Debian Bug report logs - #1007022
podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Gabriel Filion <gabster@lelutin.ca>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Thu, 10 Mar 2022 13:40:49 -0500

Package: podman
Version: 3.4.4+ds1-1
Severity: normal

Hello,

I used to be able to run rootless container on debian sid maybe 3 months ago
(I'm sorry, I don't have much more precise information about versions when
things used to work), but now that I try and start containers again I am
consistently hitting errors of this form:

    $ podman run -d --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io
Error: OCI runtime error: unable to start container "0f2eb8afb9ce6eebbede769dc288e228ea6cbae0e76936672e6673228ac6862c": runc create failed: unable to start container process: can't get final child's PID from pipe: EOF

so no container will start at all in rootless mode

for information, the images required for running the containers were correctly
downloaded and are available locally.

I've tried to search for information about this online but the cause for this
particular error message can seemingly be very varied. The usual answers about
the user.max_user_namespaces kernel option, or memory allocation settings for
images/containers seem not to hold in this case.

if I run the container as root with:

    # sudo podman run -d --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io

then it's getting started as expected.

I'm not sure what additional information could be helpful, but I'm willing to
send more output from logs/commands to help out identify what's happening.

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.16.0-4-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_CA.utf8, LC_CTYPE=en_CA.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_CA.utf8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages podman depends on:
ii  conmon                           2.0.25+ds1-1.1
ii  containernetworking-plugins      1.1.0+ds1-1
ii  golang-github-containers-common  0.44.4+ds1-1
ii  init-system-helpers              1.62
ii  libc6                            2.33-7
ii  libdevmapper1.02.1               2:1.02.175-2.1
ii  libgpgme11                       1.16.0-1.2
ii  libseccomp2                      2.5.3-2
ii  runc                             1.1.0+ds1-1

Versions of packages podman recommends:
ii  buildah                                           1.23.1+ds1-2
ii  fuse-overlayfs                                    1.7.1-1
ii  golang-github-containernetworking-plugin-dnsname  1.3.1+ds1-2
ii  slirp4netns                                       1.0.1-2
ii  tini                                              0.19.0-1
ii  uidmap                                            1:4.11.1+dfsg1-2

Versions of packages podman suggests:
pn  containers-storage  <none>
ii  docker-compose      1.29.2-1
ii  iptables            1.8.7-1

-- Configuration Files:
/etc/cni/net.d/87-podman-bridge.conflist [Errno 13] Permission denied: '/etc/cni/net.d/87-podman-bridge.conflist'

-- no debconf information

Message #10 received at 1007022@bugs.debian.org (full text, mbox, reply):

From: Adam Williamson <awilliam@redhat.com>

To: 1007022@bugs.debian.org

Subject: Re: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Mon, 21 Mar 2022 18:25:33 -0700

Just reporting I found the same problem on Fedora 36. Filed here:
https://bugzilla.redhat.com/show_bug.cgi?id=2066527 .
-- 
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net

Message #21 received at 1007022@bugs.debian.org (full text, mbox, reply):

From: Gabriel Filion <gabster@lelutin.ca>

To: 1007022@bugs.debian.org

Subject: Re: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Sat, 16 Apr 2022 14:11:48 -0400

Hi,

On Mon, 21 Mar 2022 18:25:33 -0700 Adam Williamson <awilliam@redhat.com> 
wrote:
> Just reporting I found the same problem on Fedora 36. Filed here:
> https://bugzilla.redhat.com/show_bug.cgi?id=2066527 .

Thanks for this added information!

Following information from the redhat bug report, I've tried this on my 
computer which actually fixed the situation for me (so it is a workaround):

1. apt install crun
2. use podman to destroy my rootless containers
3. re-create the rootless containers and start them

The crun package was not installed, apparently because it's a 
"either/or" dependency for podman and "runc" was installed here.

Now I have both runc *and* crun installed. I don't know if I need both, 
but seeing as containers run as my non-root user as it currently is I 
won't change anything..

Cheers!

Message #26 received at 1007022@bugs.debian.org (full text, mbox, reply):

From: Arnaud Rebillout <arnaudr@kali.org>

To: 1007022@bugs.debian.org

Subject: Re: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Fri, 20 May 2022 09:47:06 +0700

I can reproduce it locally.

For background: I just setup a new machine, and I installed both 
docker.io and podman. Since docker.io depends on runc, and podman 
depends on crun|runc, only runc was installed.

The issue is fixed after installing crun manually (note that both runc 
and crun can be installed on the system, it doesn't seem to cause any 
issue).

Cheers,

Arnaud

Message #31 received at 1007022@bugs.debian.org (full text, mbox, reply):

From: Shengjing Zhu <zhsj@debian.org>

To: Gabriel Filion <gabster@lelutin.ca>, 1007022@bugs.debian.org, Adam Williamson <awilliam@redhat.com>, Arnaud Rebillout <arnaudr@kali.org>, Reinhard Tartler <siretart@tauware.de>

Subject: Re: Bug#1007022: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Sun, 19 Jun 2022 15:28:32 +0800

On Fri, Mar 11, 2022 at 2:51 AM Gabriel Filion <gabster@lelutin.ca> wrote:
>
> Package: podman
> Version: 3.4.4+ds1-1
> Severity: normal
>
> Hello,
>
> I used to be able to run rootless container on debian sid maybe 3 months ago
> (I'm sorry, I don't have much more precise information about versions when
> things used to work), but now that I try and start containers again I am
> consistently hitting errors of this form:
>
>     $ podman run -d --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io
> Error: OCI runtime error: unable to start container "0f2eb8afb9ce6eebbede769dc288e228ea6cbae0e76936672e6673228ac6862c": runc create failed: unable to start container process: can't get final child's PID from pipe: EOF
>

Can someone checks if you still fail to run rootless container with
runc and podman 4.1?

I think it's because
https://github.com/containers/podman/issues/13731, which is fixed in
podman 4.1.
And it's caused by systemd 250 which changes OOMScoreAdjust in user@.service

--
Shengjing Zhu

Message #36 received at 1007022@bugs.debian.org (full text, mbox, reply):

From: Gabriel Filion <gabster@lelutin.ca>

To: Shengjing Zhu <zhsj@debian.org>, 1007022@bugs.debian.org, Adam Williamson <awilliam@redhat.com>, Arnaud Rebillout <arnaudr@kali.org>, Reinhard Tartler <siretart@tauware.de>

Subject: Re: Bug#1007022: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Sun, 19 Jun 2022 13:48:25 -0400

Hi again,

On 2022-06-19 03:28, Shengjing Zhu wrote:
>> I used to be able to run rootless container on debian sid maybe 3 months ago
>> (I'm sorry, I don't have much more precise information about versions when
>> things used to work), but now that I try and start containers again I am
>> consistently hitting errors of this form:
>>
>>      $ podman run -d --name="draw" -p 8080:8080 -p 8443:8443 fjudith/draw.io
>> Error: OCI runtime error: unable to start container "0f2eb8afb9ce6eebbede769dc288e228ea6cbae0e76936672e6673228ac6862c": runc create failed: unable to start container process: can't get final child's PID from pipe: EOF
>>
> Can someone checks if you still fail to run rootless container with
> runc and podman 4.1?
> 
> I think it's because
> https://github.com/containers/podman/issues/13731, which is fixed in
> podman 4.1.
> And it's caused by systemd 250 which changes OOMScoreAdjust inuser@.service

For an added tidbit of information, I am under the impression that I 
need the "crun" package because of this configuration:

$ podman info
[...]
  ociRuntime:
    name: crun
    package: 'crun: /usr/bin/crun'
    path: /usr/bin/crun


Although I tried changing that by creating a file 
~/.config/containers/containers.conf with this:

[engine]
runtime = "runc"

and then I had to remove currently existing containers to recreate them.

and although "podman info" and "podman container inspect ..." show me 
that runc should now be used, I'm still getting the error above. So I 
don't know how to get containers to run with runc.


Is it possible that podman has changed its default runtime to crun? In 
this case, would it make more sense for the podman debian package to 
depend on crun by default instead of runc?

Message #41 received at 1007022@bugs.debian.org (full text, mbox, reply):

From: Arnaud Rebillout <arnaudr@kali.org>

To: 1007022@bugs.debian.org, Shengjing Zhu <zhsj@debian.org>

Cc: Gabriel Filion <gabster@lelutin.ca>

Subject: Re: Bug#1007022: podman: starting rootless container fails with: can't get final child's PID from pipe: EOF

Date: Mon, 20 Jun 2022 20:51:13 +0700

Hi Shengjing,

On Sun, 19 Jun 2022 15:28:32 +0800 Shengjing Zhu <zhsj@debian.org> wrote:
> Can someone checks if you still fail to run rootless container with
> runc and podman 4.1?
>
> I think it's because
> https://github.com/containers/podman/issues/13731, which is fixed in
> podman 4.1.
> And it's caused by systemd 250 which changes OOMScoreAdjust in 
user@.service

I just tried, and it seems that indeed, podman 4.1 fixes the issue. Here 
are the steps I followed:

1) I removed the package crun, so that I only have runc installed:

    $ sudo apt purge crun

2) From this point, I can reproduce the issue:

    $ podman run --rm -it kali-rolling
    Error: OCI runtime error: runc create failed: unable to start 
container process: can't get final child's PID from pipe: EOF

3) Now I install podman from experimental:

    $ sudo apt install -t experimental podman
    Get:1 http://deb.debian.org/debian experimental/main amd64 
golang-github-containers-common all 0.48.0+ds1-1 [34.5 kB]
    Get:2 http://deb.debian.org/debian experimental/main amd64 podman 
amd64 4.1.0+ds2-2 [9,997 kB]
    Get:3 http://deb.debian.org/debian experimental/main amd64 buildah 
amd64 1.26.1+ds1-1 [6,041 kB]

4) Tried to run podman rootless again:

    $ podman run --rm -it kali-rolling
    ┌──(root㉿633e94a0ebde)-[/]
    └─#

It works!

Thanks,

--
Arnaud Rebillout / Offensive Security / Kali Linux Developer

Message #52 received at 1007022-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1007022-close@bugs.debian.org

Subject: Bug#1007022: fixed in libpod 4.2.0+ds1-3

Date: Fri, 19 Aug 2022 08:35:14 +0000

Source: libpod
Source-Version: 4.2.0+ds1-3
Done: Reinhard Tartler <siretart@tauware.de>

We believe that the bug you reported is fixed in the latest version of
libpod, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1007022@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated libpod package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 19 Aug 2022 09:43:54 +0200
Source: libpod
Architecture: source
Version: 4.2.0+ds1-3
Distribution: experimental
Urgency: medium
Maintainer: Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1007022 1009376 1009747 1012053
Changes:
 libpod (4.2.0+ds1-3) experimental; urgency=medium
 .
   * Force using golang-go to avoid compilation failures with gcc-go
   * Confirmed updated components allow podman to work, thanks to
     Bastian Blank (Closes: #1012053), and is compiled against a
     containers/common that is more mindful regarding foreign-arch
     images (Closes: #1009376)
   * Confirmed fix: "starting rootless container fails with: can't get final
     child's PID from pipe: EOF", code change likely already in 4.1
     thanks to Gabriel Filion (Closes: #1007022).
   * Make podman recommend 'dbus-user-session', Closes: #1009747
Checksums-Sha1:
 f5c12b2b1c48bff91bfd8f3c39072865acd2227d 5165 libpod_4.2.0+ds1-3.dsc
 2cf38213403c79af777c22e9df70510f3e0ac4c0 15492 libpod_4.2.0+ds1-3.debian.tar.xz
Checksums-Sha256:
 09ec45ad17d3416e492c52fb46780de1bb47cc6ca326aee0b87f102b211f0a84 5165 libpod_4.2.0+ds1-3.dsc
 14af6fe30656a99af08d1bb5ba1326e26029d116b462b13686f1b71ed0215eec 15492 libpod_4.2.0+ds1-3.debian.tar.xz
Files:
 b4e5e4a321100a249aff7cd461db0d32 5165 admin optional libpod_4.2.0+ds1-3.dsc
 7782167080adddbf14ddf1736029e8e1 15492 admin optional libpod_4.2.0+ds1-3.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmL/QHIUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJsvjBhAAmanfOiEAr1mUnygdYUHqLDt5b9xm
diEWVCqtb7YRwDlk7r+PtAdxhnqA00Wk9nE9UPxh8f7mOfVh8gpyUugll22I5E43
Af4r84xm/8TXk5ekEVHBuf4R3ZeIGjBYbXSMW2HqtthNoFRjeSX60LJ09txFIe1C
62EJF9iOyH4dvFdjIGvsPE6bjvfEdRPiB4kINzw85DTRgOsdm3blqabycH9huYRz
LZN86gwAhLI45Zx8KNqvnCH/HTMtWEZynUhelBZ+2vqdDIj7iOkStTiTov0bQLh8
izv0gBIuq/wPIFbHmupgJAk6YYdCQCOQ3ftsNZQ8xJv4/9RIkKtbfZYdzhDm9Hjm
D+8MrcG18liKNlv1LWsD9Qi99OBjzqwmmwbH+nj08tgZSf0h66UjkaDN93+1+qI5
T23xf+NHA7VLSjwOp9XiMuNQI6KpTHJz4vO22/g09sNY2sjp6Sem2hMsdjTJRqmx
Jc0yw6bo8L2Q6gvtVVz2xX3sc9qFltyWte6A61x1ytQ26M2NHamQPfqCDwWi0zXB
BtoWFbDLPerIZ1gJsNS8bvUEqR4ne1GfjHVR/dxZmrt+Lmo2luxum6x7kpo16Qwi
C7NyE5owyANpH+AwkJbcJrj59pL1KUzP7L39LKmN/6sOnRd5KQj0x3mGuMV0AXEn
OCeDD93Egi1ax80=
=0XwB
-----END PGP SIGNATURE-----

Message #57 received at 1007022-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1007022-close@bugs.debian.org

Subject: Bug#1007022: fixed in libpod 4.3.1+ds1-4

Date: Thu, 24 Nov 2022 21:05:07 +0000

Source: libpod
Source-Version: 4.3.1+ds1-4
Done: Reinhard Tartler <siretart@tauware.de>

We believe that the bug you reported is fixed in the latest version of
libpod, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1007022@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Reinhard Tartler <siretart@tauware.de> (supplier of updated libpod package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Nov 2022 15:35:49 -0500
Source: libpod
Architecture: source
Version: 4.3.1+ds1-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <pkg-go-maintainers@lists.alioth.debian.org>
Changed-By: Reinhard Tartler <siretart@tauware.de>
Closes: 1000521 1001780 1003486 1006426 1007022 1009374 1009376 1009747 1012053 1014309 1019591 1019929
Changes:
 libpod (4.3.1+ds1-4) unstable; urgency=medium
 .
   * upload to unstable
 .
 libpod (4.3.1+ds1-3) experimental; urgency=medium
 .
   * debian/rules: make the previous change to build machine/qemu only
     on supported architecture actually work
 .
 libpod (4.3.1+ds1-2) experimental; urgency=medium
 .
   * Build machine/qemu only on amd64, arm64, fixes FTBFS
 .
 libpod (4.3.1+ds1-1) experimental; urgency=medium
 .
   * New upstream release
     - Add container GID to additional groups,
       fixes CVE-2022-2989, closes: #1019591
   * Bugfix: Subordinate UID/GID ranges not fetched from libsubid,
     Thanks to Sam Morris <sam@robots.org.uk> for the patch, closes: #1019929
 .
 libpod (4.2.0+ds1-3) experimental; urgency=medium
 .
   * Force using golang-go to avoid compilation failures with gcc-go
   * Confirmed updated components allow podman to work, thanks to
     Bastian Blank (Closes: #1012053), and is compiled against a
     containers/common that is more mindful regarding foreign-arch
     images (Closes: #1009376)
   * Confirmed fix: "starting rootless container fails with: can't get final
     child's PID from pipe: EOF", code change likely already in 4.1
     thanks to Gabriel Filion (Closes: #1007022).
   * Make podman recommend 'dbus-user-session', Closes: #1009747
 .
 libpod (4.2.0+ds1-2) experimental; urgency=medium
 .
   * tighten dependency on golang-github-opencontainers-runc-dev
 .
 libpod (4.2.0+ds1-1) experimental; urgency=medium
 .
   * New upstream release
   * drop patches merged upstream
   * add distro patch to use system 'goimports' utility
   * tighten dependencies
   * hooks/docs no longer provides section 5 manpages
 .
 libpod (4.1.1+ds1-3) experimental; urgency=medium
 .
   * reorganize dependencies for networking stack
 .
 libpod (4.1.1+ds1-2) experimental; urgency=medium
 .
   * organize GOLANG_EXCLUDES and GOLANG_TEST_EXCLUDES
   * add patches fix-test-TestEnvVarValue-NN.patch, fixes
     Test failures for !amd64, !arm64 Closes: #1014309
 .
 libpod (4.1.1+ds1-1) experimental; urgency=medium
 .
   * New upstream release
 .
 libpod (4.1.0+ds2-2) experimental; urgency=medium
 .
   * Avoid building podman/pkg/machine/e2e on all architectures
 .
 libpod (4.1.0+ds2-1) experimental; urgency=medium
 .
   * New upstream release
 .
 libpod (4.0.3+ds1-1) experimental; urgency=medium
 .
   [ Antonio Terceiro ]
   * Stop installing systemd socket units under /usr/lib, Closes: #1009374
 .
   [ Reinhard Tartler ]
   * New upstream release
   * Skip installation of podman-remote(1), Closes: #1000521
 .
 libpod (4.0.1+ds1-3) experimental; urgency=medium
 .
   * Fix installation of systemd units
 .
 libpod (4.0.1+ds1-2) experimental; urgency=medium
 .
   * Install rootlessport, Closes: #1006426
 .
 libpod (4.0.1+ds1-1) experimental; urgency=medium
 .
   * New upstream release
 .
 libpod (4.0.0~rc5+ds1-1) experimental; urgency=medium
 .
   * New upstream release, closes: #1003486
   * Bug fix: "podman-restart missing from podman package", thanks to Jelle
     van der Waa (Closes: #1001780).
Checksums-Sha1:
 ca9b1623f5a9a9e33c37913a06fa3f8230655bf0 5179 libpod_4.3.1+ds1-4.dsc
 77698ceb9d050c6d64d51043144ca404e658bc09 16580 libpod_4.3.1+ds1-4.debian.tar.xz
Checksums-Sha256:
 d94b5335ec4c78845479a444c2abb26e90e954665bf05f88ebc26b65847574be 5179 libpod_4.3.1+ds1-4.dsc
 7af6464fa5ae534dc4c87272fc6d13c9cee30119c215496e3d66f9d09daed28c 16580 libpod_4.3.1+ds1-4.debian.tar.xz
Files:
 cdea8370086c360bfc09eafff95929dd 5179 admin optional libpod_4.3.1+ds1-4.dsc
 0c5bcec672844fe4539490409e6580ae 16580 admin optional libpod_4.3.1+ds1-4.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmN/1iUUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJssA2BAAwq6CV1nwgqR7NPHYkfoHd5Wo47HP
/lg1Nm/aeujuSpZn+DCT0VeAW2fgw8HUo5mWIeufpxWD/3ojdJRCOhwN20DJen8/
o9tLjzhxIg3VZ+0vNVggKQymvDaQCtBpe40kadDFANUKCbjbenzTKXvkQYRvjNHD
7Prnj/JQnSrRqDyzAIJ7EFsRgcFUEgEZG2tM8ieWMAOzZIeVopTt6P7cnuKlr8T7
QQF+bl8gVwdglrkyrjC6gQbwZYP+VSYfJpvbxp5Bie/aMW+N6rq8NJT1V5/tE5WP
SZvyOq0HrEhNU/B+JguLOGREuRpHoRanmzoRe8YuUIydApJuvu3IjneqlGP3JLHJ
TR9m03lWkzfJYJfQi9l64gKXCJ6WxdLTF16NIpyKCIf5kQySCooF/jP4xBu+zl+Y
78v/kXZxpXYO5sCBXQ9WSQ+xdGmtA0vfvdHYcSAeG8QSAeBZrl2J0G0kjaRJRdRm
6r0BzzmQQS0nucryveHVPSTR8CMooRwajVhWB1nZBr+oODrHMFp5X5JDKHqeSWYG
anoj4QBFYJ2HX1rs1IRzQ3bbmBHEz7Rdflb9Wp20fjejTrfVKjBZEj8YqmJC4zv9
c2QqJbcg67cxr7tkRtnDjdRhyiWpDjm4PWc3i37INdA+TbeiFWVEFvXZgE8rh1YZ
sv7PqK8U0omyX6k=
=1IVQ
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.