{"action":"created","issue":{"url":"https://api.github.com/repos/adelton/docker-freeipa/issues/95","repository_url":"https://api.github.com/repos/adelton/docker-freeipa","labels_url":"https://api.github.com/repos/adelton/docker-freeipa/issues/95/labels{/name}","comments_url":"https://api.github.com/repos/adelton/docker-freeipa/issues/95/comments","events_url":"https://api.github.com/repos/adelton/docker-freeipa/issues/95/events","html_url":"https://github.com/adelton/docker-freeipa/issues/95","id":191330331,"number":95,"title":"ipa-replica-install command fails","user":{"login":"nfuentes","id":4087068,"avatar_url":"https://avatars.githubusercontent.com/u/4087068?v=3","gravatar_id":"","url":"https://api.github.com/users/nfuentes","html_url":"https://github.com/nfuentes","followers_url":"https://api.github.com/users/nfuentes/followers","following_url":"https://api.github.com/users/nfuentes/following{/other_user}","gists_url":"https://api.github.com/users/nfuentes/gists{/gist_id}","starred_url":"https://api.github.com/users/nfuentes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nfuentes/subscriptions","organizations_url":"https://api.github.com/users/nfuentes/orgs","repos_url":"https://api.github.com/users/nfuentes/repos","events_url":"https://api.github.com/users/nfuentes/events{/privacy}","received_events_url":"https://api.github.com/users/nfuentes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-11-23T17:05:34Z","updated_at":"2016-11-29T14:42:22Z","closed_at":null,"body":"Hi!\r\n\r\ni'm trying to setup an ipa replica on amazon AWS, but i'm having the following error:\r\n\r\n```\r\n[27/43]: restarting directory server\r\nipa         : CRITICAL Failed to restart the directory server (Command '/bin/systemctl restart dirsrv@WATEA-COM-AR.service' returned non-zero exit status 1). See the installation log for details.\r\n\r\n```\r\nThis is an extract of the logfile:\r\n\r\n```\r\n2016-11-23T15:45:22Z DEBUG certmonger request is in state dbus.String(u'NEWLY_ADDED_READING_KEYINFO', variant_level=1)\r\n2016-11-23T15:45:27Z DEBUG certmonger request is in state dbus.String(u'CA_UNCONFIGURED', variant_level=1)\r\n2016-11-23T15:45:27Z DEBUG flushing ldapi://%2fvar%2frun%2fslapd-WATEA-COM-AR.socket from SchemaCache\r\n2016-11-23T15:45:27Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-WATEA-COM-AR.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x7f6aafc176c8>\r\n2016-11-23T15:45:28Z DEBUG   duration: 5 seconds\r\n2016-11-23T15:45:28Z DEBUG   [27/43]: restarting directory server\r\n2016-11-23T15:45:28Z DEBUG Starting external process\r\n2016-11-23T15:45:28Z DEBUG args=/bin/systemctl --system daemon-reload\r\n2016-11-23T15:45:28Z DEBUG Process finished, return code=0\r\n2016-11-23T15:45:28Z DEBUG stdout=\r\n2016-11-23T15:45:28Z DEBUG stderr=Failed to open /dev/tty: No such device or address\r\n\r\n2016-11-23T15:45:28Z DEBUG Starting external process\r\n2016-11-23T15:45:28Z DEBUG args=/bin/systemctl restart dirsrv@WATEA-COM-AR.service\r\n2016-11-23T15:45:28Z DEBUG Process finished, return code=1\r\n2016-11-23T15:45:28Z DEBUG stdout=\r\n2016-11-23T15:45:28Z DEBUG stderr=Failed to open /dev/tty: No such device or address\r\nFailed to open /dev/tty: No such device or address\r\nJob for dirsrv@WATEA-COM-AR.service failed because the control process exited with error code. See \"systemctl status dirsrv@WATEA-COM-AR.service\" and \"journalctl -xe\" for details.\r\n\r\n2016-11-23T15:45:28Z CRITICAL Failed to restart the directory server (Command '/bin/systemctl restart dirsrv@WATEA-COM-AR.service' returned non-zero exit status 1). See the installation log for details.\r\n2016-11-23T15:45:29Z DEBUG   duration: 0 seconds\r\n2016-11-23T15:45:29Z DEBUG   [28/43]: setting up initial replication\r\n2016-11-23T15:45:39Z DEBUG Traceback (most recent call last):\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/service.py\", line 447, in start_creation\r\n    run_step(full_msg, method)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/service.py\", line 437, in run_step\r\n    method()\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py\", line 405, in __setup_replica\r\n    self.dm_password)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/replication.py\", line 114, in enable_replication_version_checking\r\n    conn.do_simple_bind(bindpw=dirman_passwd)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py\", line 1621, in do_simple_bind\r\n    self.__bind_with_wait(self.simple_bind, timeout, binddn, bindpw)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py\", line 1616, in __bind_with_wait\r\n    self.__wait_for_connection(timeout)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py\", line 1599, in __wait_for_connection\r\n    wait_for_open_socket(lurl.hostport, timeout)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipautil.py\", line 1291, in wait_for_open_socket\r\n    raise e\r\nerror: [Errno 111] Connection refused\r\n\r\n2016-11-23T15:45:39Z DEBUG   [error] error: [Errno 111] Connection refused\r\n2016-11-23T15:45:39Z DEBUG   File \"/usr/lib/python2.7/site-packages/ipapython/admintool.py\", line 171, in execute\r\n    return_value = self.run()\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/cli.py\", line 318, in run\r\n    cfgr.run()\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/core.py\", line 310, in run\r\n    self.execute()\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/core.py\", line 332, in execute\r\n    for nothing in self._executor():\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/core.py\", line 372, in __runner\r\n    self._handle_exception(exc_info)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/core.py\", line 394, in _handle_exception\r\n    six.reraise(*exc_info)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/core.py\", line 362, in __runner\r\n step()\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/core.py\", line 359, in <lambda>\r\n    step = lambda: next(self.__gen)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/util.py\", line 81, in run_generator_with_yield_from\r\n    six.reraise(*exc_info)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/util.py\", line 59, in run_generator_with_yield_from\r\n    value = gen.send(prev_value)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/install/common.py\", line 63, in _install\r\n    for nothing in self._installer(self.parent):\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py\", line 1687, in main\r\n    promote(self)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py\", line 377, in decorated\r\n    func(installer)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py\", line 1393, in promote\r\n    promote=True, pkcs12_info=dirsrv_pkcs12_info)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/server/replicainstall.py\", line 125, in install_replica_ds\r\n    promote=promote,\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py\", line 399, in create_replica\r\n    self.start_creation(runtime=60)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/service.py\", line 447, in start_creation\r\n    run_step(full_msg, method)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/service.py\", line 437, in run_step\r\n    method()\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py\", line 405, in __setup_replica\r\n    self.dm_password)\r\n  File \"/usr/lib/python2.7/site-packages/ipaserver/install/replication.py\", line 114, in enable_replication_version_checking\r\n    conn.do_simple_bind(bindpw=dirman_passwd)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py\", line 1621, in do_simple_bind\r\n    self.__bind_with_wait(self.simple_bind, timeout, binddn, bindpw)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py\", line 1616, in __bind_with_wait\r\n    self.__wait_for_connection(timeout)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipaldap.py\", line 1599, in __wait_for_connection\r\n    wait_for_open_socket(lurl.hostport, timeout)\r\n  File \"/usr/lib/python2.7/site-packages/ipapython/ipautil.py\", line 1291, in wait_for_open_socket\r\n    raise e\r\n\r\n2016-11-23T15:45:39Z DEBUG The ipa-replica-install command failed, exception: error: [Errno 111] Connection refused\r\n2016-11-23T15:45:39Z ERROR [Errno 111] Connection refused\r\n2016-11-23T15:45:39Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information\r\n```\r\n\r\ni'm launching the container with the following docker command:\r\n\r\n`sudo docker run --privileged --name freeipa-server-container -ti -h heracles.watea.com.ar --dns=192.168.10.64 --dns=192.168.10.28 -e IPA_SERVER_IP=192.168.10.64 -v /sys/fs/cgroup:/sys/fs/cgroup:ro -v /etc/hosts:/etc/hosts --tmpfs /run --tmpfs /tmp -p 53:53/udp -p 53:53 -p 80:80 -p 443:443 -p 389:389 -p 636:636 -p 88:88 -p 464:464 -p 88:88/udp -p 464:464/udp -p 123:123/udp -p 7389:7389 -p 9443:9443 -p 9444:9444 -p 9445:9445 --network host -v /var/lib/ipa-data:/data freeipa-server ipa-replica-install --no-host-dns --skip-conncheck --admin-password=Dx90puns --allow-zone-overlap`\r\n\r\nI've read that it's not suggested to run it with privileged mode, but if I remove that parameter, I can't launch it. Docker is running on a centos 7 host\r\n\r\nAny ideas?\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/adelton/docker-freeipa/issues/comments/263588003","html_url":"https://github.com/adelton/docker-freeipa/issues/95#issuecomment-263588003","issue_url":"https://api.github.com/repos/adelton/docker-freeipa/issues/95","id":263588003,"user":{"login":"nfuentes","id":4087068,"avatar_url":"https://avatars.githubusercontent.com/u/4087068?v=3","gravatar_id":"","url":"https://api.github.com/users/nfuentes","html_url":"https://github.com/nfuentes","followers_url":"https://api.github.com/users/nfuentes/followers","following_url":"https://api.github.com/users/nfuentes/following{/other_user}","gists_url":"https://api.github.com/users/nfuentes/gists{/gist_id}","starred_url":"https://api.github.com/users/nfuentes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nfuentes/subscriptions","organizations_url":"https://api.github.com/users/nfuentes/orgs","repos_url":"https://api.github.com/users/nfuentes/repos","events_url":"https://api.github.com/users/nfuentes/events{/privacy}","received_events_url":"https://api.github.com/users/nfuentes/received_events","type":"User","site_admin":false},"created_at":"2016-11-29T14:42:22Z","updated_at":"2016-11-29T14:42:22Z","body":"I've just tried what you sugested.\r\n\r\nIf I run the container with --security-opt seccomp=unconfined, docker show these errors:\r\n\r\n```\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/fedora-domainname.service: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/systemd-journald.service: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/fedora-readonly.service: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-timer_list.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/etc-hostname.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-fs.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/dev-mqueue.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-sched_debug.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-kcore.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/data.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/-.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/data-var-log-journal.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-timer_stats.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/etc-resolv.conf.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-sysrq\\x2dtrigger.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/tmp.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-bus.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-irq.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/etc-hosts.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/proc-asound.mount: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/init.scope: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/systemd-tmpfiles-setup.service: Operation not permitted\r\nFailed to reset devices.list on /docker/631ca2220638244481f0769eb27c8e51b7282665294ffd5fa18353d647394833/system.slice/fedora-readonly.service: Operation not permitted\r\n\r\n```"}}
{"actor":{"display_login":"nfuentes"}}