From: "Yann E. MORIN" <yann.morin.1998@free.fr>
To: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Christian Stewart <christian@aperture.us>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/docker-engine: fix runtime problem
Date: Wed, 21 Aug 2024 00:00:49 +0200 [thread overview]
Message-ID: <ZsUSEXO-x4RnuiZG@landeda> (raw)
In-Reply-To: <20240820233250.3293444a@windsurf>
Thomas, All,
On 2024-08-20 23:32 +0200, Thomas Petazzoni via buildroot spake thusly:
> On Tue, 20 Aug 2024 23:26:33 +0200
> "Yann E. MORIN" <yann.morin.1998@free.fr> wrote:
> > On 2024-08-20 17:44 +0200, Waldemar Brodkorb spake thusly:
[--SNIP--]
> > > Add the missing kernel module to allow starting containers.
[--SNIP--]
> > > + $(call KCONFIG_ENABLE_OPT,CONFIG_USER_NS)
> > As far as I can see, this is an optional feature, and is not strictly
> > required:
> > https://github.com/moby/moby/blob/master/contrib/check-config.sh#L235
> > So I don't think we should forecfully enable it.
> On the other hand, Waldemar is encountering the issue while doing a
> simple "docker run <container>", which seems to be like the most basic
> thing you would want to do with docker. So if CONFIG_USER_NS is needed
> for something as basic as starting up a container, I believe it's not
> really an optional feature?
In that case, we are missig way more options, like CGROUP_PIDS, SECCOMP,
MEMCG_SWAP_ENABLED, and a good bunch of others...
The way the moby (alias docker-engine) config-check script make that
flag optional is very peculiar: they run the check in a {} list, which
means any failure is ignored, so their check_flags() failure is ignored
for those options, meaning they really are optional from the point of
view of moby, and they do not require it.
And indeed it is optional, as our runtime test for docker-compose (test
which uses docker-engine) with a custom kernel configuratio nthat does
not have USER_NS, does not fail although it does run multiple
containers...
Regards,
Yann E. MORIN.
--
.-----------------.--------------------.------------------.--------------------.
| Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ |
| +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2024-08-20 22:00 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-20 15:44 [Buildroot] [PATCH] package/docker-engine: fix runtime problem Waldemar Brodkorb
2024-08-20 21:26 ` Yann E. MORIN
2024-08-20 21:32 ` Thomas Petazzoni via buildroot
2024-08-20 22:00 ` Yann E. MORIN [this message]
2024-08-21 6:18 ` TIAN Yuanhao
2024-08-21 7:12 ` Yann E. MORIN
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZsUSEXO-x4RnuiZG@landeda \
--to=yann.morin.1998@free.fr \
--cc=buildroot@buildroot.org \
--cc=christian@aperture.us \
--cc=thomas.petazzoni@bootlin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox