nestybox / nestybox/sysbox

docker OPA plugin fails to start with "default-runtime": "sysbox-runc"

Open
#734 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

I've bumped into an issue when running sysbox simultanously with this docker plugin.

When setting sysbox as default runtime the following errors, even when configured plugin not to use hostnetwork
Sep 13 15:15:51 kata-testing dockerd[1102769]: time="2023-09-13T15:15:51.065032021Z" level=error msg="failed to enable plugin" error="failed to create task for container: failed to create shim task: OCI runtime create failed: container_linux.go:424: starting container process caused: process_linux.go:404: getting the final child's pid from pipe caused: EOF: unknown" id=d484abad1799472ea722c78145161a18758b8a5cf966edfa4dfb8202717a3ef9
If I change default runtime to runc, everything works like a charm. But the thing is I need sysbox to be the default runtime

steps to reproduce:

env:
Ubuntu 20.04.6 LTS
docker-ce/focal,now 5:24.0.5-1ubuntu.20.04focal
sysbox-ce/now 0.6.1.linux amd64
build,install,enable opa docker plugin

plugin config.json:

{
    "description": "A policy-enabled authorization plugin for Docker",
    "documentation": "https://www.openpolicyagent.org/docs/docker-authorization/",
    "entrypoint": [
        "/opa-docker-authz"
    ],
    "args": {
        "name": "opa-args",
        "description": "Arguments for opa-docker-authz",
        "settable": ["value"],
        "value": ["-policy-file","/opa/config/authz.rego"]
    },
    "interface": {
        "socket": "opa-docker-authz.sock",
        "types": ["docker.authz/1.0"]
    },
    "network": {
        "type": "bridge"
    },
    "mounts": [
       {
            "name": "policy",
            "source": "/etc/docker",
            "destination": "/opa",
            "type": "none",
            "options": ["bind", "ro"],
            "settable": ["source"]
       }
    ],
    "workdir": "/opa"
}

/etc/docker/daemon.json

{
    "debug": true,
    "default-runtime": "runc",
    "authorization-plugins": ["openpolicyagent/opa-docker-authz-v2:0.8"],
    "runtimes": {
            "sysbox-runc": {
            "path": "/usr/bin/sysbox-runc"
        }
    }
}

/etc/docker/config/authz.rego:

package docker.authz

default allow := false

allow {
    not deny
}

deny {
    seccomp_unconfined
}

seccomp_unconfined {
    input.Body.HostConfig.SecurityOpt[_] == "seccomp:unconfined"
}

sudo systemctl restart docker.service

sudo docker ps
error during connect: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json": EOF

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure using the plugin config.json, /etc/docker/daemon.json, and authz.rego shown in the report, with sysbox-runc as Docker's default runtime. Compare startup with runc and inspect the Docker plugin entrypoint and runtime configuration. Done means the OPA plugin starts and docker ps works while sysbox-runc remains the default runtime.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.