{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/docker-vault/issues/19","repository_url":"https://api.github.com/repos/hashicorp/docker-vault","labels_url":"https://api.github.com/repos/hashicorp/docker-vault/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/docker-vault/issues/19/comments","events_url":"https://api.github.com/repos/hashicorp/docker-vault/issues/19/events","html_url":"https://github.com/hashicorp/docker-vault/issues/19","id":196530636,"number":19,"title":"setcap fails on aufs systems","user":{"login":"bmitch3020","id":1979858,"avatar_url":"https://avatars.githubusercontent.com/u/1979858?v=3","gravatar_id":"","url":"https://api.github.com/users/bmitch3020","html_url":"https://github.com/bmitch3020","followers_url":"https://api.github.com/users/bmitch3020/followers","following_url":"https://api.github.com/users/bmitch3020/following{/other_user}","gists_url":"https://api.github.com/users/bmitch3020/gists{/gist_id}","starred_url":"https://api.github.com/users/bmitch3020/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bmitch3020/subscriptions","organizations_url":"https://api.github.com/users/bmitch3020/orgs","repos_url":"https://api.github.com/users/bmitch3020/repos","events_url":"https://api.github.com/users/bmitch3020/events{/privacy}","received_events_url":"https://api.github.com/users/bmitch3020/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-19T21:55:43Z","updated_at":"2016-12-20T16:01:18Z","closed_at":"2016-12-20T16:01:18Z","body":"The setcap command itself fails on some systems. I'm seeing this when trying to run a shell as the command (without changing the entrypoint) in 0.6.4):\r\n\r\n```\r\nFailed to set capabilities on file `/bin/vault' (Not supported)\r\nusage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ]\r\n\r\n Note <filename> must be a regular (non-symlink) file.\r\n```\r\n\r\nI'm even seeing this when I pass `--cap-add IPC_LOCK` to the run command, running on kernel 3.16.0-4-amd64 (Debian), OS filesystems are ext4 and using the docker storage driver is aufs. Spinning up the container with a shell as my entrypoint, I can also see:\r\n\r\n```\r\n/ # getcap /bin/vault\r\nFailed to get capabilities of file `/bin/vault' (Not supported)\r\n```\r\n\r\nSince the entrypoint starts with a `set -e`, I believe the script will immediately error out on the first setcap command even if PR#18 is included. Best solution may be to wrap that section of code with an if check, but I haven't had a chance to test this:\r\n\r\n```\r\nif getcap $(readlink -f $(which vault)) >/dev/null 2>&1; then\r\n...\r\nfi\r\n```"}}
{"actor":{"display_login":"jefferai"}}