docker not working since omv-upgrade

    • Official Post

    apparmor is installed by default now on Debian installs. I would have to look to see if it is installed in a very minimal netinstall (been awhile).


    Like I said before, apparmor is not bad. The decision to disable apparmor in grub was just because apparmor being disabled is the default with the OMV iso and lots of existing OMV installs.


    With OMV 7, I think apparmor should be enabled by default. I will see what I can come up with for omv-extras installing docker. I might add a checkbox to let the user choose if apparmor is enabled or disabled.

    Interesting... So I was just looking at this again. Again, install over mini debian...


    so apparmor I apparently have installed, but not apparmor-utils. I didn't think to just check apparmor... as I figured if it was installed, apparmor-utils was installed.

    • Official Post

    so apparmor I apparently have installed, but not apparmor-utils. I didn't think to just check apparmor... as I figured if it was installed, apparmor-utils was installed.

    That doesn't surprise me. Installing apparmor-utils will cause no issues if apparmor is already installed.

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • apparmor is installed by default now on Debian installs. I would have to look to see if it is installed in a very minimal netinstall (been awhile).


    Like I said before, apparmor is not bad. The decision to disable apparmor in grub was just because apparmor being disabled is the default with the OMV iso and lots of existing OMV installs.


    With OMV 7, I think apparmor should be enabled by default. I will see what I can come up with for omv-extras installing docker. I might add a checkbox to let the user choose if apparmor is enabled or disabled.

    ryecoaaron, thanks for your solution. But just so I understand, by running your commands it disables apparmor and will allow me to install the pending updates without any issues? Also, will this only have to be done once? Sorry still in the learning stage when it comes to this..

  • Check your journal log. Mine was heavily flooded with this line after the docker updates.


    Code
    AVC apparmor="ALLOWED" operation="ptrace" profile="docker-default"

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    • Official Post

    But just so I understand, by running your commands it disables apparmor and will allow me to install the pending updates without any issues?

    There is nothing keeping you from installing the updates. The commands just disable apparmor at the OS level (most OMV installs don't have apparmor installed) to tell docker not to try to run apparmor commands. So, you should be good to install updates like normal after running the commands.


    Also, will this only have to be done once?

    Yes.

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    • Official Post

    Check your journal log. Mine was heavily flooded with this line after the docker updates.

    I would expect this with apparmor installed and enabled. Do you have it disabled?

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • apparmor and apparmor-utils were installed and enabled but this log flooding didn't start happening until I installed the most recent docker updates.


    I have removed apparmor and apparmor-utils. Even with that done I think I had to run the commands to disable it to quiet the log.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    • Official Post

    this log flooding didn't start happening until I installed the most recent docker updates.

    I don't think docker was enabling the docker-default profile until this recent update.


    Even with that done I think I had to run the commands to disable it to quiet the log.

    Yep, even with the apparmor service disabled (no profiles will be loaded), docker enables the docker-default profile whenever you start a container.

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • I don't think docker was enabling the docker-default profile until this recent update.


    Yep, even with the apparmor service disabled (no profiles will be loaded), docker enables the docker-default profile whenever you start a container.

    Yikes! I have my journal logs capped at some reasonable size but I wonder what the default is?

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    • Official Post

    I wonder what the default is?

    I thought it was 4G.

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • I know how to prevent arbitrary user defined stuff from being written to the syslog, but I don't think this is possible for the journal log.


    So, if I understand it correctly, the latest docker updates require either installing apparmor and apparmor-utils (which allows dockers to run) and also having to accept the mentioned journal log flooding, or disabling apparmor at the OS level to allow docker to run.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

  • Thanks to @ryecoaaron your solution worked for me.


    Weird thing is though, out of 25+ containers the only one that worked straight away after the update was frigate(12 beta 7), which I noticed had 'privileged: true'. Very weird.


    Also had to reinstall portainer.


    But thanks again, all seems well now.

    • Official Post

    So, if I understand it correctly, the latest docker updates require either installing apparmor and apparmor-utils (which allows dockers to run) and also having to accept the mentioned journal log flooding, or disabling apparmor at the OS level to allow docker to run.

    The latest updates only need apparmor-utils IF apparmor is not disabled at the OS level. Unfortunately, apparmor-utils depends on apparmor.


    I just installed a fresh minimal Debian 11 system (which does have apparmor installed and enabled but not apparmor-utils) and then ran the install script. I then installed docker and portainer from omv-extras. Container works fine. Not sure why it doesn't need apparmor-utls. I'm not seeing the logs being spammed. Where are you seeing the logging?

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • Some users have reported this. I think they just clicked install Portainer again and it worked. Not really sure why it's effecting some and not others.

    This won't cause me to have to re-install Plex or qBit within Portainer will it? Those took a while for me to set up because I'm a novice

    Version: 7.0-32 (Sandworm)

    Kernel: Linux 6.1.0-18-amd64

    • Official Post

    This won't cause me to have to re-install Plex or qBit within Portainer will it? Those took a while for me to set up because I'm a novice

    No. And reinstalling portainer doesn't mean you have to set anything back up either. The container just needs to be removed and recreated.

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

    • Official Post

    I saw it when running:


    sudo journalctl -b

    I only see lines from apparmor starting at boot on my fresh system. Installing apparmor later in a system's life definitely seems to cause odd problems. I still can't get portainer to run on a test system from a few months ago when I enable apparmor at the OS level.

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • Just for information purposes, I grep'd the journal log for the string being flooded.


    The log was being spewed at a rate of 563 lines/second. I stopped scrolling the list at a little more than half a million lines. No idea how much more of it is there.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    • Official Post

    Just for information purposes, I grep'd the journal log for the string being flooded.


    The log was being spewed at a rate of 563 lines/second. I stopped scrolling the list at a little more than half a million lines. No idea how much more of it is there.

    Is one of your containers doing a ptrace?

    omv 7.0.5-1 sandworm | 64 bit | 6.5 proxmox kernel

    plugins :: omvextrasorg 7.0 | kvm 7.0.11 | compose 7.1.3 | k8s 7.1.0-3 | cputemp 7.0 | mergerfs 7.0.3


    omv-extras.org plugins source code and issue tracker - github - changelogs


    Please try ctrl-shift-R and read this before posting a question.

    Please put your OMV system details in your signature.
    Please don't PM for support... Too many PMs!

  • Is one of your containers doing a ptrace?

    I dunno, how can I tell? Here again is the spewed line:


    Code
    Feb 03 13:36:21 omv audit[11450]: AVC apparmor="ALLOWED" operation="ptrace" profile="docker-default" pid=11450 comm="apps.plugin" requested_mask="read" denied_mask="read" peer="unconfined"


    Edit:


    My netdata container has cap_add: SYS_PTRACE enabled.

    --
    Google is your friend and Bob's your uncle!


    OMV AMD64 7.x on headless Chenbro NR12000 1U 1x 8m Quad Core E3-1220 3.1GHz 32GB ECC RAM.

    Edited once, last by gderf ().

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!