{"action":"created","issue":{"url":"https://api.github.com/repos/projectatomic/buildah/issues/912","repository_url":"https://api.github.com/repos/projectatomic/buildah","labels_url":"https://api.github.com/repos/projectatomic/buildah/issues/912/labels{/name}","comments_url":"https://api.github.com/repos/projectatomic/buildah/issues/912/comments","events_url":"https://api.github.com/repos/projectatomic/buildah/issues/912/events","html_url":"https://github.com/projectatomic/buildah/issues/912","id":348331342,"node_id":"MDU6SXNzdWUzNDgzMzEzNDI=","number":912,"title":"EPERM building as a limited user inside a container","user":{"login":"vbatts","id":67049,"node_id":"MDQ6VXNlcjY3MDQ5","avatar_url":"https://avatars2.githubusercontent.com/u/67049?v=4","gravatar_id":"","url":"https://api.github.com/users/vbatts","html_url":"https://github.com/vbatts","followers_url":"https://api.github.com/users/vbatts/followers","following_url":"https://api.github.com/users/vbatts/following{/other_user}","gists_url":"https://api.github.com/users/vbatts/gists{/gist_id}","starred_url":"https://api.github.com/users/vbatts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbatts/subscriptions","organizations_url":"https://api.github.com/users/vbatts/orgs","repos_url":"https://api.github.com/users/vbatts/repos","events_url":"https://api.github.com/users/vbatts/events{/privacy}","received_events_url":"https://api.github.com/users/vbatts/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-08-07T13:53:01Z","updated_at":"2018-08-08T08:37:32Z","closed_at":null,"author_association":"MEMBER","body":"**Description**\r\nEPERM on RUN command\r\n\r\n\r\n**Steps to reproduce the issue:**\r\n1. built a buildah build-image (runc master and buildah master)\r\n2. Tried to build cri-o Dockerfile (master) as a limited user inside a container\r\n3.\r\n\r\n**Describe the results you received:**\r\n```\r\nSTEP 2: RUN echo 'deb http://httpredir.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/backports.list\r\nerror running container: error creating container for [/bin/sh -c echo 'deb http://httpredir.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/backports.list]: container_linux.go:336: starting container process caused \"process_linux.go:402: container init caused \\\"rootfs_linux.go:57: mounting \\\\\\\"/proc\\\\\\\" to rootfs \\\\\\\"/tmp/buildah799604934/mnt/rootfs\\\\\\\" at \\\\\\\"/proc\\\\\\\" caused \\\\\\\"operation not permitted\\\\\\\"\\\"\"\r\n: exit status 1\r\n```\r\n\r\n**Describe the results you expected:**\r\nsucessful build\r\n\r\n\r\n**Output of `buildah version`:**\r\n\r\n```\r\n[root@c599e5432945 /]# buildah version\r\nVersion:         1.4-dev\r\nGo Version:      go1.9.4\r\nImage Spec:      1.0.0\r\nRuntime Spec:    1.0.0\r\nCNI Spec:        0.3.1\r\nlibcni Version:  v0.6.0\r\nGit Commit:      308ad3d\r\nBuilt:           Tue Aug  7 13:32:25 2018\r\nOS/Arch:         linux/amd64\r\n[root@54ea92e38133 /]# runc --version\r\nrunc version 1.0.0-rc5+dev\r\ncommit: 4056a41f58e35fd428d517de1326bc465aa6a461\r\nspec: 1.0.0\r\n```\r\n\r\n**Output of `cat /etc/*release`:**\r\n\r\nthis is inside the container\r\n```\r\nCentOS Linux release 7.5.1804 (Core) \r\nNAME=\"CentOS Linux\"\r\nVERSION=\"7 (Core)\"\r\nID=\"centos\"\r\nID_LIKE=\"rhel fedora\"\r\nVERSION_ID=\"7\"\r\nPRETTY_NAME=\"CentOS Linux 7 (Core)\"\r\nANSI_COLOR=\"0;31\"\r\nCPE_NAME=\"cpe:/o:centos:centos:7\"\r\nHOME_URL=\"https://www.centos.org/\"\r\nBUG_REPORT_URL=\"https://bugs.centos.org/\"\r\n\r\nCENTOS_MANTISBT_PROJECT=\"CentOS-7\"\r\nCENTOS_MANTISBT_PROJECT_VERSION=\"7\"\r\nREDHAT_SUPPORT_PRODUCT=\"centos\"\r\nREDHAT_SUPPORT_PRODUCT_VERSION=\"7\"\r\n\r\nCentOS Linux release 7.5.1804 (Core) \r\nCentOS Linux release 7.5.1804 (Core) \r\n```\r\n\r\n**Output of `uname -a`:**\r\n\r\n```\r\nLinux c599e5432945 4.17.3-200.fc28.x86_64 #1 SMP Tue Jun 26 14:17:07 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n\r\nDockerfile of the buildah image:\r\n```dockerfile\r\nFROM centos\r\nARG REVISION=\"master\"\r\n\r\nRUN \\\r\n  # Install buildah dependencies.\r\n  yum -y install \\\r\n    make \\\r\n    golang \\\r\n    bats \\\r\n    btrfs-progs-devel \\\r\n    device-mapper-devel \\\r\n    glib2-devel \\\r\n    gpgme-devel \\\r\n    libassuan-devel \\\r\n    libseccomp-devel \\\r\n    ostree-devel \\\r\n    git \\\r\n    bzip2 \\\r\n    go-md2man \\\r\n    runc \\\r\n    skopeo-containers && \\\r\n  # Install buildah.\r\n  mkdir ~/buildah && \\\r\n  cd ~/buildah && \\\r\n  export GOPATH=`pwd` && \\\r\n  git clone https://github.com/opencontainers/runc ./src/github.com/opencontainers/runc && \\\r\n  cd $GOPATH/src/github.com/opencontainers/runc && \\\r\n  make runc && \\\r\n  mv runc /usr/bin/runc && \\\r\n  cd $GOPATH/ && \\\r\n  git clone https://github.com/projectatomic/buildah ./src/github.com/projectatomic/buildah && \\\r\n  cd $GOPATH/src/github.com/projectatomic/buildah && \\\r\n  git checkout \"${REVISION}\" && \\\r\n  make && \\\r\n  make install && \\\r\n  buildah --help\r\n\r\nENTRYPOINT [\"buildah\"]\r\n```"},"comment":{"url":"https://api.github.com/repos/projectatomic/buildah/issues/comments/411331323","html_url":"https://github.com/projectatomic/buildah/issues/912#issuecomment-411331323","issue_url":"https://api.github.com/repos/projectatomic/buildah/issues/912","id":411331323,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMTMzMTMyMw==","user":{"login":"giuseppe","id":67430,"node_id":"MDQ6VXNlcjY3NDMw","avatar_url":"https://avatars0.githubusercontent.com/u/67430?v=4","gravatar_id":"","url":"https://api.github.com/users/giuseppe","html_url":"https://github.com/giuseppe","followers_url":"https://api.github.com/users/giuseppe/followers","following_url":"https://api.github.com/users/giuseppe/following{/other_user}","gists_url":"https://api.github.com/users/giuseppe/gists{/gist_id}","starred_url":"https://api.github.com/users/giuseppe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/giuseppe/subscriptions","organizations_url":"https://api.github.com/users/giuseppe/orgs","repos_url":"https://api.github.com/users/giuseppe/repos","events_url":"https://api.github.com/users/giuseppe/events{/privacy}","received_events_url":"https://api.github.com/users/giuseppe/received_events","type":"User","site_admin":false},"created_at":"2018-08-08T08:37:32Z","updated_at":"2018-08-08T08:37:32Z","author_association":"MEMBER","body":"the issue with running the container inside of the Docker/Podman container is that some `/proc` paths are masked.  This prevents the container spawned by Buildah to create new pid&user NS and mount `/proc` afterwards since that mount would be too \"revealing\", i.e. make visible paths that weren't visible before in the Docker/Podman context.\r\nThere are at least two ways to address it:\r\n\r\n- have no readonly/masked paths in the first container\r\n- don't create a PID namespace, so there is no need to mount a new procfs but re-use the already existing one\r\n\r\nThe second solution can be achieved setting the environment variable `\"BUILDAH_ISOLATION=chroot\"`\r\n"}}
{"actor":{"display_login":"giuseppe"}}