[Bug 1214394] New: docker-io makes the hosts /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

            Bug ID: 1214394
           Summary: docker-io makes the hosts /sys directory read only
           Product: Fedora
           Version: rawhide
         Component: docker-io
          Severity: medium
          Assignee: ichavero(a)redhat.com
          Reporter: pwebster(a)ca.ibm.com
        QA Contact: extras-qa(a)fedoraproject.org
                CC: adimania(a)gmail.com, admiller(a)redhat.com,
                    golang(a)lists.fedoraproject.org, hushan.jia(a)gmail.com,
                    ichavero(a)redhat.com, jchaloup(a)redhat.com,
                    jperrin(a)centos.org, lsm5(a)redhat.com,
                    mattdm(a)redhat.com, mgoldman(a)redhat.com,
                    miminar(a)redhat.com, s(a)shk.io, thrcka(a)redhat.com,
                    vbatts(a)redhat.com



Description of problem:

I installed  docker-io on RHEL 6.6.  If I create a regular container, I
suddenly can no longer suspend my machine.  I tracked it down to the /sys
directory being mounted read-only on the host.  Bug 1094198 says that it should
be mounted read-only within the container if the container is run as
non-privileged, but that should not effect the host.

Version-Release number of selected component (if applicable):
docker-io-1.4.1-3.el6.x86_64
RHEL 6.6
kernel-2.6.32-504.12.2.el6.x86_64


How reproducible: 100%


Steps to Reproduce:
Start a docker container:
bash$ docker run -ti fedora:latest /bin/bash

Outside of docker, run as root:
[root@wspwebster log]# echo 7 > /sys/module/cpufreq/parameters/debug
-bash: /sys/module/cpufreq/parameters/debug: Read-only file system


Actual results:

fails to write to /sys anymore.  This effects other commands, like pm-suspend
(can't suspend my laptop anymore)

Expected results:

Should be able to write out to the /sys file system as root.


Additional info:
        Version: Intel(R) Core(TM) i7-3720QM CPU @ 2.60GHz
        Version: G5ET90WW (2.50 )
        Version: ThinkPad W530

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

Paul Webster <pwebster(a)ca.ibm.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|docker-io makes the hosts   |docker-io makes the host's
                   |/sys directory read only    |/sys directory read only



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

Alexander Kurtakov <akurtako(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |akurtako(a)redhat.com
          Component|docker-io                   |docker-io
            Version|rawhide                     |el6
            Product|Fedora                      |Fedora EPEL



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394



--- Comment #1 from Paul Webster <pwebster(a)ca.ibm.com&gt; ---
I got an upgrade to docker-io-1.5.0-1.el6.x86_64 but it made no difference.

PW

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

Jason Al-Mansor <jalmansor(a)gmail.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jalmansor(a)gmail.com



--- Comment #2 from Jason Al-Mansor <jalmansor(a)gmail.com&gt; ---
According to the docker issue on github this is fixed in 1.6.2:

https://github.com/docker/docker/commit/7c8fca2ddb58c8d2c4fb4df31c242886d...

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394



--- Comment #3 from Paul Webster <pwebster(a)ca.ibm.com&gt; ---
So  Bug 1094198 was fedora including a docker change, or fedora making a
change?

PW

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

Daniel Walsh <dwalsh(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |dwalsh(a)redhat.com
           Assignee|ichavero(a)redhat.com         |lsm5(a)redhat.com



--- Comment #4 from Daniel Walsh <dwalsh(a)redhat.com&gt; ---
Fixed in docker-1.6.2 I guess.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

Daniel Walsh <dwalsh(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |CLOSED
         Resolution|---                         |CURRENTRELEASE
        Last Closed|                            |2015-07-15 17:23:12



-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1214394] docker-io makes the host's /sys directory read only

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1214394

dsix.work(a)gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dsix.work(a)gmail.com



--- Comment #5 from dsix.work(a)gmail.com ---
I am still seeing this behavior in docker-io-1.7.1-2.el6.x86_64 on RHEL 6.7

Steps to reproduce:
1. Install docker
2. Start a container without --privileged
3. /sys in now mounted RO

# docker info
Containers: 10
Images: 179
Storage Driver: devicemapper
 Pool Name: docker-253:0-27395432-pool
 Pool Blocksize: 65.54 kB
 Backing Filesystem: extfs
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 8.951 GB
 Data Space Total: 107.4 GB
 Data Space Available: 98.42 GB
 Metadata Space Used: 10.13 MB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.137 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.95-RHEL6 (2015-07-29)
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 2.6.32-573.3.1.el6.x86_64
Operating System: <unknown>
CPUs: 2
Total Memory: 1.808 GiB
Name: -
ID: IHHZ:XJ2C:4JQL:AN6P:I7KG:7Y3P:FIEC:P5NK:QKSA:PTKR:CDHR:RILN

# docker version
Client version: 1.7.1
Client API version: 1.19
Go version (client): go1.4.2
Git commit (client): 786b29d/1.7.1
OS/Arch (client): linux/amd64
Server version: 1.7.1
Server API version: 1.19
Go version (server): go1.4.2
Git commit (server): 786b29d/1.7.1
OS/Arch (server): linux/amd64

-- 
You are receiving this mail because:
You are on the CC list for the bug.