[ Forgot to "Reply All". Re-sending to bug tracker ] On Mon, Aug 10, 2015 at 4:23 AM, Jochem Raat <[email protected]> wrote: > On 10-08-15 02:10, Thompson, David wrote: >> Hello Jochem, >> >> Thanks for the report. I've done some work to fix these in our >> master, but perhaps you have a situation that I haven't addressed. >> The container functionality requires a relatively recent version (3.8, >> I think) of Linux in order to work. >> >> What version of Linux are you using? > > I think I am running linux 3.13 ('uname -r' returns: 3.13.0-30-generic). > >> What is the output of 'ls -l /proc/self/ns'? > > 'ls -l /proc/self/ns' returns: > total 0 > lrwxrwxrwx 1 jm jm 0 aug 10 10:12 ipc -> ipc:[4026531839] > lrwxrwxrwx 1 jm jm 0 aug 10 10:12 mnt -> mnt:[4026531840] > lrwxrwxrwx 1 jm jm 0 aug 10 10:12 net -> net:[4026531956] > lrwxrwxrwx 1 jm jm 0 aug 10 10:12 pid -> pid:[4026531836] > lrwxrwxrwx 1 jm jm 0 aug 10 10:12 user -> user:[4026531837] > lrwxrwxrwx 1 jm jm 0 aug 10 10:12 uts -> uts:[4026531838] >
Thanks. So, you have a new enough kernel for all 6 user namespaces to work but the 'setgroups' interface is not present. I did some reading in the user_namespaces(7) man page and found that using setgroups became a requirement in Linux 3.19 and only kernels may not have it. I took a look at an Ubuntu 14.04 machine which also runs a 3.13 kernel and /proc/self/setgroups exists, so indeed it is an optional thing. The fix will be to test if /proc/self/setgroups exists before writing to it. I'll have this fixed next time I get a chance to hack. Thanks again for reporting this issue! - Dave
