<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">I was able to search around and find an
existing issue.<br>
<br>
<a class="moz-txt-link-freetext" href="https://github.com/systemd/systemd/pull/6876">https://github.com/systemd/systemd/pull/6876</a><br>
<br>
The keyctl syscalls are not setup to handle namespaces which is a
requirement of unprivileged containers. I eventually figured out
the right seccomp syntax to disable keyctl syscalls:<br>
<pre><code class="hljs apache"><span class="hljs-attribute">2</span>
<span class="hljs-attribute">blacklist</span><span class="hljs-meta"></span>
<span class="hljs-attribute">keyctl_chown</span> errno 38
<span class="hljs-attribute">keyctl</span> errno 38</code></pre>
<br>
What I don't understand is how was this not a problem before, and
why isn't this in the default lxc config files for debian. And if
this is worth reporting to the debian packaging team.<br>
<br>
I still have a problem starting the boinc service related to
keyctl, but the problem is resolved if I modify the systemd unit
file to not switch to the boinc user and remain as root instead.<br>
<br>
On 01/04/2018 04:02 AM, Pavol Cupka wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAH4oapdYM5k-vQiWKAq1FyYW3YioQsRqDqW8YVECTuWui0eT+A@mail.gmail.com">
<div dir="ltr">could be cgroups v2 related.<br>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr">On Tue, Jan 2, 2018 at 7:49 AM
<a class="moz-txt-link-rfc2396E" href="mailto:lxc@brak.space"><lxc@brak.space></a> wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
I'm having trouble running buster containers on debian
Buster/Sid. I'm<br>
using the download template with unprivileged containers and
plain lxc<br>
no lxd. The container is created no problem, however, it seems
the<br>
created container does not have a systemd, and hence basically
nothing<br>
works.<br>
<br>
What could be causing this. Jessie containers work just fine
for me.<br>
<br>
<br>
Thanks,<br>
<br>
<br>
Paul<br>
<br>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org"
target="_blank" moz-do-not-send="true">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users"
rel="noreferrer" target="_blank" moz-do-not-send="true">http://lists.linuxcontainers.org/listinfo/lxc-users</a></blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
lxc-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a>
<a class="moz-txt-link-freetext" href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a></pre>
</blockquote>
<p><br>
</p>
</body>
</html>