spiffe/spire

make images fails for rootless docker in docker

オープン

#5,140 opened on 2024/05/10

 (3 件のコメント) (0 件のリアクション) (0 人の担当者)Go (631 件のフォーク)auto 404
help wantedpriority/backlog

Repository metrics

Stars
 (2,443 個のスター)
PR merge metrics
 (PR metrics pending)

説明

  • Version: v1.8.10
  • Platform: Linux $hostname 5.10.197+ #1 SMP Fri Dec 29 09:13:24 UTC 2023 x86_64 GNU/Linux
  • Subsystem: make images

We are unable to build images from within a rootless docker container environment. It gets permission denied mount the sysfs:

make images
Successfully created context "spire-buildx-tls"
WARNING: new settings may not be used until builder is restarted
container-builder
Building docker image spire-server …
[+] Building 0.2s (1/1) FINISHED                                                                                                                                  docker-container:container-builder
 => ERROR [internal] booting buildkit                                                                                                                                                           0.2s
 => => starting container buildx_buildkit_container-builder0                                                                                                                                    0.2s
------
 > [internal] booting buildkit:
------
ERROR: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "sysfs" to rootfs at "/sys": mount sysfs:/sys (via /proc/self/fd/6), flags: 0xe: operation not permitted: unknown
make: *** [Makefile:348: spire-server-image] Error 1

It is apparently possible to launch the build container under rootless docker-in-docker according to this old issue: https://github.com/docker/buildx/issues/548#issuecomment-785741844. It is not clear how or if support has yet made it into the buildx cli (https://docs.docker.com/reference/cli/docker/buildx/build/).

コントリビューターガイド