General Questions • [Software] podman "crun: open executable: Permission denied: OCI permission denied"

Hello,

Comparing the previous two logs (working and not working), the main difference seems to me, as you pointed out:

Code:

DEBU[0000] Received: -1

I installed podman (using apt) in a Debian Bookmark VM (running in KVM with virt-manager) upgrated to the latest versione 12.7.

The I run successfully your command (without the debug command):

Code:

$ podman run --rm  --name test docker.io/traefik/whoami:latest

As a reference, this is the output of the podman version and podman info --debug commands

Code:

$ podman versionClient:       Podman EngineVersion:      4.3.1API Version:  4.3.1Go Version:   go1.19.8Built:        Thu Jan  1 01:00:00 1970OS/Arch:      linux/amd64$ podman info --debughost:  arch: amd64  buildahVersion: 1.28.2  cgroupControllers:  - cpu  - memory  - pids  cgroupManager: systemd  cgroupVersion: v2  conmon:    package: conmon_2.1.6+ds1-1_amd64    path: /usr/bin/conmon    version: 'conmon version 2.1.6, commit: unknown'  cpuUtilization:    idlePercent: 93.12    systemPercent: 3.4    userPercent: 3.49  cpus: 1  distribution:    codename: bookworm    distribution: debian    version: "12"  eventLogger: journald  hostname: debian-bookworm  idMappings:    gidmap:    - container_id: 0      host_id: 1000      size: 1    - container_id: 1      host_id: 100000      size: 65536    uidmap:    - container_id: 0      host_id: 1000      size: 1    - container_id: 1      host_id: 100000      size: 65536  kernel: 6.1.0-25-amd64  linkmode: dynamic  logDriver: journald  memFree: 80973824  memTotal: 1007374336  networkBackend: netavark  ociRuntime:    name: crun    package: crun_1.8.1-1+deb12u1_amd64    path: /usr/bin/crun    version: |-      crun version 1.8.1      commit: f8a096be060b22ccd3d5f3ebe44108517fbf6c30      rundir: /run/user/1000/crun      spec: 1.0.0      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL  os: linux  remoteSocket:    path: /run/user/1000/podman/podman.sock  security:    apparmorEnabled: false    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT    rootless: true    seccompEnabled: true    seccompProfilePath: /usr/share/containers/seccomp.json    selinuxEnabled: false  serviceIsRemote: false  slirp4netns:    executable: /usr/bin/slirp4netns    package: slirp4netns_1.2.0-1_amd64    version: |-      slirp4netns version 1.2.0      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383      libslirp: 4.7.0      SLIRP_CONFIG_VERSION_MAX: 4      libseccomp: 2.5.4  swapFree: 2144034816  swapTotal: 2146430976  uptime: 0h 31m 41.00splugins:  authorization: null  log:$ podman infohost:  arch: amd64  buildahVersion: 1.28.2  cgroupControllers:  - cpu  - memory  - pids  cgroupManager: systemd  cgroupVersion: v2  conmon:    package: conmon_2.1.6+ds1-1_amd64    path: /usr/bin/conmon    version: 'conmon version 2.1.6, commit: unknown'  cpuUtilization:    idlePercent: 84.31    systemPercent: 8.05    userPercent: 7.64  cpus: 1  distribution:    codename: bookworm    distribution: debian    version: "12"  eventLogger: journald  hostname: debian-bookworm  idMappings:    gidmap:    - container_id: 0      host_id: 1000      size: 1    - container_id: 1      host_id: 100000      size: 65536    uidmap:    - container_id: 0      host_id: 1000      size: 1    - container_id: 1      host_id: 100000      size: 65536  kernel: 6.1.0-25-amd64  linkmode: dynamic  logDriver: journald  memFree: 77340672  memTotal: 1007374336  networkBackend: netavark  ociRuntime:    name: crun    package: crun_1.8.1-1+deb12u1_amd64    path: /usr/bin/crun    version: |-      crun version 1.8.1      commit: f8a096be060b22ccd3d5f3ebe44108517fbf6c30      rundir: /run/user/1000/crun      spec: 1.0.0      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL  os: linux  remoteSocket:    path: /run/user/1000/podman/podman.sock  security:    apparmorEnabled: false    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT    rootless: true    seccompEnabled: true    seccompProfilePath: /usr/share/containers/seccomp.json    selinuxEnabled: false  serviceIsRemote: false  slirp4netns:    executable: /usr/bin/slirp4netns    package: slirp4netns_1.2.0-1_amd64    version: |-      slirp4netns version 1.2.0      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383      libslirp: 4.7.0      SLIRP_CONFIG_VERSION_MAX: 4      libseccomp: 2.5.4  swapFree: 2144034816  swapTotal: 2146430976  uptime: 0h 12m 55.00splugins:  authorization: null  log:  - k8s-file  - none  - passthrough  - journald  network:  - bridge  - macvlan  volume:  - localregistries: {}store:  configFile: /home/aki/.config/containers/storage.conf  containerStore:    number: 0    paused: 0    running: 0    stopped: 0  graphDriverName: vfs  graphOptions: {}  graphRoot: /home/aki/.local/share/containers/storage  graphRootAllocated: 7063732224  graphRootUsed: 6102306816  graphStatus: {}  imageCopyTmpDir: /var/tmp  imageStore:    number: 1  runRoot: /run/user/1000/containers  volumePath: /home/aki/.local/share/containers/storage/volumesversion:  APIVersion: 4.3.1  Built: 0  BuiltTime: Thu Jan  1 01:00:00 1970  GitCommit: ""  GoVersion: go1.19.8  Os: linux  OsArch: linux/amd64  Version: 4.3.1  - k8s-file  - none  - passthrough  - journald  network:  - bridge  - macvlan  volume:  - localregistries: {}store:  configFile: /home/aki/.config/containers/storage.conf  containerStore:    number: 0    paused: 0    running: 0    stopped: 0  graphDriverName: vfs  graphOptions: {}  graphRoot: /home/aki/.local/share/containers/storage  graphRootAllocated: 7063732224  graphRootUsed: 6102319104  graphStatus: {}  imageCopyTmpDir: /var/tmp  imageStore:    number: 1  runRoot: /run/user/1000/containers  volumePath: /home/aki/.local/share/containers/storage/volumesversion:  APIVersion: 4.3.1  Built: 0  BuiltTime: Thu Jan  1 01:00:00 1970  GitCommit: ""  GoVersion: go1.19.8  Os: linux  OsArch: linux/amd64  Version: 4.3.1

Perhaps you can compare the output of the previous command across the yours two VM installations (that behaves differently) or you can share the VM image to allow others to take a look at it.

Statistics: Posted by juanj — 2024-09-28 20:23 — Replies 13 — Views 372