Error setting rlimits type 8 (operation not permitted: unknown) in LXD container

LXD
1

Hello all,

I have an LXD container running Ubuntu 20.04 with security.nesting set to true and security.privileged set to false. I have installed docker and docker-compose on the container:

~$ docker -v
Docker version 20.10.2, build 2291f61
~$ docker-compose -v
docker-compose version 1.27.4, build 40524192

I tried to install OpenEDX using tutor (as explained here: https://docs.tutor.overhang.io/index.html). Tutor is running OpenEDX application processes in separated docker containers. At some point during the installation (of the elasticsearch component it seems), the following command is called:

docker-compose -f /home/ubuntu/.local/share/tutor/env/local/docker-compose.yml -f /home/ubuntu/.local/share/tutor/env/local/docker-compose.prod.yml --project-name tutor_local up --remove-orphans -d

causing the following error:

ERROR: for elasticsearch  Cannot start service elasticsearch: OCI runtime create failed: container_linux.go:370: starting container process caused: process_linux.go:459: container init caused: process_linux.go:382: setting rlimits for ready process caused: error setting rlimit type 8: operation not permitted: unknown
ERROR: Encountered errors while bringing up the project.
Error: Command failed with status 1: docker-compose -f /home/ubuntu/.local/share/tutor/env/local/docker-compose.yml -f /home/ubuntu/.local/share/tutor/env/local/docker-compose.prod.yml --project-name tutor_local up --remove-orphans -d

I tried executing the last command using sudo but the same error occurs.

Do you have any idea how to fix the problem with rlimits? (by changing the configuration of the LXD container maybe?)

Thanks a lot

2

@stgraber @brauner should we be able to set rlimits in a container?

@rfruit have you considered using an LXD VM as this will no doubt work as it has a separate kernel.

3

Thanks a lot for your quick reply!

I did not know about LXD VM, thanks for your suggestion! I will try.

4

Yes you can add --vm to the launch or init commands and you’ll get a VM rather than a container.

E.g.

lxc launch images:ubuntu/focal v1 --vm
1 Like
5

This tries to increase RLIMIT_MEMLOCK in the container which works. The problem usually is that you’re exceeding the limit set in the initial user namespace. Please see
https://linuxcontainers.org/lxd/docs/master/production-setup
which also details how to tune memlock.

1 Like
6

Thanks a lot!
I set limits.kernel.memlock to unlimited and it worked!

lxc config set MyContainer limits.kernel.memlock unlimited

Just out of curiosity, how did you know that it was RLIMIT_MEMLOCK that was being set? just based on the logs?

1 Like
7

I’ve been working on the kernel for too long apparently and know how to map 8 to the corresponding #define. :sweat_smile:

1 Like