microsoft / microsoft/vscode-remote-release

Fails to init dev container with usernamespaces enabled in docker.json

Open
#7,397 9 comments 0 reactions 1 assignee View on GitHub

@chrmarti is already working on this.

Since Oct 25, 2022.

bug containers rootless
Dominant language
Dockerfile
Stars
4.2k
Forks
470
Avg merge
1d 1h
Merged PRs (30d)
1

Description

  • VSCode Version: 1.72.2
  • Local OS Version: Windows_NT x64 10.0.25227
  • Remote OS Version: ArchLinux Server with Docker
  • Remote Extension/Connection Type: Containers
  • Logs:
[Warning] One or more build-args [_DEV_CONTAINERS_FEATURE_CONTENT_SOURCE] were not consumed
Successfully built 5af6d5412c4a
Successfully tagged vsc-git_mgmt-87dd506badc5e87333a167fd1faa5b5e:latest
[391177 ms] Start: Run: docker -v
[391200 ms] Start: Run: docker events --format {{json .}} --filter event=start
[391202 ms] Start: Starting container
[391202 ms] Start: Run: docker run --sig-proxy=false -a STDOUT -a STDERR --mount type=volume,src=dind-var-lib-docker,dst=/var/lib/docker --mount type=volume,src=git_mgmt-main-94c26a44277b3cb7a484dca57777b075,dst=/workspaces --mount type=volume,src=vscode,dst=/vscode -l vsch.local.repository=https://github.com/agowa338/git_mgmt.git/tree/main -l vsch.local.repository.volume=git_mgmt-main-94c26a44277b3cb7a484dca57777b075 -l vsch.local.repository.folder=git_mgmt --init --privileged --entrypoint /bin/sh vsc-git_mgmt-87dd506badc5e87333a167fd1faa5b5e -c echo Container started
docker: Error response from daemon: privileged mode is incompatible with user namespaces.  You must run the container in the host namespace when running privileged mode.
See 'docker run --help'.
[391230 ms] Start: Run: docker ps -q -a --filter label=vsch.local.repository=https://github.com/agowa338/git_mgmt.git/tree/main --filter label=vsch.local.repository.volume=git_mgmt-main-94c26a44277b3cb7a484dca57777b075 --filter label=vsch.local.repository.folder=git_mgmt
[390719 ms] Error: Command failed: docker run --sig-proxy=false -a STDOUT -a STDERR --mount type=volume,src=dind-var-lib-docker,dst=/var/lib/docker --mount type=volume,src=git_mgmt-main-94c26a44277b3cb7a484dca57777b075,dst=/workspaces --mount type=volume,src=vscode,dst=/vscode -l vsch.local.repository=https://github.com/agowa338/git_mgmt.git/tree/main -l vsch.local.repository.volume=git_mgmt-main-94c26a44277b3cb7a484dca57777b075 -l vsch.local.repository.folder=git_mgmt --init --privileged --entrypoint /bin/sh vsc-git_mgmt-87dd506badc5e87333a167fd1faa5b5e -c echo Container started
[390719 ms] trap "exit 0" 15
[390719 ms] /usr/local/share/docker-init.sh
[390719 ms] exec "$@"
[390719 ms] while sleep 1 & wait $!; do :; done -
[390719 ms]     at Use (/root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js:1868:1339)
[390719 ms]     at jO (/root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js:1868:1275)
[390719 ms]     at processTicksAndRejections (internal/process/task_queues.js:95:5)
[390719 ms]     at async Xse (/root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js:1874:2030)
[390719 ms]     at async Uf (/root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js:1874:3193)
[390719 ms]     at async Cae (/root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js:1994:10350)
[390719 ms]     at async yae (/root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js:1994:10104)
[390765 ms] Exit code 1
[390766 ms] Start: Run: docker rm -f 95a9642485bb73ec399310e970a8671dbeeaf8806334d285942911824f79c45f
[390770 ms] Command failed: node /root/.vscode-remote-containers/dist/dev-containers-cli-0.255.4/dist/spec-node/devContainersSpecCLI.js up --workspace-folder /workspaces/git_mgmt --workspace-mount-consistency cached --id-label vsch.local.repository=https://github.com/agowa338/git_mgmt.git/tree/main --id-label vsch.local.repository.volume=git_mgmt-main-94c26a44277b3cb7a484dca57777b075 --id-label vsch.local.repository.folder=git_mgmt --log-level debug --log-format json --config /workspaces/git_mgmt/.devcontainer/devcontainer.json --override-config /tmp/devcontainer-96c3744c-467f-4b0d-a6bb-9743cd3f601e.json --default-user-env-probe loginInteractiveShell --mount type=volume,source=git_mgmt-main-94c26a44277b3cb7a484dca57777b075,target=/workspaces,external=true --mount type=volume,source=vscode,target=/vscode,external=true --skip-post-create --update-remote-user-uid-default off --mount-workspace-git-root true --terminal-columns 89 --terminal-rows 16
[390770 ms] Exit code 1
[391270 ms] Container server terminated (code: 137, signal: null).

Steps to Reproduce:

  1. set /etc/docker/daemon.json to {"debug": false, "log-driver": "journald", "userns-remap": "default", "exec-opts": ["native.cgroupdriver=systemd"]}
  2. Create /etc/subuid and /etc/subgid accordingly.
  3. Try to open a git repository in a dev container.
  4. Set permissions on docker socket to 777 (otherwise vs code only shows a permission error while trying to start as it tries to access the docker socket from within a container which has a different namespace and therefore fails if only root and docker group [user] has access).

Does this issue occur when you try this locally?: No
Does this issue occur when you try this locally and all extensions are disabled?: No

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.