Unable to run filebeat in container runtime/cgo: pthread_create failed: Operation not permitted

Incus
1

From what I understand, all it is trying to do is run a thread. I don’t believe it makes sense to give this container extra permissions as all filebeat is doing is reading and sending logfiles. Perhaps this is something specific with using Ubuntu 24 as a host and some app armor issues? Any help would be appreciated. Thank you

2

Can you provide some more context how you have created the instance?

This would help to replicate and see the issue much faster.

3

Sure thing!
First deploy a log aggregator: I used SigLens for this validation test

  1. Create an Ubuntu 22.04 Container with nesting allowed
  2. Inside that container install Docker as normal (or allow the script below to do so)
  3. curl -L https://siglens.com/install.sh | sh inside the siglens container
  4. Create a second ubuntu 22.04 cloud image container named filebeat-test on Incus
  5. Incus shell filebeat-test and run the following commands inside that container:
$ wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-oss-7.9.3-amd64.deb
$ sudo dpkg -i filebeat-oss-7.9.3-amd64.deb
$ cat filebeat.yml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /root/test.log

output.elasticsearch:
  hosts: ['http://siglens.incus:8081/elastic/'] # Replace host as required
  index: 'filebeat-ind-0'

$ cat test.log
2024-07-21 06:26:07.030 8184 INFO cloudbaseinit.init [-] Executing plugin 'NTPClientPlugin'
2024-07-21 06:26:07.030 8184 DEBUG cloudbaseinit.utils.classloader [-] Loading class 'cloudbaseinit.osutils.windows.WindowsUtils' load_class C:\Program Files\Cloudbase Solutions\Cloudbase-Init\Python\Lib\site-packages\cloudbaseinit\utils\classloader.py:27
New log without a timestamp
$ sudo ./filebeat -e -c $(pwd)/filebeat.yml
Run output (seems to work fine but after a minute it will crash with
runtime/cgo: pthread_create failed: Operation not permitted
SIGABRT: abort
PC=0x7bc6648d69fc m=10 sigcode=18446744073709551610

goroutine 0 [idle]:
runtime: unknown pc 0x7bc6648d69fc
4

Quick search on the signature of the crash it is properly related to this bug Filebeat and GLIBC Errors on Ubuntu 22.04 Try out the solution provided at Filebeat discussion and see if it helps.

On a separate note you can actually deploy OCI images directly on Incus if you have stable 6.3 installed.