latest 11-jdk on ubuntu jammy breaks keytool -importcert

I am using your images by using maven:3.8.5-eclipse-temurin-11 - see https://github.com/carlossg/docker-maven/blob/master/eclipse-temurin-11/Dockerfile#L1

Adding trusted certificates to the java truststore is failing on the new ubuntu jammy image

Using :11-jdk-focal

FROM eclipse-temurin:11-jdk-focal

RUN keytool -importcert -noprompt -file /usr/local/share/ca-certificates/extra/rootca.crt -cacerts -storepass changeit -alias 'custom root ca'
Certificate was added to keystore

Using :11-jdk

FROM eclipse-temurin:11-jdk

RUN keytool -importcert -noprompt -file /usr/local/share/ca-certificates/extra/rootca.crt -cacerts -storepass changeit -alias 'custom root ca'
[0.004s][warning][os,thread] Failed to start thread - pthread_create failed (EPERM) for attributes: stacksize: 1024k, guardsize: 4k, detached.
#
# There is insufficient memory for the Java Runtime Environment to continue.
# Cannot create worker GC thread. Out of system resources.
# An error report file with more information is saved as:
# //hs_err_pid6.log
The command '/bin/sh -c keytool -importcert -noprompt -file /usr/local/share/ca-certificates/extra/rootca.crt -cacerts -storepass changeit -alias 'custom root ca'' returned a non-zero code: 1

The only statement changed between builds is the Dockerfile FROM statement

[Monax111]

eclipse-temurin:17-jdk same problem

[carlossg]

the change to jammy was done in docker-library/official-images#12516

[karianna]

I think if your docker engine is upgraded to the latest that resolves this issue. Can folks give that a try?

Will try and let you know how it goes

[strangelookingnerd]

I can confirm that updating to docker-engine 20.10.16 resolved the issue for me.

[roumigus]

Hi folks! I had a similar issue, and your discussions here and there helped me to investigate. So I figured I could share my findings:

the change to jammy was done in docker-library/official-images#12516

Yes. All eclipse-temurin:<version>-jdk became based on the latest ubuntu LTS 22.04 Jammy.
You have to specify eclipse-temurin:<version>-jdk-focal if you want to use the image with the previous ubuntu LTS 20.04 Focal as a base image.

I can confirm that updating to docker-engine 20.10.16 resolved the issue for me.

This is probably due to this PR on docker.

Latest glibc will attempt to use clone3(). As a result, most newer distro (ubuntu Jammy 22.04, but probably others) will fail unless we allow the syscall (in docker, in systemd...).

To reproduce:

$ wget "https://raw.githubusercontent.com/moby/moby/c7cd1b9436ac381747a5c52dddac5a66f97c61f8/profiles/seccomp/default.json" -O before_clone3.json
 # the seccomp profile right before PR https://github.com/moby/moby/commit/9f6b562dd12ef7b1f9e2f8e6f2ab6477790a6594

docker run --security-opt seccomp=before_clone3.json -it --entrypoint /bin/bash eclipse-temurin:17-jdk # (should also fail with any ubuntu 22.04 really...)
root@e2a511de29d4:/# curl google.com
curl: (6) getaddrinfo() thread failed to start
root@e2a511de29d4:/#

Permanent fix:

• upgrade docker, or expect all newer, up-to-date base images to fail in the future

Mitigation/workaround:

• docker run --security-opt seccomp=your_policy_which_allows_clone3.json .... (docs)
• downgrade your (base) images (the -focal should stay available for some 2years, IF the maintainers of docker's official images wait for the next ubuntu LTS to drop ubuntu Focal/20.04)

[frankjkelly]

Can someone clarify why updating docker fixes this? Thanks!

[karianna]

Can someone clarify why updating docker fixes this? Thanks!

#215 (comment) explains it.