podman: Error: invalid config provided: AppArmorProfile and privileged are mutually exclusive options

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

sudo podman run --privileged hello-world leads to

Error: invalid config provided: AppArmorProfile and privileged are mutually exclusive options

when using Ubuntu 20.04.

I was informed by a colleague of mine about this problem, when he tried to use an image of us, and could not get it to work.

Using Arch Linux, I could not reproduce the problem.

Steps to reproduce the issue:

To reproduce it, I installed Ubuntu 20.04 in a VirtualBox VM where the error appears, too.

  1. Download the latest Ubuntu 20.04 image from https://releases.ubuntu.com/20.04/ and install Ubuntu 20.04 in a VirtualBox VM

  2. Update the system and install curl: sudo apt-get update && sudo apt-get dist-upgrade && sudo apt-get install curl

  3. Install Podman

source /etc/os-release
sudo sh -c "echo 'deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list"
curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_${VERSION_ID}/Release.key | sudo apt-key add -
sudo apt-get update
sudo apt-get install podman
  1. Run the command sudo podman run --privileged hello-world and get the error.

I want to explicitly state at this point, that I did nothing else, besides updating the system, installing curl and installing Podman.

Describe the results you received:

I could not run the hello-world image when using sudo and --privileged.

Describe the results you expected:

I want to be able to run the hello-world image, even when using sudo and --privileged.

Output of podman version:

Version:      2.0.2
API Version:  1
Go Version:   go1.14.2
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64

Output of sudo podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.15.0
  cgroupVersion: v1
  conmon:
    package: 'conmon: /usr/libexec/podman/conmon'
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.0.18, commit: '
  cpus: 1
  distribution:
    distribution: ubuntu
    version: "20.04"
  eventLogger: file
  hostname: jonny-ubuntu-vm
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.4.0-40-generic
  linkmode: dynamic
  memFree: 2601410560
  memTotal: 4127621120
  ociRuntime:
    name: runc
    package: 'runc: /usr/sbin/runc'
    path: /usr/sbin/runc
    version: 'runc version spec: 1.0.1-dev'
  os: linux
  remoteSocket:
    path: /run/podman/podman.sock
  rootless: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 1426522112
  swapTotal: 1469710336
  uptime: 1h 25m 6.08s (Approximately 0.04 days)
registries:
  search:
  - docker.io
  - quay.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/lib/containers/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 1
  runRoot: /var/run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 1
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.14.2
  OsArch: linux/amd64
  Version: 2.0.2

Package info (e.g. output of rpm -q podman or apt list podman):

Listing... Done
podman/unknown,now 2.0.2~1 amd64 [installed]
podman/unknown 2.0.2~1 arm64
podman/unknown 2.0.2~1 armhf
podman/unknown 2.0.2~1 s390x

Additional environment details (AWS, VirtualBox, physical, etc.):

Has already been described.

About this issue

  • Original URL
  • State: closed
  • Created 4 years ago
  • Reactions: 1
  • Comments: 21 (6 by maintainers)

Commits related to this issue

Most upvoted comments

I used OBS to build podman v1.9.3 packages. Feel free to use it until a proper solution arrives.

I could successfully run this

podman run --privileged --security-opt label=disable hello-world

Should be fixed in master now, will be in 2.0.3

I agree with preserving compatibility, this is a ‘breaking’ change in behavior. The default behavior shouldn’t change drastically enough to break existing software without release notes/documentation updates and time to remediate if necessary.