nestybox / nestybox/sysbox

Sysbox doesn't work with estargz compressed images

Open
#781 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

New feature
Dominant language
Shell
Stars
3.9k
Forks
230
Avg merge
7h 48m
Merged PRs (30d)
3

Description

When I attempt to run a Kubernetes pod from a estargz compressed container image I get the following error:

Error: error creating an ID-mapped copy of layer "bd259b14ef7a0ab45d52898b79bd23c80f6c3a7e54911a196ca0791b63327194": exit status 1: error during chown: storage-chown-by-maps: lchown bin: no such device or address

The error seems to be coming from cri-o but when I set the runtimeClassName in my pod spec to runc instead of sysbox-runc , I am able to launch the container without issue.

I have this annotation set in my podspec: io.kubernetes.cri-o.userns-mode: private:uidmapping=0:1048576:65536;gidmapping=0:1048576:65536

This is my /etc/crio/crio.conf:

[crio]

  [crio.api]

  [crio.image]

  [crio.metrics]

  [crio.network]

  [crio.runtime]
    cgroup_manager = "cgroupfs"
    conmon_cgroup = "pod"
    default_capabilities = ["SETFCAP", "AUDIT_WRITE", "NET_RAW", "SYS_CHROOT", "MKNOD", "NET_BIND_SERVICE", "KILL", "CHOWN", "SETGID", "SETUID"]
    pids_limit = 16384

    [crio.runtime.runtimes]

      [crio.runtime.runtimes.sysbox-runc]
        allowed_annotations = ["io.kubernetes.cri-o.userns-mode"]
        runtime_path = "/usr/bin/sysbox-runc"
        runtime_type = "oci"

  [crio.stats]

  [crio.tracing]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by reproducing the Kubernetes pod with the estargz image and compare the sysbox-runc and runc paths, using the provided runtimeClassName, userns-mode annotation, and CRI-O configuration. Done means the estargz image can launch through sysbox-runc without the reported ID-mapped copy error.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.