{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/7952","labels_url":"https://api.github.com/repos/docker/docker/issues/7952/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/7952/comments","events_url":"https://api.github.com/repos/docker/docker/issues/7952/events","html_url":"https://github.com/docker/docker/issues/7952","id":42272967,"number":7952,"title":"Docker bails on systems with btrfs + SELinux w/o regard for SELinux status","user":{"login":"dfarrell07","id":880273,"avatar_url":"https://avatars.githubusercontent.com/u/880273?v=3","gravatar_id":"","url":"https://api.github.com/users/dfarrell07","html_url":"https://github.com/dfarrell07","followers_url":"https://api.github.com/users/dfarrell07/followers","following_url":"https://api.github.com/users/dfarrell07/following{/other_user}","gists_url":"https://api.github.com/users/dfarrell07/gists{/gist_id}","starred_url":"https://api.github.com/users/dfarrell07/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dfarrell07/subscriptions","organizations_url":"https://api.github.com/users/dfarrell07/orgs","repos_url":"https://api.github.com/users/dfarrell07/repos","events_url":"https://api.github.com/users/dfarrell07/events{/privacy}","received_events_url":"https://api.github.com/users/dfarrell07/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/area/security/selinux","name":"area/security/selinux","color":"fbca04"},{"url":"https://api.github.com/repos/docker/docker/labels/area/storage/btrfs","name":"area/storage/btrfs","color":"fbca04"},{"url":"https://api.github.com/repos/docker/docker/labels/exp/expert","name":"exp/expert","color":"3B8686"},{"url":"https://api.github.com/repos/docker/docker/labels/kind/bug","name":"kind/bug","color":"FF8C94"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":71,"created_at":"2014-09-09T05:49:21Z","updated_at":"2015-11-23T14:28:00Z","closed_at":null,"body":"I'm seeing \"Permission denied\" errors from shared library code on a Fedora 20 systems using btrfs.\r\n\r\nI've replicated this on two bare metal up-to-date Fedora 20 systems running btrfs, including one that was totally fresh. As a control, everything works fine on an up-to-date Fedora 20 system where Docker uses the devicemapper storage driver (running on an OpenStack deployment, also a very fresh install).\r\n\r\nSteps to reproduce:\r\n\r\n```\r\nsudo yum update -y\r\nsudo yum install docker-io -y\r\nsudo systemctl start docker\r\nsudo docker pull fedora\r\nsudo docker run fedora <some command>\r\n```\r\n\r\nThe exact result on btrfs storage driver systems varies with the command I attempt to run, but generally some shared lib fails to load with a permission denied error.\r\n\r\nEcho (`sudo docker run fedora echo \"hello world\"`) causes:\r\n\r\n```\r\necho: error while loading shared libraries: libc.so.6: cannot open shared object file: Permission denied\r\n```\r\n\r\nA Bash shell (`sudo docker run fedora /bin/bash`) causes:\r\n\r\n```\r\n/bin/bash: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: Permission denied\r\n```\r\n\r\nResults on devicemapper storage driver system are as expected.\r\n\r\nThe output of the three systems is identical for `docker version`:\r\n\r\n```\r\n[~]$ sudo docker version\r\nClient version: 1.1.2\r\nClient API version: 1.13\r\nGo version (client): go1.2.2\r\nGit commit (client): d84a070/1.1.2\r\nServer version: 1.1.2\r\nServer API version: 1.13\r\nGo version (server): go1.2.2\r\nGit commit (server): d84a070/1.1.2\r\n```\r\n\r\nOutput of `docker info` for the (failing) fresh btrfs system:\r\n\r\n```\r\n[~]$ sudo docker info\r\nContainers: 4\r\nImages: 3\r\nStorage Driver: btrfs\r\nExecution Driver: native-0.2\r\nKernel Version: 3.11.10-301.fc20.x86_64\r\n```\r\n\r\nOutput of `docker info` for the (working) nearly-fresh devicemapper system:\r\n\r\n```\r\n[~]$ sudo docker info\r\nContainers: 3\r\nImages: 5\r\nStorage Driver: devicemapper\r\n Pool Name: docker-252:1-131261-pool\r\n Data file: /var/lib/docker/devicemapper/devicemapper/data\r\n Metadata file: /var/lib/docker/devicemapper/devicemapper/metadata\r\n Data Space Used: 975.2 Mb\r\n Data Space Total: 102400.0 Mb\r\n Metadata Space Used: 1.3 Mb\r\n Metadata Space Total: 2048.0 Mb\r\nExecution Driver: native-0.2\r\nKernel Version: 3.11.10-301.fc20.x86_64\r\n```\r\n\r\nThe (working) devicemapper install and the (failing) totally fresh btrfs install have the same kernel:\r\n\r\n```\r\n# Fresh (failing) btrfs F20 install\r\n[~]$ uname -a\r\nLinux localhost.localdomain 3.11.10-301.fc20.x86_64 #1 SMP Thu Dec 5 14:01:17 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux\r\n# Nearly-fresh (working) devicemapper F20 install\r\n[~]$ uname -a\r\nLinux dfarrell-odl-docker 3.11.10-301.fc20.x86_64 #1 SMP Thu Dec 5 14:01:17 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n\r\nThe (failing) not-fresh btrfs install has a newer kernel:\r\n\r\n```\r\n# Not-fresh (failing) btrfs F20 install\r\n[~]$ uname -a\r\nLinux localhost.localdomain 3.15.10-201.fc20.x86_64 #1 SMP Wed Aug 27 21:10:06 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux\r\n```\r\n\r\nNote that I can prevent this error, even on the btrfs systems, by either putting SELinux in Permissive mode (`sudo setenforce 0`, as described by the OP [here][3]) or passing the `--privileged` flag (`sudo docker run --privileged fedora echo \"hello world\"`, as described [here][1]).\r\n\r\n```\r\n# Example of proper behavior on fresh btrfs system when SELinux is in Permissive mode\r\n[~]$ getenforce\r\nEnforcing\r\n[~]$ sudo setenforce 0\r\n[~]$ getenforce\r\nPermissive\r\n[~]$ sudo docker run fedora echo \"hello world\"\r\nhello world\r\n[~]$ sudo setenforce 1\r\n[~]$ sudo docker run fedora echo \"hello world\"\r\necho: error while loading shared libraries: libc.so.6: cannot open shared object file: Permission denied\r\n```\r\n\r\n```\r\n# Example of proper behavior on not-fresh btrfs system when --privileged flag passed\r\n[~]$ sudo getenforce\r\nEnforcing\r\n[~]$ sudo docker run --privileged fedora echo \"hello world\"\r\nhello world\r\n```\r\n\r\nMy libselinux version is the same on all three systems:\r\n\r\n```\r\n[~]$ sudo yum info libselinux\r\nInstalled Packages\r\nName        : libselinux\r\nArch        : x86_64\r\nVersion     : 2.2.1\r\nRelease     : 6.fc20\r\n<snip>\r\n```\r\n\r\n[This Docker GitHub Issue comment][2] mentioned switching from aufs to devicemapper as a fix for a seemingly similar issue. That may support the theory that this is a btrfs-related issue.\r\n\r\n[1]: https://ask.fedoraproject.org/en/question/50871/cant-run-docker-without-privileged-on-fedora-20/\r\n[2]: https://github.com/docker/docker/issues/5430#issuecomment-50089471\r\n[3]: https://bugzilla.redhat.com/show_bug.cgi?id=1112748#c0"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/158949610","html_url":"https://github.com/docker/docker/issues/7952#issuecomment-158949610","issue_url":"https://api.github.com/repos/docker/docker/issues/7952","id":158949610,"user":{"login":"rhatdan","id":2000835,"avatar_url":"https://avatars.githubusercontent.com/u/2000835?v=3","gravatar_id":"","url":"https://api.github.com/users/rhatdan","html_url":"https://github.com/rhatdan","followers_url":"https://api.github.com/users/rhatdan/followers","following_url":"https://api.github.com/users/rhatdan/following{/other_user}","gists_url":"https://api.github.com/users/rhatdan/gists{/gist_id}","starred_url":"https://api.github.com/users/rhatdan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rhatdan/subscriptions","organizations_url":"https://api.github.com/users/rhatdan/orgs","repos_url":"https://api.github.com/users/rhatdan/repos","events_url":"https://api.github.com/users/rhatdan/events{/privacy}","received_events_url":"https://api.github.com/users/rhatdan/received_events","type":"User","site_admin":false},"created_at":"2015-11-23T14:28:00Z","updated_at":"2015-11-23T14:28:00Z","body":"Are you using the new version of docker with btrfs/SELinux support (Docker-1.10?)  Otherwise this is expected, although the daemon should have blocked you from executing the command?\r\n\r\nIf you are using docker-1.10, please attach the output of \r\n\r\nausearch -m avc -ts recent\r\n\r\nAfter the failure."}}