Root cause narrowed down to AppArmor signal mediation. On 7.0.0-42 and -43, the kernel log shows docker-default denying gosu's signals to its own threads, with the peer labelled as a stack:
apparmor="DENIED" operation="signal" class="signal" profile="docker-default" pid=30562 comm="gosu" requested_mask="send" denied_mask="send" signal=rtmin+1 peer="docker-default//&unconfined" pid 30562 is the stuck gosu process. SIGRTMIN+1 is the signal Go's runtime uses for doAllThreadsSyscall (setuid/setgid on every thread). The threads never receive it, so the main thread spins in sched_yield forever. Counts of gosu signal denials per boot on the same host: 7.0.0-38: 0 7.0.0-42: 34x rtmin (+ int/term/urg) 7.0.0-43: 22x rtmin Control test: the same gosu 1.19 binary on 7.0.0-42 in a minimal KVM guest on the same CPU (no AppArmor policy, no Docker) completes instantly. So scheduling/futex are fine; the regression is that a container task's own threads are now labelled "docker-default//&unconfined" instead of "docker-default", so docker-default's "signal peer=docker-default" rule no longer matches. Affects any Docker container under the docker-default profile whose entrypoint drops privileges with Go >= 1.16-style all-threads setuid (official mariadb/postgres/mongo images). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172422 Title: Regression 7.0.0-42/-43: Go 1.24 programs livelock in setuid (gosu); official DB Docker images hang on start To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172422/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
