`docker:dind` on Rootless Docker host (`can't get final child's PID from pipe`) #46679

hytdsh · 2023-10-19T13:54:06Z

Description

Hi there,

In docker:dind on Rootless Docker host (Debian 12), docker pull succeeds, and docker run fails with the error can't get final child's PID from pipe.
In docker:dind on Rootless Docker host (Ubuntu 22.04), docker pull succeeds, and docker run also succeeds.

docker:dind-rootless on Rootless Docker host (Debian 12) does not up with the error newuidmap: write to uid_map failed.
docker:dind-rootless on Rootless Docker host (Ubuntu 22.04) does not up with the error newuidmap: write to uid_map failed.

Reproduce

`docker:dind`

on Rootless Docker host (Debian 12) - `docker pull` succeeds, `docker run` fails

rootless@debian12:~$ uname -a
Linux debian12 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 GNU/Linux

rootless@debian12:~/dind$ cat compose.yml
version: "3"

services:
  dind:
    image: docker:24.0.6-dind
    privileged: true

rootless@debian12:~/dind$ docker compose up -d
[+] Running 2/2
 ✔ Network dind_default   Created                                                                                  0.1s
 ✔ Container dind-dind-1  Started                                                                                  0.0s

rootless@debian12:~/dind$ docker compose ps
NAME          IMAGE                COMMAND                   SERVICE   CREATED         STATUS         PORTS
dind-dind-1   docker:24.0.6-dind   "dockerd-entrypoint.sh"   dind      6 seconds ago   Up 5 seconds   2375-2376/tcp

rootless@debian12:~/dind$ docker compose exec dind sh
/ # 

/ # docker pull ubuntu:latest
latest: Pulling from library/ubuntu
aece8493d397: Pull complete
Digest: sha256:2b7412e6465c3c7fc5bb21d3e6f1917c167358449fecac8176c6e496e5c1f05f
Status: Downloaded newer image for ubuntu:latest
docker.io/library/ubuntu:latest

/ # docker run --rm -it ubuntu:latest bash
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF: unknown.
ERRO[0000] error waiting for container:

rootless@debian12:~/dind$ docker compose logs dind
dind-dind-1  | Certificate request self-signature ok
dind-dind-1  | subject=CN = docker:dind server
dind-dind-1  | /certs/server/cert.pem: OK
dind-dind-1  | Certificate request self-signature ok
dind-dind-1  | subject=CN = docker:dind client
dind-dind-1  | /certs/client/cert.pem: OK
dind-dind-1  | mount: permission denied (are you root?)
dind-dind-1  | Could not mount /sys/kernel/security.
dind-dind-1  | AppArmor detection and --privileged mode might break.
dind-dind-1  | time="2023-10-19T14:51:46.367691053Z" level=info msg="Starting up"
dind-dind-1  | time="2023-10-19T14:51:46.373233400Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
dind-dind-1  | time="2023-10-19T14:51:46.373487600Z" level=info msg="containerd not running, starting managed containerd"
dind-dind-1  | time="2023-10-19T14:51:46.375119974Z" level=info msg="started new containerd process" address=/var/run/docker/containerd/containerd.sock module=libcontainerd pid=57

...snip...

dind-dind-1  | time="2023-10-19T14:51:47.229973833Z" level=info msg="API listen on [::]:2376"
dind-dind-1  | time="2023-10-19T14:52:39.392478666Z" level=info msg="No non-localhost DNS nameservers are left in resolv.conf. Using default external servers: [nameserver 8.8.8.8 nameserver 8.8.4.4]"
dind-dind-1  | time="2023-10-19T14:52:39.392619707Z" level=info msg="IPv6 enabled; Adding default IPv6 external servers: [nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844]"
dind-dind-1  | time="2023-10-19T14:52:39.491483074Z" level=info msg="loading plugin \"io.containerd.internal.v1.shutdown\"..." runtime=io.containerd.runc.v2 type=io.containerd.internal.v1
dind-dind-1  | time="2023-10-19T14:52:39.493372565Z" level=info msg="loading plugin \"io.containerd.ttrpc.v1.pause\"..." runtime=io.containerd.runc.v2 type=io.containerd.ttrpc.v1
dind-dind-1  | time="2023-10-19T14:52:39.493494554Z" level=info msg="loading plugin \"io.containerd.event.v1.publisher\"..." runtime=io.containerd.runc.v2 type=io.containerd.event.v1
dind-dind-1  | time="2023-10-19T14:52:39.493571581Z" level=info msg="loading plugin \"io.containerd.ttrpc.v1.task\"..." runtime=io.containerd.runc.v2 type=io.containerd.ttrpc.v1
dind-dind-1  | time="2023-10-19T14:52:39.545901194Z" level=info msg="shim disconnected" id=d34b28a8f39a732517dc5e9cff41b5e5220569eeaaa34bc8268240dbd53ea1f6 namespace=moby
dind-dind-1  | time="2023-10-19T14:52:39.546667559Z" level=warning msg="cleaning up after shim disconnected" id=d34b28a8f39a732517dc5e9cff41b5e5220569eeaaa34bc8268240dbd53ea1f6 namespace=moby
dind-dind-1  | time="2023-10-19T14:52:39.546752340Z" level=info msg="cleaning up dead shim" namespace=moby
dind-dind-1  | time="2023-10-19T14:52:39.568219191Z" level=warning msg="cleanup warnings time=\"2023-10-19T14:52:39Z\" level=warning msg=\"failed to read init pid file\" error=\"open /run/docker/containerd/daemon/io.containerd.runtime.v2.task/moby/d34b28a8f39a732517dc5e9cff41b5e5220569eeaaa34bc8268240dbd53ea1f6/init.pid: no such file or directory\" runtime=io.containerd.runc.v2\n" namespace=moby
dind-dind-1  | time="2023-10-19T14:52:39.569698590Z" level=error msg="copy shim log" error="read /proc/self/fd/13: file already closed" namespace=moby
dind-dind-1  | time="2023-10-19T14:52:39.579784182Z" level=error msg="stream copy error: reading from a closed fifo"
dind-dind-1  | time="2023-10-19T14:52:39.703295992Z" level=error msg="Handler for POST /v1.43/containers/d34b28a8f39a732517dc5e9cff41b5e5220569eeaaa34bc8268240dbd53ea1f6/start returned error: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF: unknown"

on Rootless Docker host (Ubuntu 22.04) - `docker pull` succeeds, `docker run` succeeds

rootless@ubuntu2204:~$ uname -a
Linux ubuntu2204 5.15.0-87-generic #97-Ubuntu SMP Mon Oct 2 21:09:21 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

rootless@ubuntu2204:~/dind$ cat compose.yml
version: "3"

services:
  dind:
    image: docker:24.0.6-dind
    privileged: true

rootless@ubuntu2204:~/dind$ docker compose up -d
[+] Running 2/2
 ✔ Network dind_default   Created                                                                                  0.1s
 ✔ Container dind-dind-1  Started                                                                                  0.1s

rootless@ubuntu2204:~/dind$ docker compose ps
NAME          IMAGE                COMMAND                   SERVICE   CREATED              STATUS              PORTS
dind-dind-1   docker:24.0.6-dind   "dockerd-entrypoint.sh"   dind      About a minute ago   Up About a minute   2375-2376/tcp

rootless@ubuntu2204:~/dind$ docker compose exec dind sh
/ # 

/ # docker pull debian:stable
stable: Pulling from library/debian
98d7f57ba433: Pull complete
Digest: sha256:fd865da5f887f2fdb7af19c3a33fe9c98cb00a26859df66508cadadc35cb8676
Status: Downloaded newer image for debian:stable
docker.io/library/debian:stable

/ # docker run --rm -it debian:stable bash
root@44986f5f32dc:/# 

root@44986f5f32dc:/# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

rootless@ubuntu2204:~/dind$ docker compose logs dind
dind-dind-1  | Certificate request self-signature ok
dind-dind-1  | subject=CN = docker:dind server
dind-dind-1  | /certs/server/cert.pem: OK
dind-dind-1  | Certificate request self-signature ok
dind-dind-1  | subject=CN = docker:dind client
dind-dind-1  | /certs/client/cert.pem: OK
dind-dind-1  | mount: permission denied (are you root?)
dind-dind-1  | Could not mount /sys/kernel/security.
dind-dind-1  | AppArmor detection and --privileged mode might break.
dind-dind-1  | time="2023-10-19T14:43:57.967092773Z" level=info msg="Starting up"
dind-dind-1  | time="2023-10-19T14:43:57.974216729Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
dind-dind-1  | time="2023-10-19T14:43:57.974358332Z" level=info msg="containerd not running, starting managed containerd"

...snip...

dind-dind-1  | time="2023-10-19T14:43:58.396372212Z" level=info msg="API listen on [::]:2376"
dind-dind-1  | time="2023-10-19T14:44:58.012664672Z" level=info msg="No non-localhost DNS nameservers are left in resolv.conf. Using default external servers: [nameserver 8.8.8.8 nameserver 8.8.4.4]"
dind-dind-1  | time="2023-10-19T14:44:58.012813115Z" level=info msg="IPv6 enabled; Adding default IPv6 external servers: [nameserver 2001:4860:4860::8888 nameserver 2001:4860:4860::8844]"
dind-dind-1  | time="2023-10-19T14:44:58.087850115Z" level=info msg="loading plugin \"io.containerd.internal.v1.shutdown\"..." runtime=io.containerd.runc.v2 type=io.containerd.internal.v1
dind-dind-1  | time="2023-10-19T14:44:58.088112853Z" level=info msg="loading plugin \"io.containerd.ttrpc.v1.pause\"..." runtime=io.containerd.runc.v2 type=io.containerd.ttrpc.v1
dind-dind-1  | time="2023-10-19T14:44:58.088218992Z" level=info msg="loading plugin \"io.containerd.event.v1.publisher\"..." runtime=io.containerd.runc.v2 type=io.containerd.event.v1
dind-dind-1  | time="2023-10-19T14:44:58.088291501Z" level=info msg="loading plugin \"io.containerd.ttrpc.v1.task\"..." runtime=io.containerd.runc.v2 type=io.containerd.ttrpc.v1

`docker:dind-rootless` does not up

on Rootless Docker host (Debian 12)

rootless@debian12:~$ uname -a
Linux debian12 6.1.0-13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.55-1 (2023-09-29) x86_64 GNU/Linux

rootless@debian12:~/dind-rootless$ cat compose.yml
version: "3"

services:
  dind-rootless:
    image: docker:24.0.6-dind-rootless
    privileged: true
    environment:
      - DOCKER_HOST=unix:///var/run/user/1000/docker.sock

rootless@debian12:~/dind-rootless$ docker compose up -d
[+] Running 2/2
 ✔ Network dind-rootless_default            Created                                                                0.1s
 ✔ Container dind-rootless-dind-rootless-1  Started                                                                0.1s

rootless@debian12:~/dind-rootless$ docker compose ps
NAME      IMAGE     COMMAND   SERVICE   CREATED   STATUS    PORTS

rootless@debian12:~/dind-rootless$ docker compose logs dind-rootless
dind-rootless-dind-rootless-1  | Certificate request self-signature ok
dind-rootless-dind-rootless-1  | subject=CN = docker:dind server
dind-rootless-dind-rootless-1  | /certs/server/cert.pem: OK
dind-rootless-dind-rootless-1  | Certificate request self-signature ok
dind-rootless-dind-rootless-1  | subject=CN = docker:dind client
dind-rootless-dind-rootless-1  | /certs/client/cert.pem: OK
dind-rootless-dind-rootless-1  | Device "ip_tables" does not exist.
dind-rootless-dind-rootless-1  | ip_tables              36864  2 iptable_nat,iptable_filter
dind-rootless-dind-rootless-1  | x_tables               61440  9 iptable_nat,iptable_filter,xt_nat,xt_tcpudp,xt_conntrack,xt_MASQUERADE,xt_addrtype,nft_compat,ip_tables
dind-rootless-dind-rootless-1  | modprobe: can't change directory to '/lib/modules': No such file or directory
dind-rootless-dind-rootless-1  | [rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 55 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted
dind-rootless-dind-rootless-1  | : exit status 1

on Rootless Docker host (Ubuntu 22.04)

rootless@ubuntu2204:~$ uname -a
Linux ubuntu2204 5.15.0-87-generic #97-Ubuntu SMP Mon Oct 2 21:09:21 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

rootless@ubuntu2204:~/dind-rootless$ cat compose.yml
version: "3"

services:
  dind-rootless:
    image: docker:24.0.6-dind-rootless
    privileged: true
    environment:
      - DOCKER_HOST=unix:///var/run/user/1000/docker.sock

rootless@ubuntu2204:~/dind-rootless$ docker compose up -d
[+] Running 2/2
 ✔ Network dind-rootless_default            Created                                                                0.1s
 ✔ Container dind-rootless-dind-rootless-1  Started                                                                0.1s

rootless@ubuntu2204:~/dind-rootless$ docker compose ps
NAME      IMAGE     COMMAND   SERVICE   CREATED   STATUS    PORTS

rootless@ubuntu2204:~/dind-rootless$ docker compose logs dind-rootless
dind-rootless-dind-rootless-1  | Certificate request self-signature ok
dind-rootless-dind-rootless-1  | subject=CN = docker:dind server
dind-rootless-dind-rootless-1  | /certs/server/cert.pem: OK
dind-rootless-dind-rootless-1  | Certificate request self-signature ok
dind-rootless-dind-rootless-1  | subject=CN = docker:dind client
dind-rootless-dind-rootless-1  | /certs/client/cert.pem: OK
dind-rootless-dind-rootless-1  | Device "ip_tables" does not exist.
dind-rootless-dind-rootless-1  | ip_tables              32768  2 iptable_nat,iptable_filter
dind-rootless-dind-rootless-1  | x_tables               53248  9 iptable_nat,iptable_filter,xt_nat,xt_tcpudp,xt_conntrack,xt_MASQUERADE,xt_addrtype,nft_compat,ip_tables
dind-rootless-dind-rootless-1  | modprobe: can't change directory to '/lib/modules': No such file or directory
dind-rootless-dind-rootless-1  | [rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 56 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted
dind-rootless-dind-rootless-1  | : exit status 1

Expected behavior

I want docker:dind to work correctly on Debian 12 Rootless Docker hosts.
If possible, docker:dind-rootless should also work.

docker version

`docker version` on Debian 12 host

rootless@debian12:~$ docker version
Client: Docker Engine - Community
 Version:           24.0.6
 API version:       1.43
 Go version:        go1.20.7
 Git commit:        ed223bc
 Built:             Mon Sep  4 12:32:10 2023
 OS/Arch:           linux/amd64
 Context:           rootless

Server: Docker Engine - Community
 Engine:
  Version:          24.0.6
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.7
  Git commit:       1a79695
  Built:            Mon Sep  4 12:32:10 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.24
  GitCommit:        61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc:
  Version:          1.1.9
  GitCommit:        v1.1.9-0-gccaecfc
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
 rootlesskit:
  Version:          1.1.1
  ApiVersion:       1.1.1
  NetworkDriver:    slirp4netns
  PortDriver:       builtin
  StateDir:         /tmp/rootlesskit41920960
 slirp4netns:
  Version:          1.2.0
  GitCommit:        656041d45cfca7a4176f6b7eed9e4fe6c11e8383

`docker version` on Ubuntu 22.04 host

rootless@ubuntu2204:~$ docker version
Client: Docker Engine - Community
 Version:           24.0.6
 API version:       1.43
 Go version:        go1.20.7
 Git commit:        ed223bc
 Built:             Mon Sep  4 12:31:44 2023
 OS/Arch:           linux/amd64
 Context:           rootless

Server: Docker Engine - Community
 Engine:
  Version:          24.0.6
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.7
  Git commit:       1a79695
  Built:            Mon Sep  4 12:31:44 2023
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.6.24
  GitCommit:        61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc:
  Version:          1.1.9
  GitCommit:        v1.1.9-0-gccaecfc
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0
 rootlesskit:
  Version:          1.1.1
  ApiVersion:       1.1.1
  NetworkDriver:    slirp4netns
  PortDriver:       builtin
  StateDir:         /tmp/rootlesskit4088568616
 slirp4netns:
  Version:          1.0.1
  GitCommit:        6a7b16babc95b6a3056b33fb45b74a6f62262dd4

docker info

`docker info` on Debian 12 host

rootless@debian12:~$ docker info
Client: Docker Engine - Community
 Version:    24.0.6
 Context:    rootless
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.11.2
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.21.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 5
 Server Version: 24.0.6
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: false
  userxattr: true
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc version: v1.1.9-0-gccaecfc
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  rootless
  cgroupns
 Kernel Version: 6.1.0-13-amd64
 Operating System: Debian GNU/Linux 12 (bookworm)
 OSType: linux
 Architecture: x86_64
 CPUs: 1
 Total Memory: 1.921GiB
 Name: debian12
 ID: 34a061b9-ae74-41b6-8211-bed2fd9e4f8f
 Docker Root Dir: /home/rootless/.local/share/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

`docker info` on Ubuntu 22.04 host

rootless@ubuntu2204:~$ docker info
Client: Docker Engine - Community
 Version:    24.0.6
 Context:    rootless
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.11.2
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.21.0
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 5
 Server Version: 24.0.6
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: false
  userxattr: true
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 61f9fd88f79f081d64d6fa3bb1a0dc71ec870523
 runc version: v1.1.9-0-gccaecfc
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  rootless
  cgroupns
 Kernel Version: 5.15.0-87-generic
 Operating System: Ubuntu 22.04.3 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 1
 Total Memory: 1.918GiB
 Name: ubuntu2204
 ID: c1f3005e-61ca-427e-be10-c7a56cfd21b5
 Docker Root Dir: /home/rootless/.local/share/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

The text was updated successfully, but these errors were encountered:

AkihiroSuda · 2023-10-20T02:33:37Z

Probably a duplicate of:

Rootful-in-Rootless dind doesn't work since systemd v250 (due to oom score adj): runc create failed: unable to start container process: can't get final child's PID from pipe: EOF: unknown. #46563

The fix will be included in v24.0.7:

[24.0 backport] Limit OOMScoreAdj when running in UserNS ("Rootful-in-Rootless") #46626

hytdsh · 2023-10-20T08:13:39Z

Reproduced it as commented.

rootless@debian12:~/dind$ docker compose exec dind sh
/ # docker pull ubuntu:latest
latest: Pulling from library/ubuntu
aece8493d397: Pull complete
Digest: sha256:2b7412e6465c3c7fc5bb21d3e6f1917c167358449fecac8176c6e496e5c1f05f
Status: Downloaded newer image for ubuntu:latest
docker.io/library/ubuntu:latest

/ # docker run --rm -it ubuntu:latest bash
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF: unknown.
ERRO[0000] error waiting for container:

/ # docker run --oom-score-adj=100 --rm -it ubuntu:latest bash
root@7b0ba3b17e07:/# cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

hytdsh · 2023-10-20T08:16:23Z

I would appreciate comments about docker:dind-rootless as well.
Is it not supposed to run docker:dind-rootless on a Rootless Docker host?

hytdsh added kind/bug Bugs are bugs. The cause may or may not be known at triage time so debugging may be needed. status/0-triage labels Oct 19, 2023

thaJeztah added area/rootless Rootless mode version/24.0 labels Oct 19, 2023

AkihiroSuda added the kind/duplicate label Oct 20, 2023

hytdsh mentioned this issue Oct 23, 2023

In dind, docker pull succeeds but docker run fails, or dind-rootless cannot be executed on Rootless Docker host. docker-library/docker#451

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

`docker:dind` on Rootless Docker host (`can't get final child's PID from pipe`) #46679

`docker:dind` on Rootless Docker host (`can't get final child's PID from pipe`) #46679

hytdsh commented Oct 19, 2023 •

edited

AkihiroSuda commented Oct 20, 2023

hytdsh commented Oct 20, 2023

hytdsh commented Oct 20, 2023

docker:dind on Rootless Docker host (can't get final child's PID from pipe) #46679

docker:dind on Rootless Docker host (can't get final child's PID from pipe) #46679

Comments

hytdsh commented Oct 19, 2023 • edited

Description

Reproduce

docker:dind

on Rootless Docker host (Debian 12) - docker pull succeeds, docker run fails

on Rootless Docker host (Ubuntu 22.04) - docker pull succeeds, docker run succeeds

docker:dind-rootless does not up

on Rootless Docker host (Debian 12)

on Rootless Docker host (Ubuntu 22.04)

Expected behavior

docker version

docker version on Debian 12 host

docker version on Ubuntu 22.04 host

docker info

docker info on Debian 12 host

docker info on Ubuntu 22.04 host

AkihiroSuda commented Oct 20, 2023

hytdsh commented Oct 20, 2023

hytdsh commented Oct 20, 2023

`docker:dind` on Rootless Docker host (`can't get final child's PID from pipe`) #46679

`docker:dind` on Rootless Docker host (`can't get final child's PID from pipe`) #46679

hytdsh commented Oct 19, 2023 •

edited

`docker:dind`

on Rootless Docker host (Debian 12) - `docker pull` succeeds, `docker run` fails

on Rootless Docker host (Ubuntu 22.04) - `docker pull` succeeds, `docker run` succeeds

`docker:dind-rootless` does not up

`docker version` on Debian 12 host

`docker version` on Ubuntu 22.04 host

`docker info` on Debian 12 host

`docker info` on Ubuntu 22.04 host