concourse-docker: Permission denied when creating workers. Rootfs.

Hopefully someone here can help me with this. I’m running ConcourseCI v4.2.1. Running it via docker-compose. The version of Docker on the host is Docker version 17.09.1-ce. I can successfully setup Concourse. However, I get the following error in the tasks of the pipeline I have pushed:

runc run: exit status 1: container_linux.go:348: starting container process caused "process_linux.go:402: container init caused \"rootfs_linux.go:58: mounting \\\"/worker-state/4.2.1/assets/bin/init\\\" to rootfs \\\"/worker-state/volumes/live/3e85b13b-522b-428a-6d14-5d0d605e45bb/volume\\\" at \\\"/worker-state/volumes/live/3e85b13b-522b-428a-6d14-5d0d605e45bb/volume/tmp/garden-init\\\" caused \\\"open /worker-state/volumes/live/3e85b13b-522b-428a-6d14-5d0d605e45bb/volume/tmp/garden-init: permission denied\\\"\""

TRIED:

Controlling that the worker container is running in privileged mode. It is.
Adding

cap_add:
    - SYS_ADMIN
security_opt:
          - apparmor=unconfined
          - seccomp=unconfined

to the worker container. It still fails.

Search ConcourseCI discord channels for people that already have had this issue. Found some, however I wasn’t able to apply any suggestions with success.
Did a search on various search engines as well as on GitHub. Nothing that finally solved it for me. – Found: https://github.com/opencontainers/runc/issues/1658
Also tried v3.10 of Concourse. The issue is the same.

I can conclude that the host running docker is on a rather old Linux kernel. It is v4.2.8. However, I am on a kernel higher than the min. requirement. As mentioned on https://concourse-ci.org/install.html

Any help will be highly appreciated. Thank you.

About this issue

Original URL
State: closed
Created 6 years ago
Comments: 15 (3 by maintainers)

Most upvoted comments

^this is likely due to changes in the kernel that guardian does not support. Similar to cgroupsv2 not being supported by guardian and the only solution being to switch to containerd or use cgroupsv1.

I’m going to close this issue because it’s very old and likely not relevant to other users anymore.

Thanks for sharing the new info @robinhuiser

taylorsilva on Oct 21, 2021

Not sure if this helps, but I got a similar error when deploying Concourse on Microk8s - in the end it was not a permission problem, but a runtime setting - once I set CONCOURSE_RUNTIME=containerd the issue was solved.

robinhuiser on Oct 21, 2021