Centos: fn start : mounting none on /sys/kernel/security failed: Permission denied - linux

After installing fn from https://github.com/fnproject/fn
I run "fn start" as root
I get the following error
[root#localhost my-docker-app]# fn start
sh: overlay: unknown operand
mount: mounting none on /sys/kernel/security failed: Permission denied
Could not mount /sys/kernel/security.
AppArmor detection and --privileged mode might break.
mount: permission denied (are you root?)
time="2017-10-07T09:42:36Z" level=error msg="couldn't ping db" error="unable to open database file" url=/app/data/fn.db
time="2017-10-07T09:42:36Z" level=fatal msg="Error initializing datastore." error="unable to open database file"
2017/10/07 11:42:37 error: proce
ssed finished with error exit status 1
any help?
Centos version and fn version
[root#localhost my-docker-app]# cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"
CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"
[root#localhost my-docker-app]# fn version
Client version: 0.4.7
ERROR: Get http://localhost:8080/version: dial tcp [::1]:8080: getsockopt: connection refused
[root#localhost my-docker-app]#

You need to Disable Security-Enhanced Linux (SELinux), Its caused due to this.
Issue the below command as root for temporaryly disable selinux
$ setenforce 0
OR
vi /etc/sysconfig/selinux
Change the value of SELINUX as below
SELINUX=disabled
reboot

Related

nginx: [emerg] socket() 0.0.0.0:80 failed (13: Permission denied) on Docker

Summing up: It run in my Windows, however not in my Linux Deepin (I'm meeting this world).
After install the docker CE and docker compose, I can't run anything web server, apache and nginx. In this case I'm using nginx, but without success.
$ docker-compose up
Starting php_php_1 ... done
Starting php_nginx_1 ... done
Attaching to php_nginx_1, php_php_1
nginx_1 | 2019/04/19 19:09:56 [emerg] 1#1: socket() 0.0.0.0:80 failed (13: Permission denied)
nginx_1 | nginx: [emerg] socket() 0.0.0.0:80 failed (13: Permission denied)
php_1 | [19-Apr-2019 19:09:57] ERROR: failed to create new listening socket: socket(): Permission denied (13)
php_1 | [19-Apr-2019 19:09:57] ERROR: failed to create new listening socket: socket(): Permission denied (13)
php_1 | [19-Apr-2019 19:09:57] ERROR: FPM initialization failed
php_1 | [19-Apr-2019 19:09:57] ERROR: FPM initialization failed
php_nginx_1 exited with code 1
php_php_1 exited with code 78
Note: When I installed I have runned it below before and I did logout
$ sudo groupadd docker
$ sudo usermod -aG docker $USER
$ sudo chmod +x /lib/systemd/system/docker.socket
Even though I don't have anything in my port :80.
netstat --listen | grep :80
I followed this topic 33650820 and without success
After hours, I got... only disable AppArmor on Linux Deepin.
$ sudo mkdir -p /etc/default/grub.d
$ echo 'GRUB_CMDLINE_LINUX_DEFAULT="$GRUB_CMDLINE_LINUX_DEFAULT apparmor=0"'
| sudo tee /etc/default/grub.d/apparmor.cfg
$ sudo update-grub
$ sudo reboot

Failed to connect to containerd: failed to dial

Just installed Docker CE following official instructions with the repository in Ubuntu 14.04
Installation went successfully, the daemon is running
$ ps aux | grep docker
[...] /usr/bin/dockerd --raw-logs [...]
My user is in the docker group:
$ groups
[...] docker
The cli can't seem to communicate (same with sudo)
$ docker ps
Cannot connect to the Docker daemon at unix:///var/run/docker.sock.
Is the docker daemon running?
The socket seems to have the correct permissions:
$ ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Feb 4 16:21 /var/run/docker.sock
The log seems to claim about some issues though
$ sudo tail -f /var/log/upstart/docker.log
Failed to connect to containerd: failed to dial "/var/run/docker/containerd/docker-containerd.sock": dial unix:///var/run/docker/containerd/docker-containerd.sock: timeout
/var/run/docker.sock is up
time="2018-02-04T16:22:21.031459040+01:00" level=info msg="libcontainerd: started new docker-containerd process" pid=17147
INFO[0000] starting containerd module=containerd revision=89623f28b87a6004d4b785663257362d1658a729 version=v1.0.0
INFO[0000] setting subreaper... module=containerd
containerd: invalid argument
time="2018-02-04T16:22:21.056685023+01:00" level=error msg="containerd did not exit successfully" error="exit status 1" module=libcontainerd
Any advice to make this work ?
Relog and Docker restart already done of course
As #bobbear suggested and is actually mentioned in the official doc one of the prerequisites is:
Version 3.10 or higher of the Linux kernel. The latest version of the kernel available for you platform is recommended.
After having checked my Kernel version:
$ uname -a
Linux [...] 3.2.[...]-generic [...]-Ubuntu [...] x86_64
I searched for candidates:
$ apt-cache search linux-image
And installed my new_kernel:
$ sudo apt-get install \
linux-image-new_kernel \
linux-headers-new_kernel \
linux-image-extra-new_kernel
Same situation happend on me. IS because your linux kernel version too low !!! check it use command "uname -r" , if the version below "3.10" (for example: debian 7 whezzy default version is 3.2 ) ,even you install docker-ce suceessfully, you will still can not start docker daemon success.That why! All most answers on the web tell you to 'restart' bla bla bla... but they did not consider this problem.

Remote LLDB debugging - Docker container

I'm trying to set up a remote debugging with LLDB 4.0.1.
There's a docker (17.06.0-ce) container with Arch linux.
Docker container is set in privileged mode, so now LLDB can be started in container.
Container contains core_service which is Rust executable.
Commands run inside container
(lldb) target create target/debug/core_service
Current executable set to 'target/debug/core_service' (x86_64).
(lldb) process launch
Process 182 launched: '/srv/core_service/target/debug/core_service' (x86_64)
Problem exists with remote debugging, lldb-server is started inside container with lldb-server platform --server --listen 0.0.0.0:1234.
I can connect from host lldb to container lldb-server, but I can't attach/create processes.
Commands run on host (lldb-server in container = localhost:1234)
(lldb) platform select remote-linux
Platform: remote-linux
Connected: no
(lldb) platform connect connect://localhost:1234
Platform: remote-linux
Triple: x86_64-*-linux-gnu
OS Version: 4.12.4 (4.12.4-1-ARCH)
Kernel: #1 SMP PREEMPT Fri Jul 28 18:54:18 UTC 2017
Hostname: 099bd76c07c9
Connected: yes
WorkingDir: /srv/core_service
(lldb) target create target/debug/core_service
Current executable set to 'target/debug/core_service' (x86_64).
(lldb) process launch
error: connect remote failed (Connection refused)
error: process launch failed: Connection refused
How can I fix it? Are there any docker, arch linux settings that would cause this error?
It seems, like there's some problem with lldb-server permissions in docker container.
Commands run on host (lldb-server in container)
(lldb) platform shell ps -A
PID TTY TIME CMD
1 ? 00:00:00 bash
9 ? 00:00:00 nginx
10 ? 00:00:00 nginx
11 ? 00:00:00 lldb-server
25 ? 00:00:00 core_service
59 ? 00:00:00 lldb-server
68 ? 00:00:00 ps
(lldb) platform shell kill -9 25
(lldb) platform process launch target/debug/core_service
error: connect remote failed (Connection refused)
error: Connection refused
(lldb) platform process launch anything
error: connect remote failed (Connection refused)
error: Connection refused
But I can't figure out what can it be. lldb-server is run as root in container, I can execute shell commands using lldb.
There is needed both platform port (1234 in your case) and gdbserver port (randomly generated by default). You can enforce the gdbserver port by lldb-server option --gdbserver-port.
Tested on Fedora 29 x86_64:
docker run --privileged -p 5000:5000 -p 5001:5001 fedora bash -c 'dnf -y install lldb;lldb-server platform --server --listen 0.0.0.0:5000 --gdbserver-port 5001'
and
echo 'int main(){}' >main.c;gcc -g -o main main.c;lldb -o 'platform select remote-linux' -o 'platform connect connect://localhost:5000' -o "target create ./main" -o 'b main' -o 'process launch'
(lldb) process launch
Process 45 stopped
* thread #1, name = 'main', stop reason = breakpoint 1.1
frame #0: 0x000000000040110f main`main at main.c:1
-> 1 int main(){}
Process 45 launched: '/root/main' (x86_64)
(lldb) _
This may be because the server cannot see any process on the host. It is still wrapped in its own PID namespace. When you launch the LLDB server, use a host pid name space
docker run --pid=host --privileged <yourimage>
Hopefully this will allow your container see all the host processes

dockerd: Error running deviceCreate (CreatePool) dm_task_run failed

I'm building some CentOS VM with VMWare, with no access to internet, so I've downloaded and made local repositories, including this one
Then I have installed docker-engine.x86_64, and when starting the docker daemon, I get the following errors :
[root]# dockerd
DEBU[0000] docker group found. gid: 993
...
...
DEBU[0001] Error retrieving the next available loopback: open /dev/loop-control: no such device
ERRO[0001] **There are no more loopback devices available.**
ERRO[0001] [graphdriver] prior storage driver "devicemapper" failed: loopback attach failed
DEBU[0001] Cleaning up old mountid : start.
FATA[0001] Error starting daemon: error initializing graphdriver: loopback attach failed
After manually add the loop module which control loop device with this command :
insmod /lib/modules/3.10.0-327.36.2.el7.x86_64/kernel/drivers/block/loop.ko
The error changes to :
[graphdriver] prior storage driver "devicemapper" failed: devicemapper: Error running deviceCreate (CreatePool) dm_task_run failed
I've read that it could be because I have not enough space disk, I think it's not that, any idea?
[root]# df -k .
Filesystem blocs de 1K Used Available Used Mounted on
/dev/mapper/centos-root 51887356 2436256 49451100 5% /
I got the "There are no more loopback devices available" error, which stopped dockerd from running.
I fixed it by ensuring the storage driver was 'overlay':
# /usr/bin/dockerd -D --storage-driver=overlay
This was on Debian Jessie and docker running as a systemd service/unit.
To make it permanent, I created a systemd drop-in:
$ cat /etc/systemd/system/docker.service.d/docker.conf
[Service]
ExecStart=
ExecStart=/usr/bin/dockerd -H fd:// --storage-driver=overlay

Faillure to launch docker on OSX Yosemite

I'm having troubles to install Docker on Mac OS X Yosemite (10.10.4): when I try with the Docker Quickstart Terminal from the Docker Toolbox I get this:
. '/Applications/Docker/Docker Quickstart Terminal.app/Contents/Resources/Scripts/start.sh'
bash-3.2$ . '/Applications/Docker/Docker Quickstart Terminal.app/Contents/Resources/Scripts/start.sh'
Creating Machine default...
executing: /usr/local/bin/VBoxManage
STDOUT: Oracle VM VirtualBox Command Line Management Interface Version 5.0.2
(C) 2005-2015 Oracle Corporation
All rights reserved.
Usage:
VBoxManage [<general option>] <command>
STDERR:
Creating VirtualBox VM...
Creating SSH key...
Creating disk image...
Creating 20000 MB hard disk image...
Converting from raw image file="stdin" to file="/Users/arbi/.docker/machine/machines/default/disk.vmdk"...
Creating dynamic image with size 20971520000 bytes (20000MB)...
executing: /usr/local/bin/VBoxManage createvm --basefolder /Users/arbi/.docker/machine/machines/default --name default --register
STDOUT: Virtual machine 'default' is created and registered.
UUID: e0f2a54b-b11a-47e2-9f3e-450f6fea78c8
Settings file: '/Users/arbi/.docker/machine/machines/default/default/default.vbox'
STDERR:
VM CPUS: 1
VM Memory: 2048
executing: /usr/local/bin/VBoxManage modifyvm default --firmware bios --bioslogofadein off --bioslogofadeout off --bioslogodisplaytime 0 --biosbootmenu disabled --ostype Linux26_64 --cpus 1 --memory 2048 --acpi on --ioapic on --rtcuseutc on --natdnshostresolver1 off --natdnsproxy1 off --cpuhotplug off --pae on --hpet on --hwvirtex on --nestedpaging on --largepages on --vtxvpid on --accelerate3d off --boot1 dvd
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage modifyvm default --nic1 nat --nictype1 82540EM --cableconnected1 on
STDOUT:
STDERR:
using 192.168.99.1 for dhcp address
executing: /usr/local/bin/VBoxManage list hostonlyifs
STDOUT: Name: vboxnet0
GUID: 786f6276-656e-4074-8000-0a0027000000
DHCP: Disabled
IPAddress: 192.168.99.1
NetworkMask: 255.255.255.0
IPV6Address:
IPV6NetworkMaskPrefixLength: 0
HardwareAddress: 0a:00:27:00:00:00
MediumType: Ethernet
Status: Down
VBoxNetworkName: HostInterfaceNetworking-vboxnet0
STDERR:
executing: /usr/local/bin/VBoxManage modifyvm default --nic2 hostonly --nictype2 82540EM --hostonlyadapter2 vboxnet0 --cableconnected2 on
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage storagectl default --name SATA --add sata --hostiocache on
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage storageattach default --storagectl SATA --port 0 --device 0 --type dvddrive --medium /Users/arbi/.docker/machine/machines/default/boot2docker.iso
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage storageattach default --storagectl SATA --port 1 --device 0 --type hdd --medium /Users/arbi/.docker/machine/machines/default/disk.vmdk
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage guestproperty set default /VirtualBox/GuestAdd/SharedFolders/MountPrefix /
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage guestproperty set default /VirtualBox/GuestAdd/SharedFolders/MountDir /
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage sharedfolder add default --name Users --hostpath /Users --automount
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage setextradata default VBoxInternal2/SharedFoldersEnableSymlinksCreate/Users 1
STDOUT:
STDERR:
Starting VirtualBox VM...
executing: /usr/local/bin/VBoxManage showvminfo default --machinereadable
STDOUT: name="default"
groups="/"
ostype="Linux 2.6 / 3.x / 4.x (64-bit)"
UUID="e0f2a54b-b11a-47e2-9f3e-450f6fea78c8"
CfgFile="/Users/arbi/.docker/machine/machines/default/default/default.vbox"
SnapFldr="/Users/arbi/.docker/machine/machines/default/default/Snapshots"
LogFldr="/Users/arbi/.docker/machine/machines/default/default/Logs"
hardwareuuid="e0f2a54b-b11a-47e2-9f3e-450f6fea78c8"
memory=2048
. . .
SharedFolderNameMachineMapping1="Users"
SharedFolderPathMachineMapping1="/Users"
STDERR:
using 192.168.99.1 for dhcp address
executing: /usr/local/bin/VBoxManage list hostonlyifs
STDOUT: Name: vboxnet0
GUID: 786f6276-656e-4074-8000-0a0027000000
DHCP: Disabled
IPAddress: 192.168.99.1
NetworkMask: 255.255.255.0
IPV6Address:
IPV6NetworkMaskPrefixLength: 0
HardwareAddress: 0a:00:27:00:00:00
MediumType: Ethernet
Status: Down
VBoxNetworkName: HostInterfaceNetworking-vboxnet0
STDERR:
executing: /usr/local/bin/VBoxManage modifyvm default --nic2 hostonly --nictype2 82540EM --hostonlyadapter2 vboxnet0 --cableconnected2 on
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage modifyvm default --natpf1 delete ssh
STDOUT:
STDERR: VBoxManage: error: Code NS_ERROR_INVALID_ARG (0x80070057) - Invalid argument value (extended info not available)
VBoxManage: error: Context: "RemoveRedirect(Bstr(ValueUnion.psz).raw())" at line 1766 of file VBoxManageModifyVM.cpp
executing: /usr/local/bin/VBoxManage modifyvm default --natpf1 ssh,tcp,127.0.0.1,52532,,22
STDOUT:
STDERR:
executing: /usr/local/bin/VBoxManage startvm default --type headless
STDOUT: Waiting for VM "default" to power on...
VM "default" has been successfully started.
STDERR:
Error creating machine: exit status 1
You will want to check the provider to make sure the machine and associated resources were properly removed.
Starting machine default...
exit status 1
Started machines may have new IP addresses. You may need to re-run the `docker-machine env` command.
Setting environment variables for machine default...
host is not running
docker is configured to use the default machine with IP
For help getting started, check out the docs at https://docs.docker.com
default is not running. Please start this with docker-machine start default
When I try to start the machine manually, it fails to run again:
$ docker-machine create --driver virtualbox default
Creating VirtualBox VM...
Creating SSH key...
Starting VirtualBox VM...
Error creating machine: exit status 1
You will want to check the provider to make sure the machine and associated resources were properly removed.
But then when I open VirtualBox, I see the default machine powered off, If I try to start it manually it fails and I get the following error:
Failed to open a session for the virtual machine default.
Failed to load VMMR0.r0 (VERR_VMM_SMAP_BUT_AC_CLEAR).
Result Code: NS_ERROR_FAILURE (0x80004005)
Component: ConsoleWrap
Interface: IConsole {872da645-4a9b-1727-bee2-5585105b9eed}
Any idea why it's failing to start the default machine?
I had to downgrade to VirtualBox 4.3 to make the Docker host starts successfully.
Uninstall VirtualBox:
To uninstall VirtualBox, open the disk image (dmg) file again and double-click on the uninstall icon contained therein.
Then re-install the Docker toolbox.

Resources