Sysbox v0.7.1 fails on Ubuntu 24.04 with kernel 6.17 and containerd v2.2.1
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- aws, kubernetes, linux, ubuntu
- Domain
- devops, infrastructure, operating-systems, security
Research direction
Start by reproducing the failure with the sysbox-runc RuntimeClass in the reported Ubuntu 24.04, EKS, kernel 6.17, and containerd 2.2.1 environment, then trace the reported permission-denied error for net.ipv4.ip_unprivileged_port_start. Done means the compatibility cause is confirmed and a validated resolution or compatibility requirement is recorded.
Written by the indexing model from the issue text.
Description
I installed Sysbox v0.7.1 on Ubuntu 24.04 EKS worker nodes . The installation completes successfully, but any pod configured to use the sysbox-runc RuntimeClass fails to start.
Pods using the default runtime start successfully. The issue only occurs when using the Sysbox runtime.
Below is the error message
Failed to create pod sandbox: rpc error: code = Unknown desc = failed to start sandbox "da90ea28b8074d976b3dcb249e8b2f843709ec6decaf591104db2889c7e20e93": failed to create containerd task: failed to create shim task: OCI runtime create failed: container_linux.go:439: starting container process caused: process_linux.go:608: container init caused: write sysctl key net.ipv4.ip_unprivileged_port_start: write /proc/sys/net/ipv4/ip_unprivileged_port_start: permission denied
Sysbox version: v0.7.1
OS: Ubuntu 24.04
EKS Version: 1.35
Containerd version: v2 2.2.1
Kernel version: 6.17.0-1015-aws
AppArmor is enabled: kernel.apparmor_restrict_unprivileged_userns = 1
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nestybox/sysbox
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
0.7.1: /sys/class/net inside a sysbox container lists the host's interfaces, not the container's Open
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
Similar issues
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·
-
chore
Difficulty 1/5 Under an hour Newbie friendliness 91/100
alunduil/alunduil-chezmoi#792 ·
-
area: compat bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
zenhub-dev
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenLiberty/ci.docker#747 ·