Can't unshare mount namespace centos 7.3

[Brian_McQueen (mcqueen)]

I need a workaround. Trying to get unprivileged containers going on RH7. I’ve already tried all suggestions I can find, but it looks like they work a few kernel revs after mine. Here’s the best I could find: (best link which is actually from this board) I’m stuck at specific version for a big-corporation amount of time. I’ve got the kernel flags in, still can’t unshare! I need to get around this without patching the kernel. Any suggestions?

> cat /proc/cmdline 
BOOT_IMAGE=/boot/vmlinuz-3.10.0-514.55.4.el7.x86_64 root=UUID=ugly ro crashkernel=auto rhgb quiet user_namespace.enable=1 namespace.unpriv_enable=1
> unshare -m sh
unshare: unshare failed: Operation not permitted
> #stuck

[stgraber (Stéphane Graber)]

There are kernel sysctls to set quotas on the number of the various namspaces, maybe your system is somehow configured to only allow a single mount namespace?

Also, are you running those commands as root? If run as a user, you won’t be able to unshare a mount namespace without unsharing a user namespace first.

[Brian_McQueen (mcqueen)]

That second tip is a good lesson. This bit, “you won’t be able to unshare a mount namespace without unsharing a user namespace first”.

Still not working, but its good to know that concept.

[tomp (Thomas Parrott)]

You have user namespace enabled in kernel boot line, which is good.

user_namespace.enable=1

Try running also:

sysctl user.max_user_namespaces=10000

[brauner (Christian Brauner)]

We’ve had that question quite a bit and I tracked down all the necessary bits and pieces once:

CENTOS 7 - Kernel 514 - 693 Cannot start any nodes after update

Ok, so this was fun to track down again. The problem is that by default RHEL7 and friends disallow a) creation of user namespaces and b) creation of mount namespaces in user namespaces. Both are problematic for unprivileged containers. To solve a) you have to boot your kernel with user_namespace.enable=1 on the kernel command line. Unless there’s a sysctl I’m unaware of. Now, about b). I took a closer look at the RHEL7 kernel sources. (Getting at the kernel sources for RHEL7 is… interesting. I…

@stgraber also posted here:

LXD on Centos 7

Introduction A lot of people have been asking us how to run LXD on Centos/RHEL 7 in the past. Up until now, our answer has usually been to use some of the Fedora packages for liblxc, combined with a hand built version of LXD that you then have to manually integrate with your system. So certainly doable but not exactly clean or easy. But now there is finally a cleaner, much more supportable way for you to get LXD on those systems as there is now a build of snapd that works with Centos/RHEL, let…

[Brian_McQueen (mcqueen)]

That (sysctl user.max_user_namespaces=10000) gives the surprising

sysctl: cannot stat /proc/sys/user/max_user_namespaces: No such file or directory

Its not in /proc! Its like my kernel is some tiny step below compatibility.

I do have both of the recommended kernel flags in place. Its shown at the top of the thread.

[tomp (Thomas Parrott)]

It looks like those sysctls didn’t appear until RHEL 7.4

7.4 Release Notes - Red Hat Customer Portal

So I would suggest you upgrade beyond 7.3 and try it again.

[Brian_McQueen (mcqueen)]

Yea that’s what I’m guessing, but that stinks for my project. At corporate velocities this is an unknown delay. I’m thinking of getting some POC going in VMs just to get it done.