0-23.28 amd64Linux kernel image for version 4. ii linux-image-4. 4.3.0-5.16 amd64Linux kernel image for version 4. ii linux-image-ex 4.2.0-23.28 amd64Linux kernel extra modules for ve ii linux-image-ex 4.3.0-5.16 amd64Linux kernel extra modules for ve ii linux-image-ge 4.2.0.23.25 amd64Generic Linux kernel image ii systemd225-1ubuntu9 amd64system and service manager -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
[Bug 1533833] [NEW] unprivileged lxc containers won't start
Public bug reported: I'n trying to get (unpriviliged) lxc containers to run on wily. I create a container like this: > lxc-create -t download -n u1 -- -d ubuntu -r wily -a amd64 that works. However, starting the container fails: > lxc-start -n u1 lxc-start: lxc_start.c: main: 344 The container failed to start. lxc-start: lxc_start.c: main: 346 To get more details, run the container in foreground mode. lxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options. Setting the log priority to debug shows the following (relevant part only): lxc-start 1452717530.484 INFO lxc_start - start.c:lxc_init:474 - 'u1' is initialized lxc-start 1452717530.484 DEBUGlxc_start - start.c:__lxc_start:1186 - Not dropping cap_sys_boot or watching utmp lxc-start 1452717530.484 INFO lxc_start - start.c:resolve_clone_flags:883 - Cloning a new user namespace lxc-start 1452717530.484 INFO lxc_cgroup - cgroup.c:cgroup_init:65 - cgroup driver cgmanager initing for u1 lxc-start 1452717530.489 ERRORlxc_cgmanager - cgmanager.c:lxc_cgmanager_enter:698 - call to cgmanager_move_pid_sync failed: invalid request lxc-start: cgmanager.c: lxc_cgmanager_enter: 698 call to cgmanager_move_pid_sync failed: invalid request lxc-start 1452717530.490 ERRORlxc_start - start.c:__lxc_start:1213 - failed to spawn 'u1' lxc-start: start.c: __lxc_start: 1213 failed to spawn 'u1' lxc-start 1452717530.513 ERRORlxc_start_ui - lxc_start.c:main:344 - The container failed to start. lxc-start: lxc_start.c: main: 344 The container failed to start. lxc-start 1452717530.513 ERRORlxc_start_ui - lxc_start.c:main:348 - Additional information can be obtained by setting the --logfile and --logpriority options. lxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options. lxc-start 1452717530.484 INFO lxc_start - start.c:lxc_init:474 - 'u1' is initialized lxc-start 1452717530.484 DEBUGlxc_start - start.c:__lxc_start:1186 - Not dropping cap_sys_boot or watching utmp lxc-start 1452717530.484 INFO lxc_start - start.c:resolve_clone_flags:883 - Cloning a new user namespace lxc-start 1452717530.484 INFO lxc_cgroup - cgroup.c:cgroup_init:65 - cgroup driver cgmanager initing for u1 lxc-start 1452717530.489 ERRORlxc_cgmanager - cgmanager.c:lxc_cgmanager_enter:698 - call to cgmanager_move_pid_sync failed: invalid request lxc-start: cgmanager.c: lxc_cgmanager_enter: 698 call to cgmanager_move_pid_sync failed: invalid request lxc-start 1452717530.490 ERRORlxc_start - start.c:__lxc_start:1213 - failed to spawn 'u1' lxc-start: start.c: __lxc_start: 1213 failed to spawn 'u1' lxc-start 1452717530.513 ERRORlxc_start_ui - lxc_start.c:main:344 - The container failed to start. lxc-start: lxc_start.c: main: 344 The container failed to start. lxc-start 1452717530.513 ERRORlxc_start_ui - lxc_start.c:main:348 - Additional information can be obtained by setting the --logfile and --logpriority options. lxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options. So it seems a cgmanager issue. Syslog shows: Jan 13 21:37:58 miranda cgmanager[22010]: cgmanager:do_create_main: pid 25615 (uid 1000 gid 1000) may not create under /run/cgmanager/fs/pids Jan 13 21:37:58 miranda cgmanager[22010]: cgmanager: Invalid path /run/cgmanager/fs/pids/lxc/u1 Jan 13 21:37:58 miranda cgmanager[22010]: cgmanager:per_ctrl_move_pid_main: Invalid path /run/cgmanager/fs/pids/lxc/u1 Jan 13 21:38:50 miranda cgmanager[22010]: cgmanager:do_create_main: pid 25632 (uid 1000 gid 1000) may not create under /run/cgmanager/fs/pids Jan 13 21:38:50 miranda cgmanager[22010]: cgmanager: Invalid path /run/cgmanager/fs/pids/lxc/u1 Jan 13 21:38:50 miranda cgmanager[22010]: cgmanager:per_ctrl_move_pid_main: Invalid path /run/cgmanager/fs/pids/lxc/u1 ** Affects: lxc (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1533833 Title: unprivileged lxc containers won't start To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1533833/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
