Odroid HC2 - Docker 23 - AppArmor issue

steakhutzeee · 28. Februar 2023

Hello,

as others i also have an issue after the latest Docker update.

I'm running an Odroid HC2:

Code

steakhutzeee@dk:~$ uname -a
Linux dk 5.4.230-odroidxu4 #23.02.2 SMP PREEMPT Fri Feb 17 23:42:09 UTC 2023 armv7l GNU/Linux

Docker is running but containers are not starting.

If i try to manually start one i have:

Code

steakhutzeee@dk:~$ docker start heimdall
Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: unable to apply apparmor profile: apparmor failed to apply profile: write /proc/self/attr/exec: no such file or directory: unknown
Error: failed to start containers: heimdall

I tried adding:

extraargs=apparmor=0

to my armbianEnv.txt and rebooted many times but nothing changes:

Code

steakhutzeee@dk:/boot$ cat armbianEnv.txt
rootdev=UUID=9bb27981-aeac-4c2c-bb2d-95aa22509616
rootfstype=ext4
extraargs=apparmor=0
usbstoragequirks=0x2537:0x1066:u,0x2537:0x1068:u

Tried uninstalling and reinstalling Docker from omv-extras tab but issue persists.

My daemon.json file only contains:

Code

steakhutzeee@dk:/etc/docker$ sudo cat daemon.json
{
"data-root": "/srv/dev-disk-by-label-HC2/DockerBasePath/docker"
}

What should i do?

Thank you in advance!

Wolf2000 · 28. Februar 2023

Run it as root or sudo

steakhutzeee · 28. Februar 2023

Zitat von Wolf2000

Run it as root or sudo

It's the same:

Code

steakhutzeee@dk:~$ sudo docker start heimdall
Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: unable to apply apparmor profile: apparmor failed to apply profile: write /proc/self/attr/exec: no such file or directory: unknown
Error: failed to start containers: heimdall

Also, my user is in the docker group.

Wolf2000 · 28. Februar 2023

apt purge apparmor

steakhutzeee · 28. Februar 2023

Zitat von Wolf2000

apt purge apparmor

steakhutzeee@dk:~$ sudo apt purge apparmor

[sudo] password for steakhutzeee:

Reading package lists... Done

Building dependency tree... Done

Reading state information... Done

Package 'apparmor' is not installed, so not removed

0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Wolf2000 · 28. Februar 2023

apt install apparmor apparmor-utils

docker start heimdall

steakhutzeee · 28. Februar 2023

Zitat von Wolf2000

apt install apparmor apparmor-utils

docker start heimdall

But this way i install what i was trying to disable with

Code

extraargs=apparmor=0

Correct?

Wolf2000 · 28. Februar 2023

yes i know let it change at 0 we can still change it

steakhutzeee · 28. Februar 2023

Zitat von Wolf2000

yes i know let it change at 0 we can still change it

Ok, i did apt install apparmor apparmor-utils and restarted.

Now containers are working again.

I did also:

Code

steakhutzeee@dk:~$ systemctl status apparmor
● apparmor.service - Load AppArmor profiles
Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
Active: active (exited) since Tue 2023-02-28 18:15:48 CET; 3min 22s ago
Docs: man:apparmor(7)
https://gitlab.com/apparmor/apparmor/wikis/home/
Process: 392 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=0/SUCCESS)
Main PID: 392 (code=exited, status=0/SUCCESS)
CPU: 147ms

So this is ok? It means that apparmor is installed but has been successfully disabled by extraargs=apparmor=0?

If yes, why i had to install it in the first place?

ryecoaaron · 28. Februar 2023

Zitat von steakhutzeee

So this is ok? It means that apparmor is installed but has been successfully disabled by extraargs=apparmor=0?

If yes, why i had to install it in the first place?

Yes. You have to have it installed because evidently docker doesn't recognize the apparmor is disabled at the OS level on arm systems (well, at least yours). So, it really just needs apparmor-utils but you can't install just that because it is dependent on the apparmor package.

Wolf2000 · 28. Februar 2023

does heimdall work now?

steakhutzeee · 28. Februar 2023

Zitat von Wolf2000

does heimdall work now?

Yes now all containers are working! Thank you @Wolf2000!!

Odroid HC2 - Docker 23 - AppArmor issue

steakhutzeee 28. Februar 2023

Jetzt mitmachen!

Tags