The problem is independent of Docker version.
Tested with:
- docker.io 29.1.3
- docker.io 24.0.7
Both exhibit identical behaviour.
Inside the container:
CapEff includes CAP_SYS_ADMIN.
The following all fail:
mount -t tmpfs tmpfs /mnt
mount -t proc proc /mnt
mount --bind /etc /mnt
strace shows:
mount("tmpfs", "/mnt", "tmpfs", 0, NULL)
= -1 EACCES
Running the same container with
--security-opt apparmor=unconfined
makes the mount succeed immediately.
No AppArmor audit messages are produced.
No AVC messages appear.
No dmesg messages appear.
This appears to be an interaction between docker-default AppArmor
confinement and Ubuntu 24.04 HWE kernel 7.0.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162651
Title:
The AppArmor profile generated by docker.io 29.1.3 prevents tmpfs
mounts inside containers, even when the container has CAP_SYS_ADMIN.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/docker.io-app/+bug/2162651/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
