Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1025130 > unrolled thread

Bug#970352: unprivileged podman dies with gibberish

Started byHarald Dunkel <harri@afaics.de>
First post2020-09-15 08:00 +0200
Last post2020-09-27 00:30 +0200
Articles 5 — 2 participants

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#970352: unprivileged podman dies with gibberish Harald Dunkel <harri@afaics.de> - 2020-09-15 08:00 +0200
    Bug#970352: unprivileged podman dies with gibberish Reinhard Tartler <siretart@gmail.com> - 2020-09-15 17:10 +0200
      Bug#970352: unprivileged podman dies with gibberish Harald Dunkel <harri@afaics.de> - 2020-09-20 15:40 +0200
        Bug#970352: unprivileged podman dies with gibberish Reinhard Tartler <siretart@gmail.com> - 2020-09-20 17:40 +0200
          Bug#970352: unprivileged podman dies with gibberish Reinhard Tartler <siretart@gmail.com> - 2020-09-27 00:30 +0200

#1025130 — Bug#970352: unprivileged podman dies with gibberish

FromHarald Dunkel <harri@afaics.de>
Date2020-09-15 08:00 +0200
SubjectBug#970352: unprivileged podman dies with gibberish
Message-ID<APcat-3yo-3@gated-at.bofh.it>
Package: podman
Version: 2.0.6+dfsg1-1

Unprivileged podman dies with some gibberish instead of a readable
error message:

% podman run -it debian /bin/bash
Trying to pull quay.io/debian...
   error parsing HTTP 404 response body: invalid character '<' looking for beginning of value: "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<title>404 Not Found</title>\n<h1>Not Found</h1>\n<p>The requested URL was not found on the server. If you entered the URL manually please check 
your spelling and try again.</p>\n"
Trying to pull docker.io/library/debian...
Getting image source signatures
Copying blob 57df1a1f1ad8 done
Copying config f6dcff9b59 done
Writing manifest to image destination
Storing signatures
ERRO[0010] Error while applying layer: ApplyLayer exit status 1 stdout:  stderr: there might not be enough IDs available in the namespace (requested 0:42 for /etc/gshadow): lchown /etc/gshadow: invalid argument
   ApplyLayer exit status 1 stdout:  stderr: there might not be enough IDs available in the namespace (requested 0:42 for /etc/gshadow): lchown /etc/gshadow: invalid argument
Error: unable to pull debian: 2 errors occurred:
         * Error initializing source docker://quay.io/debian:latest: Error reading manifest latest in quay.io/debian: error parsing HTTP 404 response body: invalid character '<' looking for beginning of value: "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<title>404 Not 
Found</title>\n<h1>Not Found</h1>\n<p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>\n"
         * Error committing the finished image: error adding layer with blob "sha256:57df1a1f1ad841deaf50c8f662d77e93b4b17af776ed66148116607f9aceffa8": ApplyLayer exit status 1 stdout:  stderr: there might not be enough IDs available in the namespace (requested 0:42 for /etc/gshadow): lchown 
/etc/gshadow: invalid argument


Regards
Harri

[toc] | [next] | [standalone]

#1025202

FromReinhard Tartler <siretart@gmail.com>
Date2020-09-15 17:10 +0200
Message-ID<APkKJ-p4-11@gated-at.bofh.it>
In reply to#1025130

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 moreinfo

Hi Harald,


On Tue, Sep 15, 2020 at 1:51 AM Harald Dunkel <harri@afaics.de> wrote:

> Package: podman
> Version: 2.0.6+dfsg1-1
>
> Unprivileged podman dies with some gibberish instead of a readable
> error message:
>
> % podman run -it debian /bin/bash
> Trying to pull quay.io/debian...
>    error parsing HTTP 404 response body: invalid character '<' looking for
> beginning of value: "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2
> Final//EN\">\n<title>404 Not Found</title>\n<h1>Not Found</h1>\n<p>The
> requested URL was not found on the server. If you entered the URL manually
> please check
> your spelling and try again.</p>\n"
> Trying to pull docker.io/library/debian...
> Getting image source signatures
> Copying blob 57df1a1f1ad8 done
> Copying config f6dcff9b59 done
> Writing manifest to image destination
> Storing signatures
> ERRO[0010] Error while applying layer: ApplyLayer exit status 1 stdout:
> stderr: there might not be enough IDs available in the namespace (requested
> 0:42 for /etc/gshadow): lchown /etc/gshadow: invalid argument
>    ApplyLayer exit status 1 stdout:  stderr: there might not be enough IDs
> available in the namespace (requested 0:42 for /etc/gshadow): lchown
> /etc/gshadow: invalid argument
>

I think this is the relevant error message. May I ask a couple of questions:


   1. Did this work with an earlier verison of podman, i.e., is this a
   regression? What version worked for you before?
   2. Does the problem go away after a reboot?
   3. Does the command 'unshare -nr id' work for you?
   4. Did you read the file /usr/share/doc/podman/README.Debian, in
   particular the parts "User Namespaces" and "Troubleshooting rootless mode"?


Best,
-rt

-- 
regards,
    Reinhard

[toc] | [prev] | [next] | [standalone]

#1025759

FromHarald Dunkel <harri@afaics.de>
Date2020-09-20 15:40 +0200
Message-ID<AR7Jn-8r1-11@gated-at.bofh.it>
In reply to#1025202
On 9/15/20 5:05 PM, Reinhard Tartler wrote:
> 
> I think this is the relevant error message. May I ask a couple of questions:
> 
> 
>     1. Did this work with an earlier verison of podman, i.e., is this a
>     regression? What version worked for you before?

No, I didn't try an earlier version of podman. I just found out that there
is a native podman available.

>     2. Does the problem go away after a reboot?

No.

>     3. Does the command 'unshare -nr id' work for you?

Yes:

% unshare -nr id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)
% id -a
uid=1000(harri) gid=1000(harri) groups=1000(harri),4(adm),6(disk),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),44(video),46(plugdev),50(staff),107(haldaemon),108(powerdev),111(mythtv),112(netdev),119(kvm),123(wireshark),124(fuse),136(sbuild),999(docker)

And no, docker is not installed. It was.

>     4. Did you read the file /usr/share/doc/podman/README.Debian, in
>     particular the parts "User Namespaces" and "Troubleshooting rootless mode"?
> 

I did, but they are no help. I don't run a Debian kernel, i.e. there
is no sysctl kernel.unprivileged_userns_clone to be set. CONFIG_USER_NS
is enabled. And AFAIR it is common practice to define default subuid
and subgid ranges as a fallback (at least for Docker).

I think there is a misunderstanding: The problem is not the error,
but the error *message*. Can you do without complaining about bad
HTTP code and URLs that don't work? Surely they don't give a hint
about what is wrong. They are just distracting.


Thanx very much
Harri

[toc] | [prev] | [next] | [standalone]

#1025770

FromReinhard Tartler <siretart@gmail.com>
Date2020-09-20 17:40 +0200
Message-ID<AR9Bw-16o-11@gated-at.bofh.it>
In reply to#1025759

[Multipart message — attachments visible in raw view] — view raw

Control: tag -1 upstream

On Sun, Sep 20, 2020 at 9:28 AM Harald Dunkel <harri@afaics.de> wrote:

> I think there is a misunderstanding: The problem is not the error,
> but the error *message*. Can you do without complaining about bad
> HTTP code and URLs that don't work? Surely they don't give a hint
> about what is wrong. They are just distracting.
>
>
That was not clear to me from the initial description. In any case, I think
the most efficient way to resolve this is to ask upstream. May I ask you to
file an upstream report at https://github.com/containers/podman/issues/new
? I could do so on your behalf, but it'd be more efficient if you could do
so yourself.

Let me know how you prefer to proceed.

-- 
regards,
    Reinhard

[toc] | [prev] | [next] | [standalone]

#1026554

FromReinhard Tartler <siretart@gmail.com>
Date2020-09-27 00:30 +0200
Message-ID<ATqRz-23W-7@gated-at.bofh.it>
In reply to#1025770

[Multipart message — attachments visible in raw view] — view raw

Control: close -1
Control: tag -1 unreproducible

Hi Harald,


On Sun, Sep 20, 2020 at 11:32 AM Reinhard Tartler <siretart@gmail.com>
wrote:

> Control: tag -1 upstream
>
> On Sun, Sep 20, 2020 at 9:28 AM Harald Dunkel <harri@afaics.de> wrote:
>
>> I think there is a misunderstanding: The problem is not the error,
>> but the error *message*. Can you do without complaining about bad
>> HTTP code and URLs that don't work? Surely they don't give a hint
>> about what is wrong. They are just distracting.
>>
>>
> That was not clear to me from the initial description. In any case, I
> think the most efficient way to resolve this is to ask upstream. May I ask
> you to file an upstream report at
> https://github.com/containers/podman/issues/new ? I could do so on your
> behalf, but it'd be more efficient if you could do so yourself.
>
> Let me know how you prefer to proceed.
>
>
I've read the 'gibberish' again, and have to ask for clarification. It
seems to be this report is actually about two

The "gibberish" is not what is causing podman to "die". The relevant part
of the output probably is this:

ApplyLayer exit status 1 stdout:  stderr: there might not be enough
IDs available in the namespace (requested 0:42 for /etc/gshadow):
lchown /etc/gshadow: invalid argument

I would have hoped that the instruction in README.Debian would have
helped, but you indicated that you are using a custom, non-Debian
kernel, so there is no way for me to reproduce this crash. I have to
ask you to try again with a Debian kernel and report this issue to
upstream.

The other issue in your report happens when you instruct podman to
fetch an image without fully qualifying what registry to get the image
from. In this case, podman will search several registries as
configured in /etc/containers/registries.conf. The Debian package
configures "quay.io" and "docker.io" in that order. The image you
specified is not available on quay.io, but on docker.io, and this
causes some warnings that might be considered confusing. I'm not sure
what kind of formatting or behavior would be more helpful to both
users and developers that have to triage user errors.

As package maintainer, I don't think I can support you well with
either of these issues. I'd strongly encourage you to discuss both
upstream at https://github.com/containers/podman/issues/new. Let me
know the bug numbers, I'm happy to repoen this report with appropriate
linking to the upstream bug.


-- 
regards,
    Reinhard

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web