Why podman cannot change the memory protections when running containers ?

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • podman

Issue

  • Trying to run podman ends up with the below error
# podman run -itd --name test registry.access.redhat.com/ubi8:latest
error while loading shared libraries: librt.so.1: cannot change memory protections

Resolution

  • Whenever graphRoot of a rootless user is changed to a different path, the selinux labels for this location should also be changed appropriately.
  • To find the graphRoot for a user, run podman info | grep graphRoot.
  • Following commands needs to be run to change the labels,
# semanage fcontext -a -e /var/lib/containers <graphRoot_path>
# restorecon -R -v <graphRoot_path>
  • Default selinux label for /var/lib/containers is container_var_lib_t
# ls -laZd /var/lib/containers/
drwxr-xr-x. 5 root root system_u:object_r:container_var_lib_t:s0 50 Aug 21 12:32 /var/lib/containers/
  • The above command labels everything under the graphRoot the same way /var/lib/containers is labeled.
  • An alternate way to label the graphRoot directory is to run the below commands,
  # semanage fcontext -a -t container_var_lib_t 'graphRootDirectory(/.*)?'
  # restorecon -Rv graphRootDirectory

where the value of graphRootDirectory can be found by running $podman info | grep graphRoot.

Root Cause

  • Labels of graphRoot is not set appropriately when changing the graphRoot.

Diagnostic Steps

  • Running any container should end up in the below error,
# podman run registry.access.redhat.com/ubi8/ubi 
error while loading shared libraries: librt.so.1: cannot change memory protections

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments