fedora-silverblue

#14 Cannot create/use containers in Fedora 30
Closed by fansari. Opened by fansari.

Closed
Reopen Issue

First I pull the image:

podman pull docker.io/library/fedora:30

rootless containers:

[fansari@bat ~]$ podman run -it docker.io/library/fedora:30 /bin/bash
Error: slirp4netns failed

I have no idea what this is.

Next I try to create a container as root:

[root@bat ~]# podman run -it docker.io/library/fedora:30 /bin/bash
[root@e69c4053e45a /]#

The creation of the container works. But if I now want to install a package this fails.

[root@e69c4053e45a /]# dnf install which
Fatal Python error: initfsencoding: unable to load the file system codec
ModuleNotFoundError: No module named 'encodings'
Current thread 0x00007f1a4c190680 (most recent call first):
Aborted (core dumped)

Also I want to mention that already existing F29 containers fail to start.

cannot start a container that has stopped
Error: unable to start container "ldap": `/usr/bin/runc start 8158db0aae5a51f6341bbe2061220d12177da61ac64440862a53289f39c06466` failed: exit status 1

So from my point of view containers are completely broken in F30.

I found the first working way to install a container:

podman pull registry.fedoraproject.org/fedora:30
setenforce 0
podman run -it registry.fedoraproject.org/fedora:30 /bin/bash
dnf install which

This way it is working.

Trying the same thing from docker.io/library/fedora:30 end with a segmentation fault.

[root@bat system]# podman run -it docker.io/library/fedora:30 /bin/bash
[root@d36279f3e5c6 /]# dnf install which
Fedora Modular 30 - x86_64                                                                                                                                                                                    1.8 MB/s | 2.1 MB     00:01    
Fedora Modular 30 - x86_64 - Updates                                                                                                                                                                          234  B/s | 257  B     00:01    
Fedora Modular 30 - x86_64 - Test Updates                                                                                                                                                                     2.0 MB/s | 2.9 MB     00:01    
Fedora 30 - x86_64 - Test Updates                                                                                                                                                                             7.7 MB/s |  16 MB     00:02    
Fedora 30 - x86_64 - Updates                                                                                                                                                                                  275  B/s | 257  B     00:00    
Segmentation fault (core dumped)                                                                    75% [==========================================================================-                        ]  42 kB/s |  15 kB     00:00 E

Now I go back to the container from registry.fedoraproject.org/fedora:30 but enter enforcing mode.

[root@bat system]# setenforce 1
[root@bat system]# podman exec -it friendly_hoover /bin/bash
[root@bc0a6e382f42 /]# dnf install procps-ng
Fatal Python error: initfsencoding: unable to load the file system codec
ModuleNotFoundError: No module named 'encodings'
Current thread 0x00007fa755059680 (most recent call first):
Aborted (core dumped)

This is what I see in the audit.log:

type=USER_AVC msg=audit(1555868827.236:567): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=1)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'UID="root" AUID="unset" SAUID="root"
type=ANOM_ABEND msg=audit(1555868840.781:568): auid=1000 uid=0 gid=0 ses=3 subj=system_u:system_r:container_t:s0:c144,c560 pid=14232 comm="dnf" exe="/usr/bin/python3.7" sig=6 res=1AUID="fansari" UID="root" GID="root"
type=SERVICE_START msg=audit(1555868840.794:569): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@11-14233-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
type=SERVICE_STOP msg=audit(1555868841.003:570): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-coredump@11-14233-0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
Edited by fansari

Running F30, selinux enabled and enforcing.

I tried the following:

$ podman run -it hello-world
Error: slirp4netns failed

And saw this in the journal:

May 05 09:10:53 polis.friocorte.com kernel: SELinux: mount invalid.  Same superblock, different security settings for (dev mqueue, type mqueue)

Nothing shows up in the audit log.

If I use --net=host it works.

Running F30, selinux enabled and enforcing.
I tried the following:
$ podman run -it hello-world
Error: slirp4netns failed

And saw this in the journal:
May 05 09:10:53 polis.friocorte.com kernel: SELinux: mount invalid. Same superblock, different security settings for (dev mqueue, type mqueue)

Nothing shows up in the audit log.
If I use --net=host it works.

You can get some additional logs using podman --log-level=debug when running the command.

The SELinux message that you see is actually a mis-leading error; it is benign and known to appear during normal operation. See this RHBZ - https://bugzilla.redhat.com/show_bug.cgi?id=1425278

I'd suggest you take this issue to the upstream podman folks; they'll have a better set of knowledge to help you out - https://github.com/containers/libpod

All this stuff seems to be fixed now.

Still I have SELinux issues summarized here:

https://bugzilla.redhat.com/show_bug.cgi?id=1707087

Metadata Update from @fansari:
- Issue status updated to: Closed (was: Open)

My problem didn't get fixed with an upgrade, however I did fix my issue which was related to https://bugzilla.redhat.com/show_bug.cgi?id=1706093

Copied my selinux files over the ones in /etc/
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.