rawhide (crun): rootless(?): podman exec broken: OCI runtime error

[edsantiago]

On current rawhide with crun:

$ podman run -d --name foo alpine sleep 60
8c0855798e92d718be496e428c66a4e702ec4921575f006a5848fe53e41d50b8
$ podman exec foo true
Error: non zero exit code: 1: OCI runtime error
$ echo $?
1

I can't check root because podman-root is 100% broken (rhbz1748214).

With --log-level=debug:

...
DEBU[0000] Successfully started exec session 3985743e00dad6f2710b08790fb2ea75f96572b520aa2c16dc296cfb927e2856 in container c5875947634e0bf1f5804b19f361e7123b253f523cf43e0494ad04450d508419
[conmon:d]: exec with attach is waiting for start message from parent
[conmon:d]: exec with attach got start message from parent
ERRO[0000] non zero exit code: 1: OCI runtime error

podman-1.5.2-0.46.dev.git1d8a940.fc32.x86_64
crun-0.7-2.fc31.x86_64
package runc is not installed

[giuseppe]

it should work well with crun 0.8. The new version has different fixes for interacting with Podman and reporting the correct exit code.

[rhatdan]

@edsantiago can you test it out, reopen if this does not fix the issue.

[edsantiago]

Problem persists with crun-0.8-1.fc32.x86_64 although the error is different:

$ podman exec foo true
Error: writing file '/sys/fs/cgroup//user.slice/user-1000.slice/user@1000.service/user.slice/libpod-61c0251e87cd6312ce7e6176f2ad66f3260b675a079efa5d71ad79ed22e06671.scope/cgroup.procs': Permission denied: OCI runtime permission denied error

[rhatdan]

Progress...

[giuseppe]

it seems to fail moving a process from cgroup A to a cgroup B, where A is the current cgroup (owned by root) and B is the destination cgroup in the container.

Can you confirm the current cgroup is owned by root with `ls -l /sys/fs/cgroup/$(sed -e 's|0::||' /proc/self/cgroup)?

Does it work if you use something like systemd-run --user --scope podman exec foo echo hello ?

Not sure what would be the best way to handle it, we'd need to enforce somehow to run in a cgroup that is owned by the rootless user.

[giuseppe]

opened a PR to automatically create the scope: #3959