Questions tagged [container]
191
questions
0
votes
1answer
13 views
lxc containers can ping host and can resolve dns internet addresses but cannot get to the internet
Debian Buster amd64
Two containers, 192.168.122.2,3 both can resolve but cannot get to the Internet
Both containers can ping / interact with the host server.
Here is what I have in iptables.
# ...
0
votes
0answers
21 views
Using SSH terminal (stdio) as a tunnel for mongo (-L option not allowed)
Here's the thing:
a mongodb client on the client machine
a SSH terminal on a jump machine
the mongodb server on the target machine
I would like the client to connect to the server through the jump ...
0
votes
1answer
26 views
What can happen if you rm -rf a systemd-nspawn container directory from host while running?
I was running a systemd-nspawn container with command:
systemd-nspawn --console=passive -qbUD container-directory 2>&1 >/dev/null &
to provide a clean build environment. While cleaning ...
0
votes
1answer
15 views
What is the relation between CAP_NET_RAW and net.ipv4.ping_group_range?
I am using rootless containers, according to the buildah docs,
Moreover, pinging from a rootless container does not work because it lacks the CAP_NET_RAW security capability that the ping command ...
0
votes
2answers
22 views
What is the effect of a symlink in a buildah mount?
If I run a buildah script like this,
ctr=$(buildah from alpine:3)
mnt=$(buildah mount "$ctr")
ln -sf "$PWD/foo" "$mnt/foo"
buildah commit $ctr "myimage"
Will ...
1
vote
1answer
14 views
Command executing outside container with lxc-attach?
I am trying to do a more complicated task inside a running lxc ubuntu container, but my problem can be explained using this simple example. When I run
sudo lxc-attach -n container1 -- echo "test&...
0
votes
0answers
6 views
Why is the filesystem tree view after nsenter different from that after unshare+pivot_root?
I've encountered a problem while trying to make a mount namespace with a different root filesystem using the tools unshare, pivot_root, and nsenter.
Say the top-level of a Linux machine's filesystem ...
0
votes
1answer
56 views
lxc-start tells me apparmor_parser not available even though apparmor is installed and running
System:Debian Testing (Bullseye)
I am trying to get an LXC container up and running as per here, however, when I get to lxc-start -n my-container -d I get the following:
$ lxc-start -n test1 -d
lxc-...
1
vote
1answer
59 views
Why I mount --bind --make-private /etc/hosts in new namespace, modification of this file with vim in old namespace will also affect the new ns?
I want to create a new namespace with a different /etc/hosts, so I tried to use mount --bind with unshare to create it as referenced in this answer: https://unix.stackexchange.com/a/242830/271204
# ...
0
votes
0answers
21 views
File changes made during execution of shell script on overlay filesystem are not visible before the shell script exits?
I have been experimenting with Docker and how some of the options of docker run ..., e.g. --privileged, may be abused for container-to-host escapes.
The following cgroup_escape.sh script abuses the ...
0
votes
1answer
29 views
Linux bridge does not forward packets to TAP interface
I have the following scenario where I run a Docker container which has configured inside of it a Linux bridge br0 and attached to it I have the main interface eth0 of the container and a TAP interface ...
0
votes
0answers
70 views
CloudLinux 7 with Docker - problem with cgroup devices.list
I have server with CloudLinux and I am trying to run Docker. I installed Docker Engine using official docs for CentOS (https://docs-stage.docker.com/engine/install/centos/).
Docker version 20.10.2, ...
0
votes
2answers
45 views
Do any of the common Linux utilities allow changing to arbitrary UID given CAP_SETUID?
I sometimes have the need to change my UID to arbitrary value when testing user namespace functionality.
Currently, I do something like:
useradd -u <uid> testuser
su testuser
userdel testuser
I ...
1
vote
0answers
29 views
When NFS Client try to create a file on shared folder, operation not permitted occurs, both server and client are in containers
I've googled a lot and found some similar cases. However, none of them works in my case. Not sure if it has something to do with Mac.
I will try to describe my question as clearly as possible.
I use ...
1
vote
0answers
9 views
Docker process showing only on Ubuntu 18.04 but not Hyper Terminal
I usually use my Hyper terminal for programming purposes, which should be the same (uses WSL 2) as my Ubuntu 18.04 WSL 2.
I can run the same docker commands on them, but for some reason when docker is ...
0
votes
0answers
9 views
Distributed Filesystem for container instances like MySQL/Mariadb
I'm looking for a suitable distributed POSIX compatible replicated block filesystem as the persistent volume for DB container instances.
My first intent was to use GlusterFS, but according to the ...
0
votes
1answer
121 views
cgroups v2: cgroup controllers not delegated to non-privileged users on CentOS Stream (8)
I am currently trying to configure my more or less fresh installation of CentOS Stream (8) to delegate cgroup controllers to non-privileged users. However, I fail at this and I've searched the web for ...
0
votes
0answers
34 views
Use adb (android debug bridge) in systemd-nspawn container
I would like to use adb inside an systemd-nspawn container. Unfortunately I cannot access the phone inside the container (connected via USB).
pi@debian-buster-64:~ $ export ADB_TRACE=usb
pi@debian-...
0
votes
1answer
27 views
Can I run a virtual machine or like a linux shell in a webapp/website or host it on a webserver?
I asked this question before and I am going to refine it so I can get a better answer.
I am planning to make a java webapp and I want to add a feature to it which is what I need help with.
I want to ...
0
votes
0answers
23 views
Is a root shell any different from a container with CAP_SYS_ADMIN and bind mount to /?
If I start podman in the highly insecure mode,
sudo podman run -ti \
-v /:/:bind \
--cap-add=cap_sys_admin \
alpine:3 \
/bin/sh
Is there any way ...
0
votes
2answers
157 views
How to debootstrap Centos?
Is there a way to create a Centos system inside a chroot using something similar to debootstrap for Debian/Ubuntu? I’d need it for a container project where Docker is NOT a solution(I’d use systemd ...
0
votes
0answers
63 views
How can I embed linux virtual machines in a website or a webapp?
I am planning to start a project to build a webapp, and I had an idea that I have seen in many places.
I have seen some websites where they have a linux virtual machine and a bash terminal is embedded ...
-1
votes
1answer
61 views
docker import loses the image's name, repository, and tag
When I export an image with
podman save --format oci-archive -o /tmp/image-oci.tar localhost/foobar-centos-7:92
Or,
podman save --format docker-archive -o /tmp/image-docker.tar localhost/foobar-...
1
vote
1answer
43 views
What are “container-tools” and what does disabling them achieve?
The buildah docs for installation mention,
sudo dnf -y module disable container-tools
Interestingly, the advice for RHEL 8 BETA is to enable them
sudo yum module enable -y container-tools:1.0
What ...
1
vote
2answers
122 views
What does it mean for a container to have a running state?
When I run podman create followed by podman exec, I'm told that my container state is not running,
$ ctr=$(podman create alpine:3)
dc63e5975a918485b3d6a0ddf90576213b02d00e15fd84bab97732cf6d1f885a
$ ...
0
votes
0answers
13 views
iptables: package got ACCEPT when exceeding the rate-limit
I'm trying to create rate limit for number of connection to server.
to do so I created RATE-LIMIT chain and added a rule to ACCEPT chain which direct new connections to this chain
iptables --new-...
0
votes
0answers
31 views
systemd-tmpfiles: Failed to create directory or subvolume “/tmp”: Function not implemented
Why does this error get generated in a container?
# /usr/bin/systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev
Failed to create directory or subvolume "/tmp": Function not ...
0
votes
1answer
45 views
creating FreePBX lxd container image from virtualbox instance
I needed a freepbx lxd image for some test, and since I didn't find it in public image servers (well, default images: one and google search but nothing, I think for licence's issues but don't really ...
0
votes
1answer
23 views
Is there a way to expose ports after a container is running?
Podman gives a mechanism to expose ports with
--expose=port Expose a port, or a range of ports (e.g. --expose=3300-3310) to set up port redirection on the host system.
Is there a mechanism to set ...
0
votes
1answer
48 views
Container runs systemd, what's the easiest way to execute a script that uses systemd?
I have a container that runs systemd, the setup instructions followed can be found at
Dockerfile for systemd base image
Now I have a script install.sh which I need to run in the build phase over the ...
0
votes
1answer
93 views
Podman vs Buildah: buildah from, run, and commit -versus- podman run, exec, and commit?
It seems we have the workflow to launch a container, and run commands inside of it, and commit it.
buildah-from - Creates a new working container, either from scratch or using a specified image as a ...
1
vote
1answer
63 views
create custom profile to run man using firejail
I'm trying to use firejail (version 0.9.58.2) for application sandboxing on my Debian Stable machine. From what I understand it's possible to create a custom configuration file for each application ...
0
votes
0answers
28 views
Setting security extended file attribute in nspawn returns “Operation not permitted”
I have built an nspawn container. It starts with the -U (--private-users) option, so creates a user namespace. setfattr -n security.NTACL from the container returns Operation not permitted. The same ...
2
votes
1answer
108 views
Why can't Wine run kernel-mode (ring 0) drivers in a container?
I'm not extremely familiar with systems programming or operating systems, so this is probably a stupid question. But I was trying to get a game running in Wine recently that implements an anti-cheat ...
1
vote
0answers
320 views
How to disable X11 extension (MIT-SHM) for systemd-nspawn container?
X Error of failed request: BadValue (integer parameter out of range for operation)
Major opcode of failed request: 130 (MIT-SHM)
Minor opcode of failed request: 3 (X_ShmPutImage)
Value in ...
1
vote
0answers
77 views
How to pass environment variables to systemd-nspawn container?
$ systemd-nspawn -bUM $container -E DISPLAY="$DISPLAY"
> (...)
$ cat /proc/1/environ
> (...) DISPLAY=:0
But echo $DISPLAY outputs nothing, since the variable is passed to systemd ...
2
votes
1answer
471 views
Do docker container cause slow Disk/OS performance
We have 3 servers, each of which are running RHEL 7.6. Each machine has 64G of RAM and 15 CPUs.
We are preparing to install a set of services --- kafka, zookeeper, schema registry --- on all of the ...
0
votes
1answer
291 views
Running a process under systemd init for containerization?
Docker provides for the ability to run a command when the container starts. This is specified with CMD in the Dockerfile.
However, if I want my container to start with systemd I have to use,
CMD [&...
4
votes
1answer
781 views
Docker container shows, “sleep: cannot read realtime clock: Operation not permitted”
When I run apt-get dist-upgrade in Docker container, I'm getting,
Unpacking libc6:i386 (2.31-1) over (2.30-8) ...
Setting up libc6:i386 (2.31-1) ...
Checking for services that may need to be restarted....
0
votes
0answers
19 views
I'm having a bit of trouble with logging in, help please
I am just starting to learn Linux Beta on my Chromebook, and it seems that I cannot access an account at all.
I have used this command:
vmc start termina
and then attempted to login using commands
...
0
votes
0answers
53 views
How does Linux NFS4 client map a user name to a uid in unshared namespaces?
NFS4 maps a user name to a uid with nfsidmap, which answers request_key() upcall from the kernel. My question is how the kernel associates a mount point to this executable. Specially,
How does the ...
0
votes
1answer
79 views
How does docker prevent root from reading from block device?
I'm trying to understand Linux container security. I have a docker container running with a root shell in it. The container does not have block devices visible in /dev, but I can create them with ...
0
votes
0answers
119 views
Docker Run error | ValueError: Unable to configure handler u'sys-logger': [Errno 2] No such file or directory
Traceback (most recent call last):
File "main.py", line 189, in <module>
logging_module = LoggingModule(os.path.join(service_dir, "logging_conf.json"))
File "/home/otisuser/db_inserter/...
1
vote
1answer
26 views
Containerised Postfix treating External e-mails as Internal e-mails
I have an iRedMail Mail Server running in an LXD container. Unfortunately, all e-mail is currently treated as internal e-mail, effectively making it an openrelay.
Container host
VPS, with its own ...
0
votes
2answers
125 views
how to remove docker with yum or any other approach
today we installed docker with the following rpm's ( 32 rpm's ) , on rhel 7.2
rpm -qa --last|more
libselinux-devel-2.5-15.el7.x86_64 Sun 10 May 2020 07:03:31 AM UTC
libselinux-2.5-15.el7....
1
vote
1answer
287 views
how to installed the latest docker version without dependencies issues
We prepare the following in order to install docker on rhel 7.5 version
( from the list https://download.docker.com/linux/centos/7/x86_64/stable/Packages/ ) , and only the latest
curl https://...
1
vote
0answers
314 views
Very high “hidden” memory usage inside a LXC container
We have a Proxmox VE (kernel 5.3) cluster running some IT services using LXC, one of which is used as a gateway for the whole intranet. It's set up with a Debian image and does forwarding & NAT ...
1
vote
0answers
186 views
Not able to setup cluseter in kubernets
I am trying to setup a cluster using kubernetes on centos 7 VM's and stuck on the part to join worker to the cluster.
I have managed to setup the master and get the token, i added the token onto the ...
0
votes
0answers
42 views
How do I set “visible” CPU and memory for a container?
I wrote a simple container in C as described in this article (not affiliated) and it works well. The container has mount, UTS, IPC, PID and cgroup namespace separated (via clone(2)).
There's one ...
0
votes
1answer
616 views
How to grant read/write access through SELinux policy to a bind-mounted volume via rootless podman play kube?
I recently switched from Docker to Podman and created a Kubernetes compliant pod definition yaml file.
The definition is loaded successful using rootless podman play kube command, then, declared Pod ...
