2

I have an LXC container running docker. Many containers are running successfully but I am unable to add more; I am trying to deploy a new docker container and getting the following error:

container init caused "join session keyring: create session key: disk quote exceeded": unknown

But the container has plenty of free space, as does the host. I confirmed this with df -h and df -i (so, it's not inodes)

What does this error mean and how is it resolved?

2 Answers 2

5

It's not the root filesystem that's the issue here, it's the kernel keyring. This LXC thread explains it well, and has the following solution: on the LXC host (not inside the LXC container), raise the maximum number of keys with:

echo 5000 | sudo tee /proc/sys/kernel/keys/maxkeys

5000 is admittedly arbitrary; select a number that's greater than what you have now.

Quoting Stéphane Graber, maintainer of LXD, from the thread:

Kinda sounds like Docker may be attempting to use the kernel keyring? That’d certainly be a new behavior from them…

and credit to simos also from that thread for the provided command, which resolved this for me.

Further reference on GitHub

4

To add to @Josh's answer. To make this change persist after a reboot you can create a file under /etc/sysctl.d with the updated kernel value

# /etc/sysctl.d/99-custom.conf
kernel.keys.maxkeys=2000

If you are starting a lot of nested containers or unprivileged containers, then you may start to have a lot of processes owned by your mapped user, e.g., UID 1000000.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .