Comments (8)
sudo is not installed in the container you do not need to use it to apt-get
something
On Tue, Jul 14, 2015 at 4:36 PM, yakbulut [email protected] wrote:
Hi all,
I am trying to run a service, i.e mysql, inside a container. I gathered
the ubuntu rootfs from docker pull ubuntu:latest.Although whoami returns root, sudo command fails with sudo: PERM_SUDOERS:
setresuid(-1, 1, -1): Operation not permittedAs a result, I can't apt-get install or do any other sudo tasks.
How can I get around this issue?Thanks in advance,
—
Reply to this email directly or view it on GitHub
#126.
from runc.
On Tue, Jul 14, 2015 at 04:38:49PM -0700, Jessie Frazelle wrote:
sudo is not installed in the container…
I don't think that's the problem (if it was, @yakbulut would be
getting something like “sudo: command not found”).
Although whoami returns root, sudo command fails with sudo:
PERM_SUDOERS: setresuid(-1, 1, -1): Operation not permitted
PERM_SUDOERS seems to be a SELinux permission 1. I'm not sure how
that relates to linux.capabilities in the runc config, but you might
want to poke around there.
from runc.
On Tue, Jul 14, 2015 at 04:38:49PM -0700, Jessie Frazelle wrote:
you do not need to use it to apt-get something
^ this part I agree with ;).
from runc.
I know for a fact in that rootfs it is not installed
On Tue, Jul 14, 2015 at 4:49 PM, W. Trevor King [email protected]
wrote:
On Tue, Jul 14, 2015 at 04:38:49PM -0700, Jessie Frazelle wrote:
you do not need to use it to apt-get something
^ this part I agree with ;).
—
Reply to this email directly or view it on GitHub
#126 (comment)
.
from runc.
jk its not debian, i take that back
On Tue, Jul 14, 2015 at 4:56 PM, Jessie Frazelle [email protected] wrote:
I know for a fact in that rootfs it is not installed
On Tue, Jul 14, 2015 at 4:49 PM, W. Trevor King [email protected]
wrote:On Tue, Jul 14, 2015 at 04:38:49PM -0700, Jessie Frazelle wrote:
you do not need to use it to apt-get something
^ this part I agree with ;).
—
Reply to this email directly or view it on GitHub
#126 (comment)
.
from runc.
My first impression was that it was related to sudo. If try apt-get install mysql-server
the following error occurs
useradd: failure while writing changes to /etc/shadow adduser:
/usr/sbin/useradd -d /nonexistent -g mysql -s /bin/false -u 102 mysql' returned error code 1. Exiting.
dpkg: error processing archive /var/cache/apt/archives/mysql-server-5.5_5.5.35+dfsg-1ubuntu1_amd64.deb (--unpack):
subprocess new pre-installation script returned error exit status 1
Errors were encountered while processing:
/var/cache/apt/archives/mysql-server-5.5_5.5.35+dfsg-1ubuntu1_amd64.deb
W: chown to root:adm of file /var/log/apt/term.log failed - OpenLog (1: Operation not permitted)
E: Sub-process /usr/bin/dpkg returned an error code (1)`
Here is linux capabilities. Am I missing something here ?
"AUDIT_WRITE",
"KILL",
"NET_BIND_SERVICE",
"NET_RAW"
from runc.
On Tue, Jul 14, 2015 at 05:04:17PM -0700, yakbulut wrote:
adduser:`/usr/sbin/useradd -d /nonexistent -g mysql -s /bin/false -u 102 mysql' returned error code 1. Exiting.
Have you mounted your /etc/shadow read-only? Maybe stracing that
useradd command will turn up something useful. From useradd(8):
EXIT VALUES
…
1
can't update password file
so I suspect a mount-access or permissions issue.
from runc.
Hi all,
Thanks for all the tips. It turns out that I had to include bunch of linux capabilities.
You certainly do not need to sudo to run root commands.
from runc.
Related Issues (20)
- Seems like a typo, the .PHONY label has no purpose this way HOT 3
- runc update will clear cpu burst value HOT 3
- runc update: cpu period and cpu burst being reset to defaults after an unrelated update HOT 8
- runc init hang up HOT 1
- runc doesn't work with go1.22 HOT 6
- GHSA-c5pj-mqfh-rvc3 "Runc allows an arbitrary systemd property to be injected" is a misunderstood vulnerability. Users do NOT need to update runc. HOT 3
- flaky test: TestUsernsCheckpoint HOT 6
- flaky test: TestCheckpoint(actuated-arm64-6cpu-8gb, 1.21.x) HOT 2
- runc error on pod termination HOT 7
- rlimit hack won't work with Go 1.23 HOT 2
- Unblock
- flake in TestInitJoinPID on CentOS 7 HOT 1
- Flaky test: TestFdLeaks HOT 1
- CI: Replace CentOS Stream 8 with Alma, Rocky, or Oracle Linux due to EOL HOT 5
- [v1.2 regression] `SCMP_ACT_NOTIFY` rule for `fcntl` causes runc to hang, before connecting to the seccomp listener agent HOT 9
- Replace CentOS 7 in cirrus-ci HOT 2
- runc fails if run with _LIBCONTAINER_INITPIPE env var set HOT 4
- [rfc] switch from dependabot to renovate? HOT 3
- runc's poststart behaviour doesn't match the runtime-spec HOT 1
- runc aways open "/proc/sys/kernel/cap_last_cap" HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from runc.