Proxmox LXC Docker Pull Issues

[lastb0isct]

Hi All,

Looks like i'm having issues with a CT with Docker installed. The Error i'm receiving is as follows:

Does anyone have any advise?

 

[1nerdyguy]

I don't think putting a container in a container is adviseable.

Spin up a basic *buntu or Debian of CentOS KVM host, and then put your docker stuff on that.

 

[lastb0isct]

I don't think putting a container in a container is adviseable.

Spin up a basic *buntu or Debian of CentOS KVM host, and then put your docker stuff on that.

According to https://github.com/docker/docker/issues/6783 it should be able to, shouldn't it? I saw some discussion on the forum regarding this, but not sure. Just to be clear, I'm able to get docker running in the LXC, i'm just getting that error when attempting to use docker to pull an image down.

 

[1nerdyguy]

Not saying it isn't possible, but I don't see the benefit personally. It's another layer of abstraction that isn't officially 'the way' of doing it, so possible support issue.

docker on KVM, on the other hand, is supported, known, and easy.

 

[lastb0isct]

Just want things to be running on Baremetal whenever possible. I see the reasoning why it makes sense on KVM, but would be nice to try on CT as well.

 

[LnxBil]

What about the syslog on the Proxmox VE host around the time of the failure?

 

[lastb0isct]

What about the syslog on the Proxmox VE host around the time of the failure?

Aha! That is where the logs would be!! I was looking for them for a while, definitely makes sense. This is the error it shows:

 

[LnxBil]

You need to change the your profile to allow mounts. I've never done it, so I cannot help but I suggest you google for the error with apparmor. You normally need to change the used profile or extend it be able to do such things. (e.g. running NFS inside LXC also needs changes to profile and loosen the security).

 

[HeroCC]

Same issue here, same error: Error response from daemon: ApplyLayer exit status 1 stdout: stderr: permission denied. Using http://askubuntu.com/a/380000/353466 helped to solve it.

 

[albans]

Same issue here, same error: Error response from daemon: ApplyLayer exit status 1 stdout: stderr: permission denied. Using http://askubuntu.com/a/380000/353466 helped to solve it.

Hey, thx for this!
Tried to set the below within the /etc/pve/lxc/<CTID>.conf file of the container having docker:
lxc.aa_profile: unconfined
lxc.cgroup.devices.allow: b 7:* rwm
lxc.cgroup.devices.allow: c 10:237 rwm

I don't get the
Error response from daemon: ApplyLayer exit status 1 stdout: stderr: permission denied
But I then get another type of error:
Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:291: setting cgroup config for ready process caused \"failed to write c 10:200 rwm to devices.allow: write /sys/fs/cgroup/devices/docker/*/devices.allow: operation not permitted\"".

How did you make it work @HeroCC ?

 

[HeroCC]

Hey, thx for this!
Tried to set the below within the /etc/pve/lxc/<CTID>.conf file of the container having docker:
lxc.aa_profile: unconfined
lxc.cgroup.devices.allow: b 7:* rwm
lxc.cgroup.devices.allow: c 10:237 rwm

I don't get the
Error response from daemon: ApplyLayer exit status 1 stdout: stderr: permission denied
But I then get another type of error:
Error response from daemon: oci runtime error: container_linux.go:247: starting container process caused "process_linux.go:291: setting cgroup config for ready process caused \"failed to write c 10:200 rwm to devices.allow: write /sys/fs/cgroup/devices/docker/*/devices.allow: operation not permitted\"".

How did you make it work @HeroCC ?

It's been a while since I did this, but after this fix I ran `docker run -d -p 38001:8001 --security-opt apparmor=lxc-container-default DOCKER/URLHERE` and it starts fine. I may have tried to install `apparmor` inside the container but I'm not 100% sure. It is a Ubuntu 16.04 container.

 

[tripflex]

Edit the specific lxc container config in Proxmox configuration

/etc/pve/lxc/XXXX.conf

and add this to the bottom of that config:

lxc.aa_profile: unconfined

Then inside the container, remove apparmor:

apt-get remove apparmor --purge

Source:
https://stackoverflow.com/questions/39557576/docker-run-hello-world-still-fails-permission-denied

 

[elkato]

Thanks this worked for me in PVE 5.2-9!
UPDATE:
"Use lxc.apparmor.profile: unconfined
Just put at the end of an /etc/pve/lxc/ID.conf file and restart your LXC container.
Using lxc.aa_profile: unconfined is deprecated as was renamed."

source:
https://stackoverflow.com/questions/39557576/docker-run-hello-world-still-fails-permission-denied