[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-11-04 Thread dann frazier
Marking Invalid again, as the fix is confirmed to be in nvidia- container-runtime and is pending. ** Changed in: docker.io (Ubuntu) Status: Opinion => Invalid -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu.

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-27 Thread dann frazier
@lucaskanashiro I don't doubt the importance of fixing bug 1943049[*]. My concern is that doing so with the current fix will knowingly break nvidia-container-runtime users. Of course, if this is due to a bug in nvidia-container-runtime, they should fix that. But at this point (AFAICT) there still

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-27 Thread Lucas Kanashiro
@dann, the patch you mentioned is really needed to fix the issue reported in LP #1943049. Without this patch we will not be able to launch/build any Impish based (or greater Ubuntu version) container in any of the supported Ubuntu releases (this is because of the glibc version we are using). The

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-27 Thread dann frazier
fyi, this issue goes away if I rebuild docker.io w/ the following Ubuntu patch dropped: debian/patches/seccomp-add-support-for-clone3-syscall-in-default- policy.patch So should we reopen this until we understand what is going on? -- You received this bug notification because you are a member

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-27 Thread dann frazier
I suggest we debug in https://github.com/NVIDIA/nvidia-container- runtime/issues/157 to avoid duplication. Of course, should that debug highlight an issue with Ubuntu's container stack, we can then reopen this LP. -- You received this bug notification because you are a member of Ubuntu Bugs,

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-27 Thread Evan Lezar
The nvidia-contaier-runtime is a simple shim for the runc installed on the system. It makes a modification to the OCI spec (inserting a prestart hook) before execing to runc directly. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu.

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-27 Thread Evan Lezar
Hi Lucas, Ian, Just as a matter of interest, what are the versions of the packages of the NVIDIA Container Stack packages installed on the system where the failure occurs? Could you run: ``` apt list --installed *nvidia* ``` -- You received this bug notification because you are a member of

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-26 Thread Lucas Kanashiro
Based on the comment above I believe this is a bug in the nvidia-docker stack (coming from a third party PPA) and not in docker itself. I am marking this bug as Invalid. ** Changed in: docker.io (Ubuntu) Status: New => Invalid -- You received this bug notification because you are a

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-26 Thread Athos Ribeiro
While trying to reproduce this bug on a focal machine, I realized that the tests runs through the nvidia-docker wrapper. running $ nvidia-docker run --rm -it docker.io/ubuntu:latest /bin/bash Crashes with the reported error "docker: Error response from daemon: failed to create shim: OCI

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-26 Thread dann frazier
I've filed a bug here to get it on Nvidia's radar, in case the fix is required there: https://github.com/NVIDIA/nvidia-container-runtime/issues/157 ** Bug watch added: github.com/NVIDIA/nvidia-container-runtime/issues #157 https://github.com/NVIDIA/nvidia-container-runtime/issues/157 -- You

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-26 Thread dann frazier
Note that this test runs with a non-Ubuntu docker runtime (runc) from an Nvidia repo, which allows GPUs to be passed through to containers. AIUI, this update required some interface change to our runc - perhaps the same change(s) is needed on their side? -- You received this bug notification

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-26 Thread Lucas Kanashiro
After a quick look I noticed the test did not run because of an issue with the symlink created, I blindly copied and pasted the commands you provided. After fixing it, I am able to run the tests but it failed in my VM because there is not enough disk space to run it. I'll be allocating a VM with

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-26 Thread Lucas Kanashiro
Hi Ian, Thanks for the bug report. However, I was not able to reproduce the failure with the steps that you provided. I did the following in a Focal VM with proposed enabled and docker.io/20.10.7-0ubuntu5~20.04.1 installed: ubuntu@focal:~$ dpkg -l docker.io

[Bug 1948361] Re: docker.io - error adding seccomp filter rule for syscall clone3

2021-10-25 Thread Ian May
** Description changed: Encountered the following error using the docker.io package in focal- proposed running the autotest-client- test/ubuntu_performance_deep_learning test. "docker: Error response from daemon: failed to create shim: OCI runtime create failed: