{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/2407","repository_url":"https://api.github.com/repos/lxc/lxc","labels_url":"https://api.github.com/repos/lxc/lxc/issues/2407/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/2407/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/2407/events","html_url":"https://github.com/lxc/lxc/issues/2407","id":332676226,"node_id":"MDU6SXNzdWUzMzI2NzYyMjY=","number":2407,"title":"Cannot start docker hello-world in LXC conatiner","user":{"login":"AdrianPeniakGL","id":33865646,"node_id":"MDQ6VXNlcjMzODY1NjQ2","avatar_url":"https://avatars3.githubusercontent.com/u/33865646?v=4","gravatar_id":"","url":"https://api.github.com/users/AdrianPeniakGL","html_url":"https://github.com/AdrianPeniakGL","followers_url":"https://api.github.com/users/AdrianPeniakGL/followers","following_url":"https://api.github.com/users/AdrianPeniakGL/following{/other_user}","gists_url":"https://api.github.com/users/AdrianPeniakGL/gists{/gist_id}","starred_url":"https://api.github.com/users/AdrianPeniakGL/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AdrianPeniakGL/subscriptions","organizations_url":"https://api.github.com/users/AdrianPeniakGL/orgs","repos_url":"https://api.github.com/users/AdrianPeniakGL/repos","events_url":"https://api.github.com/users/AdrianPeniakGL/events{/privacy}","received_events_url":"https://api.github.com/users/AdrianPeniakGL/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-06-15T07:44:19Z","updated_at":"2018-06-15T12:14:40Z","closed_at":null,"author_association":"NONE","body":"# Required information\r\n\r\n * Distribution: Beaglebone black rev c. [yocto](https://github.com/AdrianPeniak/meta-blackbone)\r\n * Distribution version: kernel linux-ti-staging_4.4\r\n * The output of:\r\n```\r\nroot@blackbone-board:~# lxc-start --version\r\n2.0.0\r\n```\r\n```\r\nroot@blackbone-board:~# lxc-checkconfig\r\n--- Namespaces ---\r\nNamespaces: enabled\r\nUtsname namespace: enabled\r\nIpc namespace: enabled\r\nPid namespace: enabled\r\nUser namespace: enabled\r\nNetwork namespace: enabled\r\nMultiple /dev/pts instances: enabled\r\n\r\n--- Control groups ---\r\nCgroup: enabled\r\nCgroup clone_children flag: enabled\r\nCgroup device: enabled\r\nCgroup sched: enabled\r\nCgroup cpu account: enabled\r\nCgroup memory controller: enabled\r\n\r\n--- Misc ---\r\nVeth pair device: enabled\r\nMacvlan: missing\r\nVlan: enabled\r\nBridges: enabled\r\nAdvanced netfilter: enabled\r\nCONFIG_NF_NAT_IPV4: enabled\r\nCONFIG_NF_NAT_IPV6: missing\r\nCONFIG_IP_NF_TARGET_MASQUERADE: enabled\r\nCONFIG_IP6_NF_TARGET_MASQUERADE: missing\r\nCONFIG_NETFILTER_XT_TARGET_CHECKSUM: missing\r\nFUSE (for use with lxcfs): missing\r\n\r\n--- Checkpoint/Restore ---\r\ncheckpoint restore: enabled\r\nCONFIG_FHANDLE: enabled\r\nCONFIG_EVENTFD: enabled\r\nCONFIG_EPOLL: enabled\r\nCONFIG_UNIX_DIAG: missing\r\nCONFIG_INET_DIAG: enabled\r\nCONFIG_PACKET_DIAG: missing\r\nCONFIG_NETLINK_DIAG: missing\r\nFile capabilities: enabled\r\n\r\nNote : Before booting a new kernel, you can check its configuration\r\nusage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig\r\n```\r\n```\r\nroot@blackbone-board:~# uname -a\r\nLinux blackbone-board 4.4.54-gecd4eada6f #6 PREEMPT Thu Jun 14 12:33:53 UTC 2018 armv7l GNU/Linux\r\n```\r\n```\r\nroot@blackbone-board:~# cat /proc/self/cgroup\r\n12:name=systemd:/\r\n11:debug:/\r\n10:pids:/\r\n9:perf_event:/\r\n8:net_cls:/\r\n7:freezer:/\r\n6:devices:/\r\n5:memory:/\r\n4:blkio:/\r\n3:cpuacct:/\r\n2:cpu:/\r\n1:cpuset:/\r\n0::/\r\n```\r\n```\r\nroot@blackbone-board:~# cat /proc/1/mounts\r\n/dev/root / ext4 rw,relatime,data=ordered 0 0\r\ndevtmpfs /dev devtmpfs rw,relatime,size=229980k,nr_inodes=57495,mode=755 0 0\r\nproc /proc proc rw,relatime 0 0\r\nsysfs /sys sysfs rw,relatime 0 0\r\ndebugfs /sys/kernel/debug debugfs rw,relatime 0 0\r\ntmpfs /run tmpfs rw,nosuid,nodev,mode=755 0 0\r\ntmpfs /var/volatile tmpfs rw,relatime 0 0\r\ndevpts /dev/pts devpts rw,relatime,gid=5,mode=620,ptmxmode=000 0 0\r\ncgroup /sys/fs/cgroup tmpfs rw,relatime,mode=755 0 0\r\ncgroup /sys/fs/cgroup/cpuset cgroup rw,relatime,cpuset 0 0\r\ncgroup /sys/fs/cgroup/cpu cgroup rw,relatime,cpu 0 0\r\ncgroup /sys/fs/cgroup/cpuacct cgroup rw,relatime,cpuacct 0 0\r\ncgroup /sys/fs/cgroup/blkio cgroup rw,relatime,blkio 0 0\r\ncgroup /sys/fs/cgroup/memory cgroup rw,relatime,memory 0 0\r\ncgroup /sys/fs/cgroup/devices cgroup rw,relatime,devices 0 0\r\ncgroup /sys/fs/cgroup/freezer cgroup rw,relatime,freezer 0 0\r\ncgroup /sys/fs/cgroup/net_cls cgroup rw,relatime,net_cls 0 0\r\ncgroup /sys/fs/cgroup/perf_event cgroup rw,relatime,perf_event 0 0\r\ncgroup /sys/fs/cgroup/pids cgroup rw,relatime,pids 0 0\r\ncgroup /sys/fs/cgroup/debug cgroup rw,relatime,debug 0 0\r\ncgroup /sys/fs/cgroup/systemd cgroup rw,relatime,name=systemd 0 0\r\n```\r\n\r\n# Issue description\r\nCannot start docker-ce hello-world image in LXC conatiner. Issue ale reported [here](https://github.com/docker/for-linux/issues/340) \r\n```\r\nroot@docker:/# docker run armhf/hello-world\r\ndocker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused \"process_linux.go:402: container init caused \\\"process_linux.go:367: setting cgroup config for procHooks process caused \\\\\\\"failed to write a *:* rwm to devices.deny: open /sys/fs/cgroup/cpuset/lxc/docker/docker/80e92786ab0a12ad3496cf0662bb931da364d5b9f2e0494f24f3d357b6ab3dbf/devices.deny: permission denied\\\\\\\"\\\"\": unknown.\r\n```\r\n\r\n# Steps to reproduce\r\n[1] download lxc container (ubuntu/bionic/armhf), [2] start lxc container, [3] install docker-ce, [4] run hello world\r\n```\r\n[1] lxc-create -t download -n docker\r\n[2] lxc-start -n docker -d\r\n[3] according https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-docker-ce\r\n[4] docker run hello-world or docker run armhf/hello-world\r\n```\r\n\r\n# Information to attach\r\n - [X] container log (The <log> file from running `lxc-start -n <c> -l <log> -o DEBUG`)\r\n```\r\nroot@blackbone-board:~# date\r\nThu Jun 14 18:34:14 UTC 2018\r\nroot@blackbone-board:~# lxc-start -n docker --logfile /dev/stdout --logpriority debug\r\n      lxc-start 20180614183430.433 INFO     lxc_start_ui - lxc_start.c:main:264 - using rcfile /var/lib/lxc/docker/config\r\n      lxc-start 20180614183430.436 WARN     lxc_confile - confile.c:config_pivotdir:1877 - lxc.pivotdir is ignored.  It will soon become an error.\r\n      lxc-start 20180614183430.453 INFO     lxc_start - start.c:lxc_check_inherited:251 - closed inherited fd 4\r\n      lxc-start 20180614183430.474 INFO     lxc_container - lxccontainer.c:do_lxcapi_start:797 - Attempting to set proc title to [lxc monitor] /var/lib/lxc docker\r\n      lxc-start 20180614183430.489 DEBUG    lxc_start - start.c:setup_signal_fd:289 - sigchild handler set\r\n      lxc-start 20180614183430.499 INFO     lxc_start - start.c:lxc_check_inherited:251 - closed inherited fd 4\r\n      lxc-start 20180614183430.506 DEBUG    lxc_console - console.c:lxc_console_peer_default:473 - no console peer\r\n      lxc-start 20180614183430.507 INFO     lxc_start - start.c:lxc_init:488 - 'docker' is initialized\r\n      lxc-start 20180614183430.518 DEBUG    lxc_start - start.c:__lxc_start:1302 - Not dropping cap_sys_boot or watching utmp\r\n      lxc-start 20180614183430.519 INFO     lxc_start - start.c:save_phys_nics:947 - stored saved_nic #0 idx 4 name eth0\r\n      lxc-start 20180614183430.520 INFO     lxc_cgroup - cgroup.c:cgroup_init:68 - cgroup driver cgroupfs-ng initing for docker\r\n      lxc-start 20180614183430.538 INFO     lxc_monitor - monitor.c:lxc_monitor_sock_name:178 - using monitor sock name lxc/ad055575fe28ddd5//var/lib/lxc\r\n      lxc-start 20180614183430.558 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.deny' set to 'a'\r\n      lxc-start 20180614183430.558 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c *:* m'\r\n      lxc-start 20180614183430.558 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'b *:* m'\r\n      lxc-start 20180614183430.559 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:3 rwm'\r\n      lxc-start 20180614183430.559 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:5 rwm'\r\n      lxc-start 20180614183430.559 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:7 rwm'\r\n      lxc-start 20180614183430.559 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 5:0 rwm'\r\n      lxc-start 20180614183430.559 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 5:1 rwm'\r\n      lxc-start 20180614183430.560 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 5:2 rwm'\r\n      lxc-start 20180614183430.560 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:8 rwm'\r\n      lxc-start 20180614183430.560 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:9 rwm'\r\n      lxc-start 20180614183430.560 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 136:* rwm'\r\n      lxc-start 20180614183430.560 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:229 rwm'\r\n      lxc-start 20180614183430.561 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 254:0 rm'\r\n      lxc-start 20180614183430.561 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:200 rwm'\r\n      lxc-start 20180614183430.561 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:228 rwm'\r\n      lxc-start 20180614183430.561 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:232 rwm'\r\n      lxc-start 20180614183430.561 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'b 7:* rwm'\r\n      lxc-start 20180614183430.562 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'a'\r\n      lxc-start 20180614183430.562 INFO     lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1716 - cgroup has been setup\r\n      lxc-start 20180614183430.602 DEBUG    lxc_conf - conf.c:lxc_assign_network:3047 - move '(null)' to '2823'\r\n      lxc-start 20180614183430.606 DEBUG    lxc_conf - conf.c:setup_rootfs:1215 - mounted '/var/lib/lxc/docker/rootfs' on '/usr/lib/lxc/rootfs'\r\n      lxc-start 20180614183430.607 INFO     lxc_conf - conf.c:setup_utsname:843 - 'gamma' hostname has been setup\r\n      lxc-start 20180614183430.638 DEBUG    lxc_conf - conf.c:setup_hw_addr:2144 - mac address '4a:49:43:49:79:ff' on 'eth0' has been setup\r\n      lxc-start 20180614183430.731 DEBUG    lxc_conf - conf.c:setup_netdev:2371 - 'eth0' has been setup\r\n      lxc-start 20180614183430.731 INFO     lxc_conf - conf.c:setup_network:2392 - network has been setup\r\n      lxc-start 20180614183430.731 INFO     lxc_conf - conf.c:mount_autodev:1072 - Mounting container /dev\r\n      lxc-start 20180614183430.733 INFO     lxc_conf - conf.c:mount_autodev:1095 - Mounted tmpfs onto /usr/lib/lxc/rootfs/dev\r\n      lxc-start 20180614183430.733 INFO     lxc_conf - conf.c:mount_autodev:1113 - Mounted container /dev\r\n      lxc-start 20180614183430.735 INFO     lxc_conf - conf.c:mount_entry:1646 - failed to mount '/sys/fs/fuse/connections' on '/usr/lib/lxc/rootfs/sys/fs/fuse/connections' (optional): No such file or directory\r\n      lxc-start 20180614183430.735 DEBUG    lxc_conf - conf.c:mount_entry:1657 - remounting /sys/kernel/debug on /usr/lib/lxc/rootfs/sys/kernel/debug to respect bind or remount options\r\n      lxc-start 20180614183430.736 DEBUG    lxc_conf - conf.c:mount_entry:1672 - (at remount) flags for /sys/kernel/debug was 4096, required extra flags are 0\r\n      lxc-start 20180614183430.736 DEBUG    lxc_conf - conf.c:mount_entry:1681 - mountflags already was 4096, skipping remount\r\n      lxc-start 20180614183430.736 DEBUG    lxc_conf - conf.c:mount_entry:1707 - mounted '/sys/kernel/debug' on '/usr/lib/lxc/rootfs/sys/kernel/debug', type 'none'\r\n      lxc-start 20180614183430.736 INFO     lxc_conf - conf.c:mount_entry:1646 - failed to mount '/sys/kernel/security' on '/usr/lib/lxc/rootfs/sys/kernel/security' (optional): No such file or directory\r\n      lxc-start 20180614183430.736 INFO     lxc_conf - conf.c:mount_entry:1646 - failed to mount '/sys/fs/pstore' on '/usr/lib/lxc/rootfs/sys/fs/pstore' (optional): No such file or directory\r\n      lxc-start 20180614183430.737 DEBUG    lxc_conf - conf.c:mount_entry:1707 - mounted 'mqueue' on '/usr/lib/lxc/rootfs/dev/mqueue', type 'mqueue'\r\n      lxc-start 20180614183430.737 INFO     lxc_conf - conf.c:mount_file_entries:1926 - mount points have been setup\r\n      lxc-start 20180614183430.738 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/cpuset read-only\r\n      lxc-start 20180614183430.738 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/cpuset//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/cpuset//lxc/docker\r\n      lxc-start 20180614183430.739 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/cpuset//lxc/docker\r\n      lxc-start 20180614183430.739 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/cpu read-only\r\n      lxc-start 20180614183430.739 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/cpu//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/cpu//lxc/docker\r\n      lxc-start 20180614183430.739 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/cpu//lxc/docker\r\n      lxc-start 20180614183430.739 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/cpuacct read-only\r\n      lxc-start 20180614183430.739 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/cpuacct//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/cpuacct//lxc/docker\r\n      lxc-start 20180614183430.740 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/cpuacct//lxc/docker\r\n      lxc-start 20180614183430.740 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/blkio read-only\r\n      lxc-start 20180614183430.740 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/blkio//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/blkio//lxc/docker\r\n      lxc-start 20180614183430.740 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/blkio//lxc/docker\r\n      lxc-start 20180614183430.740 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/memory read-only\r\n      lxc-start 20180614183430.741 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/memory//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/memory//lxc/docker\r\n      lxc-start 20180614183430.741 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/memory//lxc/docker\r\n      lxc-start 20180614183430.741 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/devices read-only\r\n      lxc-start 20180614183430.741 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/devices//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/devices//lxc/docker\r\n      lxc-start 20180614183430.741 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/devices//lxc/docker\r\n      lxc-start 20180614183430.742 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/freezer read-only\r\n      lxc-start 20180614183430.742 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/freezer//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/freezer//lxc/docker\r\n      lxc-start 20180614183430.742 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/freezer//lxc/docker\r\n      lxc-start 20180614183430.742 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/net_cls read-only\r\n      lxc-start 20180614183430.742 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/net_cls//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/net_cls//lxc/docker\r\n      lxc-start 20180614183430.742 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/net_cls//lxc/docker\r\n      lxc-start 20180614183430.743 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/perf_event read-only\r\n      lxc-start 20180614183430.743 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/perf_event//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/perf_event//lxc/docker\r\n      lxc-start 20180614183430.743 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/perf_event//lxc/docker\r\n      lxc-start 20180614183430.743 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/pids read-only\r\n      lxc-start 20180614183430.743 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/pids//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/pids//lxc/docker\r\n      lxc-start 20180614183430.743 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/pids//lxc/docker\r\n      lxc-start 20180614183430.744 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/debug read-only\r\n      lxc-start 20180614183430.744 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/debug//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/debug//lxc/docker\r\n      lxc-start 20180614183430.744 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/debug//lxc/docker\r\n      lxc-start 20180614183430.744 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1292 - Remounted /usr/lib/lxc/rootfs/sys/fs/cgroup/systemd read-only\r\n      lxc-start 20180614183430.744 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1298 - Mounting /sys/fs/cgroup/systemd//lxc/docker onto /usr/lib/lxc/rootfs/sys/fs/cgroup/systemd//lxc/docker\r\n      lxc-start 20180614183430.744 INFO     lxc_cgfsng - cgfsng.c:do_secondstage_mounts_if_needed:1306 - Completed second stage cgroup automounts for /usr/lib/lxc/rootfs/sys/fs/cgroup/systemd//lxc/docker\r\n      lxc-start 20180614183430.745 INFO     lxc_conf - conf.c:fill_autodev:1141 - Creating initial consoles under container /dev\r\n      lxc-start 20180614183430.745 INFO     lxc_conf - conf.c:fill_autodev:1152 - Populating container /dev\r\n      lxc-start 20180614183430.745 INFO     lxc_conf - conf.c:fill_autodev:1189 - Populated container /dev\r\n      lxc-start 20180614183430.745 INFO     lxc_conf - conf.c:setup_ttydir_console:1458 - created /usr/lib/lxc/rootfs/dev/lxc\r\n      lxc-start 20180614183430.746 INFO     lxc_conf - conf.c:setup_ttydir_console:1504 - console has been setup on lxc/console\r\n      lxc-start 20180614183430.746 INFO     lxc_utils - utils.c:mount_proc_if_needed:1726 - I am 1, /proc/self points to '1'\r\n      lxc-start 20180614183430.766 DEBUG    lxc_conf - conf.c:setup_rootfs_pivot_root:1050 - pivot_root syscall to '/usr/lib/lxc/rootfs' successful\r\n      lxc-start 20180614183430.768 DEBUG    lxc_conf - conf.c:lxc_create_tty:3291 - allocated pty '/dev/pts/0' (9/12)\r\n      lxc-start 20180614183430.769 DEBUG    lxc_conf - conf.c:lxc_create_tty:3291 - allocated pty '/dev/pts/1' (13/14)\r\n      lxc-start 20180614183430.770 DEBUG    lxc_conf - conf.c:lxc_create_tty:3291 - allocated pty '/dev/pts/2' (15/16)\r\n      lxc-start 20180614183430.770 DEBUG    lxc_conf - conf.c:lxc_create_tty:3291 - allocated pty '/dev/pts/3' (17/18)\r\n      lxc-start 20180614183430.771 INFO     lxc_conf - conf.c:lxc_create_tty:3302 - tty's configured\r\n      lxc-start 20180614183430.771 INFO     lxc_conf - conf.c:setup_tty:995 - 4 tty(s) has been setup\r\n      lxc-start 20180614183430.771 INFO     lxc_conf - conf.c:setup_personality:1393 - set personality to '0x8'\r\n      lxc-start 20180614183430.771 DEBUG    lxc_conf - conf.c:setup_caps:2064 - capabilities have been setup\r\n      lxc-start 20180614183430.772 NOTICE   lxc_conf - conf.c:lxc_setup:3838 - 'docker' is setup.\r\n      lxc-start 20180614183430.772 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.deny' set to 'a'\r\n      lxc-start 20180614183430.772 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c *:* m'\r\n      lxc-start 20180614183430.772 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'b *:* m'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:3 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:5 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:7 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 5:0 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 5:1 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 5:2 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:8 rwm'\r\n      lxc-start 20180614183430.773 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 1:9 rwm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 136:* rwm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:229 rwm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 254:0 rm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:200 rwm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:228 rwm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'c 10:232 rwm'\r\n      lxc-start 20180614183430.774 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'b 7:* rwm'\r\n      lxc-start 20180614183430.775 DEBUG    lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1712 - cgroup 'devices.allow' set to 'a'\r\n      lxc-start 20180614183430.775 INFO     lxc_cgfsng - cgfsng.c:cgfsng_setup_limits:1716 - cgroup has been setup\r\n      lxc-start 20180614183430.775 NOTICE   lxc_start - start.c:start:1411 - exec'ing '/sbin/init'\r\n      lxc-start 20180614183430.777 NOTICE   lxc_start - start.c:post_start:1422 - '/sbin/init' started with pid '2823'\r\n      lxc-start 20180614183430.778 WARN     lxc_start - start.c:signal_handler:337 - invalid pid for SIGCHLD\r\n      lxc-start 20180614183430.787 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183430.788 DEBUG    lxc_commands - commands.c:lxc_cmd_get_state:579 - 'docker' is in 'RUNNING' state\r\nroot@blackbone-board:~#       lxc-start 20180614183430.790 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n\r\nroot@blackbone-board:~# lxc-attach -n docker\r\n      lxc-start 20180614183445.743 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.751 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.753 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.765 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.766 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.773 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.775 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.777 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.778 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.780 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.781 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.782 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.784 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.786 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.787 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.789 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\n      lxc-start 20180614183445.790 DEBUG    lxc_commands - commands.c:lxc_cmd_handler:893 - peer has disconnected\r\nroot@docker:/# docker run hello-world\r\ndocker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused \"process_linux.go:402: container init caused \\\"process_linux.go:367: setting cgroup config for procHooks process caused \\\\\\\"failed to write a *:* rwm to devices.deny: open /sys/fs/cgroup/cpuset/lxc/docker/docker/5e137d6bd5c07699702ae162ce6d8d5576c879107767439b72439201b4ef6d23/devices.deny: permission denied\\\\\\\"\\\"\": unknown.\r\nroot@docker:/# exit\r\n```\r\n - [X] any relevant kernel output (`dmesg`)\r\n```\r\n[ 5338.992327] net eth0: initializing cpsw version 1.12 (0)\r\n[ 5338.997725] net eth0: initialized cpsw ale version 1.4\r\n[ 5339.004108] net eth0: ALE Table size 1024\r\n[ 5339.011353] net eth0: phy found : id is : 0x7c0f1\r\n[ 5339.016935] libphy: PHY 4a101000.mdio:01 not found\r\n[ 5339.021790] net eth0: phy \"4a101000.mdio:01\" not found on slave 1, err -19\r\n[ 5339.052461] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready\r\n[ 5339.146448] cgroup: cgroup2: unknown option \"nsdelegate\"\r\n[ 5341.002878] cpsw 4a100000.ethernet eth0: Link is Up - 100Mbps/Full - flow control rx/tx\r\n[ 5341.010992] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready\r\n[ 5368.476573] IPv6: ADDRCONF(NETDEV_UP): docker0: link is not ready\r\n[ 5370.398045] device veth4afa3f5 entered promiscuous mode\r\n[ 5370.421181] IPv6: ADDRCONF(NETDEV_UP): veth4afa3f5: link is not ready\r\n[ 5371.349116] docker0: port 1(veth4afa3f5) entered disabled state\r\n[ 5371.367307] device veth4afa3f5 left promiscuous mode\r\n[ 5371.378257] docker0: port 1(veth4afa3f5) entered disabled state\r\n```\r\n\r\n - [X] the containers configuration file\r\n```\r\nroot@blackbone-board:~# cat /var/lib/lxc/docker/config\r\n# Distribution configuration\r\nlxc.include = /usr/share/lxc/config/ubuntu.common.conf\r\nlxc.arch = linux32\r\n\r\n# Container specific configuration\r\nlxc.aa_profile = unconfined\r\nlxc.cgroup.devices.allow = a\r\nlxc.cap.drop =\r\nlxc.rootfs = /var/lib/lxc/docker/rootfs\r\nlxc.rootfs.backend = dir\r\nlxc.utsname = docker\r\n\r\n# Container with network virtualized using a physical network device with name\r\n# 'eth0'\r\nlxc.utsname = gamma\r\nlxc.network.type = phys\r\nlxc.network.flags = up\r\nlxc.network.link = eth0\r\nlxc.network.hwaddr = 4a:49:43:49:79:ff\r\nlxc.network.ipv4 = 10.2.3.6/24\r\nlxc.network.ipv6 = 2003:db8:1:0:214:1234:fe0b:3297\r\n```"},"comment":{"url":"https://api.github.com/repos/lxc/lxc/issues/comments/397602513","html_url":"https://github.com/lxc/lxc/issues/2407#issuecomment-397602513","issue_url":"https://api.github.com/repos/lxc/lxc/issues/2407","id":397602513,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzYwMjUxMw==","user":{"login":"brauner","id":7353573,"node_id":"MDQ6VXNlcjczNTM1NzM=","avatar_url":"https://avatars0.githubusercontent.com/u/7353573?v=4","gravatar_id":"","url":"https://api.github.com/users/brauner","html_url":"https://github.com/brauner","followers_url":"https://api.github.com/users/brauner/followers","following_url":"https://api.github.com/users/brauner/following{/other_user}","gists_url":"https://api.github.com/users/brauner/gists{/gist_id}","starred_url":"https://api.github.com/users/brauner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brauner/subscriptions","organizations_url":"https://api.github.com/users/brauner/orgs","repos_url":"https://api.github.com/users/brauner/repos","events_url":"https://api.github.com/users/brauner/events{/privacy}","received_events_url":"https://api.github.com/users/brauner/received_events","type":"User","site_admin":false},"created_at":"2018-06-15T12:14:40Z","updated_at":"2018-06-15T12:14:40Z","author_association":"MEMBER","body":"Please show the output of `lxc info`."}}
{"actor":{"display_login":"brauner"}}