setuser problem about baseimage-docker HOT 11 CLOSED

Can you run it through strace and post the output?

from baseimage-docker.

It's a while I have done that... looks like I'm not allowed to run strace ?

strace: test_ptrace_setoptions_for_all: PTRACE_TRACEME doesn't work: Permission denied
strace: test_ptrace_setoptions_for_all: unexpected exit status 1

from baseimage-docker.

I tried my image on a newly created virtual host and it is working there .. so I guess it has something to do with my server .) I'd like any hint if you got one, but I guess it's not a bug in the image ;)

from baseimage-docker.

Maybe a strange filesystem thing. But strace doesn't work even with sudo? What if you run your Docker container with --privileged?

from baseimage-docker.

Does /usr/bin/redis-server has execution privileges?

from baseimage-docker.

Yes... and using su to change user to redis and then starting the server from the shell works. Maybe I have enabled some security thing on this server? I don't know.

from baseimage-docker.

Mmm permissions on Linux are quite simple and can't think of anything you could have turned on to have such behavior. Try sending out a couple of 'ls -la' of both executables and the configuration files to see if there is something missing there 

---Sent from my iPhone

from baseimage-docker.

ok ... I think I found the culprit. In my dockerfile I have:

VOLUME ["/var/lib/redis"]
RUN chown redis /var/lib/redis

which I think always worked, but obviously not anymore, since the directory is now owned by root and that's the permission error I got.

BTW... I got strace working by putting the apparmor profiles to complain mode as described at https://help.ubuntu.com/community/AppArmor .. now I'm allowed to run strace

from baseimage-docker.

good that you found the problem.

from baseimage-docker.

I had a suspicion it would be something like AppArmor. :)

from baseimage-docker.

Yup, that seems to work. I ran aa-complain /etc/apparmor.d/docker and all is good.

from baseimage-docker.