moby: "docker exec" and "docker stop" commands throw permission denied exception

Steps to reproduce the issue:

  1. build and image from dockerfile like

FROM alpine:latest CMD /bin/sh

  1. run it in -dit mode

docker run -dit --name mycontainer mynewimage

  1. stop running container docker stop mycontainer

Describe the results you received: Error response from daemon: Cannot stop container mycontainer: Cannot kill container 194b31df7d8cb97efcc53905d7b1172ffda90c1909274b7b2efba9f0a36fd925: rpc error: code = 7 desc = permission denied

image

Describe the results you expected:

Additional information you deem important (e.g. issue happens only occasionally):

Output of docker version:

Client:
 Version:      1.12.2
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   bb80604
 Built:        Tue Oct 11 18:19:35 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.2
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   bb80604
 Built:        Tue Oct 11 18:19:35 2016
 OS/Arch:      linux/amd64

Output of docker info:

Containers: 2
 Running: 2
 Paused: 0
 Stopped: 0
Images: 10
Server Version: 1.12.2
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 16
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: host bridge null overlay

Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: apparmor
Kernel Version: 4.4.0-45-generic
Operating System: Ubuntu 14.04.5 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 11.73 GiB
Name: tutrinov-pro
ID: BA5U:WBBF:DR6E:CYE3:EGZP:FJTC:IOVO:GX3O:TGNA:FT2T:EBYP:PFBC
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Username: vtutrinov
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Insecure Registries:
 127.0.0.0/8

About this issue

  • Original URL
  • State: closed
  • Created 8 years ago
  • Comments: 17 (8 by maintainers)

Most upvoted comments

Run with

–security-opt apparmor:unconfined

fixed issue. But I expected such behavior by default.