Uploaded image for project: 'Quarkus'
  1. Quarkus
  2. QUARKUS-3451

Podman 4.6 and newer does not work properly with SELinux and test-containers

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • 3.2.6-Ghost.GA
    • team/docs
    • None
    • False
    • None
    • False
    • ---

      Ryuk container[1] which is essential for proper working of testcontainers library (used for Quarkus devmode) can not be started when using podman.

      There are several issues[2]:
      1. By default, ryuk fails with "permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock". This can be solved by adding "label=false" into containers.conf file.
      2. If SELinux is enabled in OS but disabled in the containers.conf file, there is error "com.github.dockerjava.api.exception.InternalServerErrorException: Status 500:

      {"cause":"netavark (exit code 1): code: 4, msg: Fatal: can't open lock file /run/xtables.lock: Permission denied\n","message":"netavark (exit code 1): code: 4, msg: Fatal: can't open lock file /run/xtables.lock: Permission denied\n","response":500}

      ". This can be solved by disabling SELinux altogether: "sudo setenforce 0".
      3. Finally, there is an error "com.github.dockerjava.api.exception.InternalServerErrorException: Status 500:

      {"cause":"OCI permission denied","message":"crun: write to `/proc/self/oom_score_adj`: Permission denied: OCI permission denied","response":500}

      ", which doesn't have any workaround yet.

      For now, it seems, that the best course of action is to avoid using ryuk containers altogether or stick to the older version of podman (4.5.x, the same as in RHEL 8/9).

      [1] https://hub.docker.com/r/testcontainers/ryuk
      [2] https://github.com/containers/podman/discussions/20206

              rhn-support-ggastald George Gastaldi
              rhn-support-fdudinsk Fedor Dudinskii
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: