podman containers won't start after F36 upgrade

[Clemens Eisserer]

HI there,

I've just recently upgraded from F35->F36 and now podman containers don't
start anymore.
When starting a container which was created with F35 as user, I just get:

Error: OCI runtime error: unable to start container
"0a4d835ccc0777ccf77bc61976c32d9c3fbbf32c18902f0a2043a0
12d5fed598": runc: runc create failed: unable to start container process:
can't get final child's PID from
pipe: EOF

It is a bit unfortunate I need the containers as they are, so I can't
simply recreate them.
I've tried to solve the problem by installing crun and making sure runc is
installed, however nothing helped-

Any idea what could be the problem?

Thank you in advance, Clemens

[Daniel Walsh]

On 5/22/22 03:09, Clemens Eisserer wrote:
> HI there,
>
> I've just recently upgraded from F35->F36 and now podman containers 
> don't start anymore.
> When starting a container which was created with F35 as user, I just get:
>
> Error: OCI runtime error: unable to start container 
> "0a4d835ccc0777ccf77bc61976c32d9c3fbbf32c18902f0a2043a0
> 12d5fed598": runc: runc create failed: unable to start container 
> process: can't get final child's PID from
> pipe: EOF
>
> It is a bit unfortunate I need the containers as they are, so I can't 
> simply recreate them.
> I've tried to solve the problem by installing crun and making sure 
> runc is installed, however nothing helped-
>
> Any idea what could be the problem?
>
> Thank you in advance, Clemens
>
> users mailing list [e-mail]
> To unsubscribe send an email [e-mail]
> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure

Are you seeing the SELinux AVC error?  Does this work if you put your 
machine into permissive mode?

[Clemens Eisserer]

Hi Daniel,

Thanks for your hint :)
> Are you seeing the SELinux AVC error?  Does this work if you put your
> machine into permissive mode?

I am running with SELINUX=disabled, so I guess this is not caused by
selinux.

I've now discarded all the old containers that were not able to start -
however it is a bit unfortunate, the error message was so useless in
debugging the root cause.
I really tried searching on various mailing list archives for ~2 hours and
that error seems completly ambigous with many causes.

Thanks & best regards, Clemens

[Daniel Walsh]

On 5/24/22 07:50, Clemens Eisserer wrote:
> Hi Daniel,
>
> Thanks for your hint :)
> Are you seeing the SELinux AVC error?  Does this work if you put
> your machine into permissive mode?
>
> I am running with SELINUX=disabled, so I guess this is not caused by 
> selinux.
>
> I've now discarded all the old containers that were not able to start
> however it is a bit unfortunate, the error message was so useless in
>
> debugging the root cause.
> I really tried searching on various mailing list archives for ~2 hours 
> and that error seems completly ambigous with many causes.
>
> Thanks & best regards, Clemens

Sorry this broke, I have no idea what could cause the issue, other then 
SELinux upgrade issue.  If you are running lots of containers in 
production, I would really encourage you to enable SELinux, BTW.

[Barry]

> On 24 May 2022, at 12:58, Clemens Eisserer  wrote:
>
> 
> Hi Daniel,
>
> Thanks for your hint :)
> > Are you seeing the SELinux AVC error?  Does this work if you put your machine into permissive mode?
>
> I am running with SELINUX=disabled, so I guess this is not caused by selinux.

Containers have be run with selinux in the same mode as used to create them.
Did you create the contain with selinux enabled?

I hit this issue and it had very confusing error messages.
Folks on the pod and list helped diagnose this in my case.

Barry
> I've now discarded all the old containers that were not able to start - however it is a bit unfortunate, the error message was so useless in debugging the root cause.
> I really tried searching on various mailing list archives for ~2 hours and that error seems completly ambigous with many causes.
>
> Thanks & best regards, Clemens
> _______________________________________________
> users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure