Stopping containers doesn't work on Ubuntu 23.10 about watchtower HOT 22 OPEN

same issue here - ubuntu 23.10

from watchtower.

from watchtower.

Hi there! 👋🏼 As you're new to this repo, we'd like to suggest that you read our code of conduct as well as our contribution guidelines. Thanks a bunch for opening your first issue! 🙏

from watchtower.

Same here, came after my upgrade to ubuntu 23.10.

from watchtower.

Yeah, seems to be related to apparmor permissions. Perhaps @simskij has some insights?

from watchtower.

Yeah, seems to be related to apparmor permissions.

Here is a kernel log that happened when watchtower got the error

kernel: [510121.642686] audit: type=1400 audit(1703840408.407:47786): apparmor="DENIED" operation="signal" class="signal" profile="docker-default" pid=1330911 comm="runc" requested_mask="receive" denied_mask="receive" signal=term peer="/usr/sbin/runc"

from watchtower.

This bug contains some more info (not on Ubuntu 23.10, so I cannot test it unfortunately):
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2039294

I guess we need to allow watchtower/docker to send signals using an apparmor rule somehow. I have very little experience with apparmor though :/

from watchtower.

Looks like this change fixes the issue

diff -u -r /etc/apparmor.d.bak/docker /etc/apparmor.d/docker
--- /etc/apparmor.d.bak/docker  2024-01-05 13:51:22.718451513 -0500
+++ /etc/apparmor.d/docker      2024-01-05 13:59:18.445871143 -0500
@@ -37,4 +37,5 @@
   # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container
   ptrace (trace,read) peer=docker-default,
 
+  signal receive set=(term kill) peer="/usr/sbin/runc",
 }

and then tell apparmor to reload the modified profile by running

sudo apparmor_parser -r /etc/apparmor.d/docker

from watchtower.

I don't have a /etc/apparmor.d/docker profile, according to aa-status I have a docker-default profile, however cannot find that in /etc/apparmor.d/

ps. from my short research I think the correct way would be to create a new profile and pass that to Watchtower as a security option (https://docker-docs.uclv.cu/engine/security/apparmor/)

from watchtower.

Docker automatically generates and loads a default profile for containers named docker-default. On Docker versions 1.13.0 and later, the Docker binary generates this profile in tmpfs and then loads it into the kernel. On Docker versions earlier than 1.13.0, this profile is generated in /etc/apparmor.d/docker instead.

Since the default AppArmor profile is generated dynamically you will not be able to edit it, or (afaik) even read its current contents. Could anyone on an older version share their /etc/apparmor.d/docker so we can use it as template to create a modified AppArmor profile for watchtower?

from watchtower.

from watchtower.

Ok, a little bit more context would be great. what did you do? Apt reinstall docker.io did not work.

from watchtower.

from watchtower.

from watchtower.

from watchtower.

There is not package docker or docker-engine. reinstall did not work. Still looking for a solution.

from watchtower.

Doing the complete reinstall (but skipping the cleanup of old containers/images/volumes) worked for me.

from watchtower.

Complete uninstall, reinstall didn't work here.

from watchtower.

from watchtower.

root@cassius # apt list apparmor
Auflistung... Fertig
apparmor/mantic,now 4.0.0~alpha2-0ubuntu5 amd64  [installiert]

Seems to be.

root@cassius4 /h/# apparmor_status | grep docker
   docker-default
   /package/admin/s6-2.11.3.2/command/s6-svscan (6499) docker-default
   /package/admin/s6-2.11.3.2/command/s6-supervise (6586) docker-default
[...]

from watchtower.

I can't be of much help here.
for me apt list states:

lukasz@chw-homeserver:~$ sudo apt list apparmor
Listing... Done
apparmor/mantic,now 4.0.0~alpha2-0ubuntu5 amd64 [installed,automatic]
`
[installed,automatic] - I have no clue why and if it does make any difference...

from watchtower.