gvisor check fails on containers under RHEL host about grist-core HOT 3 CLOSED

runsc can be set up to do extensive logging

Found docs - works like this

    runsc --network none -unprivileged -ignore-cgroups --debug --debug-log=/dev/stderr do ls

which spams a stack trace and also says

    panic: unable to attach: operation not permitted

which means ptrace - which you also said.

Adding ptrace cap fixes the issue:

    docker run -it --cap-add=SYS_PTRACE gristlabs/grist /bin/bash

Maybe add SYS_PTRACE to the docs page faq section as well as the XSAVE processor flag?

Thanks!

from grist-core.

Hmm, do you know if you have the SYS_PTRACE capability?

One option for debugging is to run /bin/bash on the container, and then try running runsc in various ways, outside of Grist. runsc can be set up to do extensive logging.

For example, for me this command succeeds and shows a directory listing:

paulfitz@entwash:~/cvs/grist-core$ docker run -it gristlabs/grist /bin/bash
root@203def292848:/grist# runsc --network none -unprivileged -ignore-cgroups do ls
...

If it fails for you, then maybe you could enable logging on it (I forget the details but runsc documentation should be clear) and see what is up?

from grist-core.

@gabriel-v there was a documentation update based in part on your suggestion, thanks.
gristlabs/grist-help#330

from grist-core.