dind-rootless fails

[mo-saeed]

Hello,

Am trying to run dind-rootless image but the container fails with this error

[rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 117 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted

[wglambert]

Can you give all the commands you ran and any relevant files or logs for reproducing the issue

[mo-saeed]

Hi @wglambert I am using kubernetes, so preparing a deployment file with this image but the pod keep restarting throwing the above error
kubernetes: EKS 1.19.6

[mo-saeed]

Here's the full log from the pod:

Generating RSA private key, 4096 bit long modulus (2 primes)
..................................................................................................................................................................................................................................++++
....................................++++
e is 65537 (0x010001)
Generating RSA private key, 4096 bit long modulus (2 primes)
................................................................................................................................................++++
........................++++
e is 65537 (0x010001)
Signature ok
subject=CN = docker:dind server
Getting CA Private Key
/certs/server/cert.pem: OK
Generating RSA private key, 4096 bit long modulus (2 primes)
...............................................................................................++++
........................................++++
e is 65537 (0x010001)
Signature ok
subject=CN = docker:dind client
Getting CA Private Key
/certs/client/cert.pem: OK
[rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 50 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted
: exit status 1

[mo-saeed]

Here's also the simple pod

apiVersion: v1
kind: Pod
metadata:
  name: test-dind-rootless
  labels:
    role: myrole
spec:
  containers:
    - name: dind-rootless
      image: docker:dind-rootless
~

[wglambert]

#291 (comment)

You still need --privileged #151 (comment)

You'll also want the command set to --experimental for dockerd#281 (comment)
As of 20.10.x --experimental is no longer needed moby/moby#40759

[mo-saeed]

Thanks @wglambert now it runs but I can't run for example docker ps with this error Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json: dial unix /var/run/docker.sock: connect: permission denied

[wglambert]

Ah yeah, you'll also want to specify a couple environment variables. Here's a working pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: test-dind-rootless
  labels:
    role: myrole
spec:
  containers:
    - name: dind-rootless
      image: docker:dind-rootless
      securityContext:
        privileged: true
      env:
      - name: DOCKER_TLS_CERTDIR
        value: "/certs"
      - name: DOCKER_HOST
        value: "unix:///run/user/1000/docker.sock"

$ kubectl apply -f pod.yaml
pod/test-dind-rootless created

$ kubectl exec -it test-dind-rootless -- ash
/ $ docker ps
CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES

/ $ docker pull ubuntu
Using default tag: latest
latest: Pulling from library/ubuntu
5d3b2c2d21bb: Pull complete
3fc2062ea667: Pull complete
75adf526d75b: Pull complete
Digest: sha256:b4f9e18267eb98998f6130342baacaeb9553f136142d40959a1b46d6401f0f2b
Status: Downloaded newer image for ubuntu:latest
docker.io/library/ubuntu:latest

[mo-saeed]

Hello @wglambert Thanks

Maybe you can help with the next issue :(

now when i am trying docker run hello-world i get this error

docker: Error response from daemon: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:338: getting the final child's pid from pipe caused: EOF: unknown.
ERRO[0000] error waiting for container: context canceled

It seems to be known issue, have a look here moby/moby#40068 (comment)