https://bugzilla.redhat.com/show_bug.cgi?id=1144636
Bug ID: 1144636 Summary: Docker fails to start on systems with SELinux and btrfs Product: Fedora Version: 20 Component: docker-io Severity: urgent Assignee: lsm5@fedoraproject.org Reporter: voxadam@gmail.com QA Contact: extras-qa@fedoraproject.org CC: admiller@redhat.com, golang@lists.fedoraproject.org, hushan.jia@gmail.com, jperrin@centos.org, lsm5@fedoraproject.org, mattdm@redhat.com, mgoldman@redhat.com, s@shk.io, thrcka@redhat.com, vbatts@redhat.com External Bug ID: Red Hat Bugzilla 1128041 External Bug ID: Red Hat Bugzilla 1128041
Description of problem:
The Docker daemon fails to start on systems with SELinux and btrfs
Version-Release number of selected component (if applicable):
Kernel: 3.16.2-200.fc20.x86_64 #1 SMP Docker: 1.2.0 (2.fc20) libselinux: 2.2.1 (6.fc20)
How reproducible:
Incredibly so.
Steps to Reproduce: 1. Install F20 on btrfs 2. systemctl start docker 3. Bang head against desk
Actual results:
adam@dekatron ~/bin sudo systemctl start docker [sudo] password for adam: Job for docker.service failed. See 'systemctl status docker.service' and 'journalctl -xn' for details. ✘ adam@dekatron ~/bin journalctl -xn -- Logs begin at Wed 2014-09-17 14:41:46 PDT, end at Fri 2014-09-19 18:18:26 PDT. -- Sep 19 18:18:18 dekatron.voxadam.com docker[7517]: 2014/09/19 18:18:18 SELinux is not supported with the BTRFS graph driver! Sep 19 18:18:18 dekatron.voxadam.com systemd[1]: docker.service: main process exited, code=exited, status=1/FAILURE Sep 19 18:18:18 dekatron.voxadam.com systemd[1]: Failed to start Docker Application Container Engine. -- Subject: Unit docker.service has failed -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
Tomas Tomecek ttomecek@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ttomecek@redhat.com
--- Comment #1 from Tomas Tomecek ttomecek@redhat.com --- Suggested workaround by Dan Walsh:
remove --selinux-enabled from /etc/sysconfig/docker
https://github.com/docker/docker/issues/7952#issuecomment-56435657
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
Lokesh Mandvekar lsm5@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED
--- Comment #2 from Lokesh Mandvekar lsm5@fedoraproject.org --- (In reply to Tomas Tomecek from comment #1)
Suggested workaround by Dan Walsh:
remove --selinux-enabled from /etc/sysconfig/docker
https://github.com/docker/docker/issues/7952#issuecomment-56435657
Dan's patch: http://pkgs.fedoraproject.org/cgit/docker-io.git/tree/ignore-selinux-if-disa... should ignore selinux if it's disabled. This patch has been added since docker-io-1.2.0-3 . Could you check if this issue still exists.
Also, if --selinux-enabled has to be removed from /etc/sysconfig/docker, I'd guess that'd need to be done only on selinux-disabled systems, so that'd need no changes in the rpm itself. Let me know.
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
--- Comment #3 from Tomas Tomecek ttomecek@redhat.com --- Still not working for me: I had to go for workaround:
(alias sc="systemctl")
$ sc start docker Job for docker.service failed. See 'systemctl status docker.service' and 'journalctl -xn' for details.
$ sc status docker ● docker.service - Docker Application Container Engine Loaded: loaded (/usr/lib/systemd/system/docker.service; static) Active: failed (Result: exit-code) since Fri 2014-10-03 09:22:36 CEST; 9s ago Docs: http://docs.docker.com Process: 15807 ExecStart=/usr/bin/docker -d -H fd:// $OPTIONS $DOCKER_STORAGE_OPTIONS (code=exited, status=1/FAILURE) Main PID: 15807 (code=exited, status=1/FAILURE)
Oct 03 09:22:36 quahog docker[15807]: 2014/10/03 09:22:36 docker daemon: 1.2.0 fa7b24f/1.2.0; execdriver: native; graphdriver: Oct 03 09:22:36 quahog docker[15807]: [4d8d9691] +job serveapi(fd://) Oct 03 09:22:36 quahog docker[15807]: 2014/10/03 09:22:36 SELinux is not supported with the BTRFS graph driver! Oct 03 09:22:36 quahog systemd[1]: docker.service: main process exited, code=exited, status=1/FAILURE Oct 03 09:22:36 quahog systemd[1]: Failed to start Docker Application Container Engine. Oct 03 09:22:36 quahog systemd[1]: Unit docker.service entered failed state.
$ rpm -q docker-io docker-io-1.2.0-3.fc21.x86_64
$ getenforce Permissive
$ cat /etc/sysconfig/docker OPTIONS=--selinux-enabled
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
--- Comment #4 from Lokesh Mandvekar lsm5@fedoraproject.org --- Tomas, so I'd guess removing --selinux-enabled from /etc/sysconfig/docker works fine for you, correct?
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
--- Comment #5 from Tomas Tomecek ttomecek@redhat.com --- Yes
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
Lokesh Mandvekar lsm5@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- CC|lsm5@fedoraproject.org | Assignee|lsm5@fedoraproject.org |lsm5@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
Daniel Walsh dwalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |NOTABUG Last Closed| |2015-03-09 20:35:52
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
--- Comment #6 from Michael Monreal michael.monreal+bugs@gmail.com --- So, will this never be supported? Time to re-install with another filesystem? :(
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
--- Comment #7 from Daniel Walsh dwalsh@redhat.com --- Sadly unless some Kernel File System picks up the support, I am doubtful. Red Hat plans on concentrating on OverLayFS and DeviceMapper as the preferred docker backends.
https://bugzilla.redhat.com/show_bug.cgi?id=1144636
--- Comment #8 from Peter Meier peter.meier@immerda.ch --- There seems to be an upstream patch for that:
https://marc.info/?l=git-commits-head&m=141302939209611&w=2
From: https://github.com/docker/docker/issues/7952
golang@lists.fedoraproject.org
-
Red Hat Bugzilla