6

The following error occurs during docker run and docker build after upgrading from Debian 8 to Debian 9:

ERROR: Service 'etherpad' failed to build: OCI runtime create failed: container_linux.go:344: starting container process caused "error loading seccomp filter into kernel: invalid argument": unknown

I was able to solve the problem when running a container by using --seccomp-profile:unconfined but build doesn't support this flag (https://github.com/moby/moby/issues/21105). I also tried to pass it to the daemon via the daemon.json but this caused an error during startup.

Kernel support is enabled:

grep CONFIG_SECCOMP= /boot/config-$(uname -r)
CONFIG_SECCOMP=y

docker info:

Containers: 38
Running: 9
Paused: 0
Stopped: 29
Images: 119
Server Version: 18.09.2
Storage Driver: aufs
Root Dir: /var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 275
Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries     splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 9754871865f7fe2f4e74d43e2fc7ccd237edcbce
runc version: 09c8266bf2fcf9519a651b04ae54c967b9ab86ec
init version: fec3683
Security Options:
 seccomp
 WARNING: You're not using the default seccomp profile
 Profile: /root/labs/security/seccomp/seccomp-profiles/default.json
Kernel Version: 3.16.0-7-amd64
Operating System: Debian GNU/Linux 9 (stretch)
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 15.71GiB
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine

WARNING: No memory limit support
WARNING: No swap limit support
WARNING: No kernel memory limit support
WARNING: No oom kill disable support
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support

Does anyone have an idea how to solve it? Thank you very much.

aljoshare
  • 792
  • 9
  • 16
  • Docker containers can't (or at least really really shouldn't) make changes to the host kernel. You especially can't do this during the `docker build` step. Also note the output of the build is essentially a filesystem image with metadata, and not any of the other running state of the system: if you succeeded at this, pushed the image, and ran it from somewhere else, it wouldn't have whatever kernel-related change you were making. – David Maze Feb 27 '19 at 12:18
  • Aside - recommend moving off the aufs storage driver. – danblack Feb 27 '19 at 12:51

1 Answers1

9

TLDR; reboot your server after upgrading to Stretch.

Your issue looks similar to one that I experienced. I received the below error:

OCI runtime create failed: container_linux.go:345: starting container process caused "error loading seccomp filter into kernel: invalid argument": unknown

The issue occurred after upgrading from Jessie to Stretch and installing a fresh copy of Docker (https://docs.docker.com/install/linux/docker-ce/debian/).

I believe your issue is similar because your docker info output shows

Kernel Version: 3.16.0-7-amd64

and for me:

# uname -a
Linux debian 3.16.0-7-amd64 #1 SMP Debian 3.16.59-1 (2018-10-03) x86_64 GNU/Linux

Stretch should be using a later kernel version than that, so the fix was:

# reboot
# uname -a
Linux debian 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1+deb9u2 (2019-05-13) x86_64 GNU/Linux
Kieran
  • 2,200
  • 1
  • 15
  • 17
  • Thank you for your answer. After updating kernel docker starts. 1. `apt-cache search linux-image` have follow: `linux-image-4.9.0-11-amd64 - Linux 4.9 for 64-bit PCs` and `linux-headers-4.9.0-11-amd64 - Header files for Linux 4.9.0-11-amd64` 2. `sudo apt-get install linux-image-4.9.0-11-amd64 linux-headers-4.9.0-11-amd64` 3. `docker run hello-world` – SiZE Oct 22 '19 at 04:24