podman: Cannot restore segment prot after reloc: Permission denied

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

I uninstalled Docker in my Fedora 30 and installed podman and podman-docker. However I get the following error when building my project (which uses Docker):

[INFO] [io.quarkus.creator.phase.nativeimage.NativeImagePhase] docker run -v /home/ggastald/workspace/quarkus/integration-tests/jgit/target:/project:z --rm --user 1000:1000 quay.io/quarkus/ubi-quarkus-native-image:19.1.1 -J-Djava.util.logging.manager=org.jboss.logmanager.LogManager -J-Dio.netty.leakDetection.level=DISABLED -J-Dvertx.disableDnsResolver=true -J-Dio.netty.noUnsafe=true --initialize-at-build-time= -H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy$BySpaceAndTime -jar quarkus-integration-test-jgit-999-SNAPSHOT-runner.jar -J-Djava.util.concurrent.ForkJoinPool.common.parallelism=1 -H:FallbackThreshold=0 -H:+ReportExceptionStackTraces -H:+PrintAnalysisCallTree -H:-AddAllCharsets -H:EnableURLProtocols=http,https --enable-all-security-services -H:-SpawnIsolates -H:+JNI --no-server -H:-UseServiceLoaderFeature -H:+StackTrace
Error occurred during initialization of VM
Unable to load JVMCI shared library: /opt/graalvm/jre/lib/amd64/libjvmcicompiler.so: cannot restore segment prot after reloc: Permission denied

Steps to reproduce the issue:

  1. git clone git@github.com:quarkusio/quarkus.git

  2. cd quarkus && ./mvnw clean install -DskipTests

  3. ./mvnw install -Dnative -Dnative-image.docker-build=true -pl integration-tests/jgit

Describe the results you received:

[INFO] --- quarkus-maven-plugin:999-SNAPSHOT:native-image (native-image) @ quarkus-integration-test-jgit ---
[INFO] [io.quarkus.creator.phase.nativeimage.NativeImagePhase] Running Quarkus native-image plugin on OpenJDK 64-Bit Server VM
Error: Could not create directory /project/.native-image/machine-id-
[INFO] [io.quarkus.creator.phase.nativeimage.NativeImagePhase] docker run -v /home/ggastald/workspace/quarkus/integration-tests/jgit/target:/project:z --rm --user 1000:1000 quay.io/quarkus/ubi-quarkus-native-image:19.1.1 -J-Djava.util.logging.manager=org.jboss.logmanager.LogManager -J-Dio.netty.leakDetection.level=DISABLED -J-Dvertx.disableDnsResolver=true -J-Dio.netty.noUnsafe=true --initialize-at-build-time= -H:InitialCollectionPolicy=com.oracle.svm.core.genscavenge.CollectionPolicy$BySpaceAndTime -jar quarkus-integration-test-jgit-999-SNAPSHOT-runner.jar -J-Djava.util.concurrent.ForkJoinPool.common.parallelism=1 -H:FallbackThreshold=0 -H:+ReportExceptionStackTraces -H:+PrintAnalysisCallTree -H:-AddAllCharsets -H:EnableURLProtocols=http,https --enable-all-security-services -H:-SpawnIsolates -H:+JNI --no-server -H:-UseServiceLoaderFeature -H:+StackTrace
Error occurred during initialization of VM
Unable to load JVMCI shared library: /opt/graalvm/jre/lib/amd64/libjvmcicompiler.so: cannot restore segment prot after reloc: Permission denied
Error: Image build request failed with exit status 1

Describe the results you expected: Build success (it works with Docker installed)

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

Version:            1.5.1
RemoteAPI Version:  1
Go Version:         go1.12.7
OS/Arch:            linux/amd64

Output of podman info --debug:

debug:
  compiler: gc
  git commit: ""
  go version: go1.12.7
  podman version: 1.5.1
host:
  BuildahVersion: 1.10.1
  Conmon:
    package: podman-1.5.1-3.fc30.x86_64
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.0.0, commit: d728afa06cd2df86a27f32a4692c7099a56acc97-dirty'
  Distribution:
    distribution: fedora
    version: "30"
  MemFree: 17401413632
  MemTotal: 33072443392
  OCIRuntime:
    package: containerd.io-1.2.6-3.3.fc28.x86_64
    path: /usr/bin/runc
    version: |-
      runc version 1.0.0-rc8
      commit: 425e105d5a03fabd737a126ad93d62a9eeede87f
      spec: 1.0.1-dev
  SwapFree: 16129261568
  SwapTotal: 16605245440
  arch: amd64
  cpus: 8
  eventlogger: journald
  hostname: ggastald-laptop
  kernel: 5.2.8-200.fc30.x86_64
  os: linux
  rootless: true
  uptime: 55h 12m 32.36s (Approximately 2.29 days)
registries:
  blocked: null
  insecure: null
  search:
  - docker.io
  - registry.fedoraproject.org
  - quay.io
  - registry.access.redhat.com
  - registry.centos.org
store:
  ConfigFile: /home/ggastald/.config/containers/storage.conf
  ContainerStore:
    number: 0
  GraphDriverName: overlay
  GraphOptions:
  - overlay.mount_program=/usr/bin/fuse-overlayfs
  GraphRoot: /home/ggastald/.local/share/containers/storage
  GraphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  ImageStore:
    number: 1
  RunRoot: /run/user/1000
  VolumePath: /home/ggastald/.local/share/containers/storage/volumes

Package info (e.g. output of rpm -q podman or apt list podman):

podman-1.5.1-3.fc30.x86_64

Additional environment details (AWS, VirtualBox, physical, etc.):

Running on Fedora 30

About this issue

  • Original URL
  • State: closed
  • Created 5 years ago
  • Comments: 29 (14 by maintainers)

Commits related to this issue

Most upvoted comments

Yes that makes sense. Or drop the --user flag altogether to get the file owned by you.
Nice that we were able to get this to work.