* Re: [ISSUE] [CLOSED] podman-2.0.0 won't work with apparmor enabled
[not found] <gh-mailinglist-notifications-41a7ca26-5023-4802-975b-f1789d68868e-void-packages-23206@inbox.vuxu.org>
@ 2020-08-04 17:14 ` the-antz
0 siblings, 0 replies; only message in thread
From: the-antz @ 2020-08-04 17:14 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 2018 bytes --]
Closed issue by the-antz on void-packages repository
https://github.com/void-linux/void-packages/issues/23206
Description:
### System
* xuname:
Void 5.6.19_1 x86_64 GenuineIntel uptodate rrFF
* package:
podman-2.0.0_1
maybe containers.image-5.0.0_1
### Expected behavior
Both
`sudo podman run --rm -it hello-world`
and
`podman run --rm -it hello-world`
should print some hello-world messages.
### Actual behavior
#### ~~Issue 1~~ (fixed in v2.0.1 #23235 )
`sudo podman run --rm -it hello-world`
fails with
`Error: AppArmor profile "container-default" specified but not loaded`
After loading a dummy apparmor profile in complain mode `/etc/apparmor.d/container-default.profile`
```
#include <tunables/global>
profile container-default flags=(complain) {
#include <abstractions/base>
}
```
running podman as root works as expected.
Related: https://github.com/containers/libpod/issues/6724
We should probably add a container-default.profile to podman (or maybe containers.image?) but I didn't find any example profile in the podman repo.
#### Issue 2
**edit**: https://github.com/containers/libpod/issues/6668
`podman run --rm -it hello-world`
fails with
`Error: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused \"process_linux.go:378: setting rlimits for ready process caused \\\"error setting rlimit type 7: invalid argument\\\"\"": OCI runtime error`
This happens with both apparmor enabled and disabled and might be a different issue.
--
I deleted all container related configs and had them recreate by podman 2 (well actually containers.image) but that didn't have any effect.
### Steps to reproduce the behavior
To load the profile: `apparmor_parser /etc/apparmor.d/container-default.profile`
Otherwise, on an apparmor enabled system, simply:
```
xbps-install podman
podman run --rm -it hello-world
sudo podman run --rm -it hello-world
```
edit: @cameronnemo (ping)
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-08-04 17:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <gh-mailinglist-notifications-41a7ca26-5023-4802-975b-f1789d68868e-void-packages-23206@inbox.vuxu.org>
2020-08-04 17:14 ` [ISSUE] [CLOSED] podman-2.0.0 won't work with apparmor enabled the-antz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).