podman: unable to find user root: no matching entries in passwd file

Is this a BUG REPORT or FEATURE REQUEST?:

[//]: # Uncomment only one, leave it on its own line:

kind bug

[//]: # kind feature

Description Sometime, we hit the following error while deploying a bunch of containers:

2018-11-13 18:16:19 | "2018-11-13 18:13:39,018 ERROR: 4514 -- error mounting image volumes: unable to find user root: no matching entries in passwd file",

Steps to reproduce the issue:

Appears at random.

Describe the results you received: It’s randomly failing

Describe the results you expected: It should run as expected, using the “–user <value>” we set with podman exec

Additional information you deem important (e.g. issue happens only occasionally): So it’s random, and happens a couple of time on our CI.

Output of podman version:

Version:       0.11.1
Go Version:    go1.10.2
OS/Arch:       linux/amd64

Output of podman info:

host:
  BuildahVersion: 1.5-dev
  Conmon:
    package: podman-0.11.1-2.gita4adfe5.el7.x86_64
    path: /usr/libexec/podman/conmon
    version: 'conmon version 1.12.0-dev, commit: 02be8b05693994d520f0802560f1195296aadbae-dirty'
  Distribution:
    distribution: '"centos"'
    version: "7"
  MemFree: 976379904
  MemTotal: 8365137920
  OCIRuntime:
    package: runc-1.0.0-55.dev.git2abd837.el7.x86_64
    path: /usr/bin/runc
    version: 'runc version spec: 1.0.0'
  SwapFree: 5581828096
  SwapTotal: 8588881920
  arch: amd64
  cpus: 8
  hostname: undercloud.localdomain
  kernel: 3.10.0-862.14.4.el7.x86_64
  os: linux
  uptime: 2h 24m 55.42s (Approximately 0.08 days)
insecure registries:
  registries:
  - 192.168.24.1:8787
  - 192.168.24.3:8787
registries:
  registries:
  - docker.io
  - registry.fedoraproject.org
  - quay.io
  - registry.access.redhat.com
  - registry.centos.org
store:
  ContainerStore:
    number: 88
  GraphDriverName: overlay
  GraphOptions:
  - overlay.override_kernel_check=true
  GraphRoot: /var/lib/containers/storage
  GraphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
  ImageStore:
    number: 35
  RunRoot: /var/run/containers/storage

Additional environment details (AWS, VirtualBox, physical, etc.):

About this issue

Original URL
State: closed
Created 6 years ago
Reactions: 4
Comments: 29 (20 by maintainers)

Commits related to this issue

Categorize ImageNotFoundException on tripleo jobs "ImageNotFoundException: Not found image: docker://docker.io/tripleomaster/" <...> 245 hits in the last month. This is potentially another variance... — committed to openstack-infra/elastic-recheck by rafaelfolco 6 years ago
Categorize error mounting image volumes due to libpod bug[1] error mounting image volumes: unable to find user root: no matching entries in passwd file. [1] https://github.com/containers/libpod/issu... — committed to openstack-infra/elastic-recheck by rafaelfolco 6 years ago
Prevent a second lookup of user for image volumes Instead of forcing another user lookup when mounting image volumes, just use the information we looked up when we started generating the spec. This ... — committed to mheon/libpod by mheon 6 years ago
Prevent a second lookup of user for image volumes Instead of forcing another user lookup when mounting image volumes, just use the information we looked up when we started generating the spec. This ... — committed to mheon/libpod by mheon 6 years ago
Update git submodules * Update elastic-recheck from branch 'master' - Fix all fails query not matching any jobs Monty updated the post-ssh.yaml playbook in project config to do other p... — committed to openstack/openstack by cboylan 5 years ago

Most upvoted comments

@mheon There are some warnings built into opencontainers/selinux to prevent user attempts to relabel system directories.

	exclude_paths := map[string]bool{"/": true, "/usr": true, "/etc": true, "/tmp": true, "/home": true, "/run": true, "/var": true, "/root": true}
	if exclude_paths[path] {
		return fmt.Errorf("SELinux relabeling of %s is not allowed", path)
	}

rhatdan on Dec 28, 2018

The number of hits isn’t small but not critical yet. We’re working on it now though.

EmilienM on Dec 11, 2018