Docker rootfs_linux.go permission denied when mounting /proc

Question

I'm using meteor-up to deploy to docker instances inside an LXD container. When it attempts to bring up a MongoDB docker instance, it fails with the following error:

docker: Error response from daemon: oci runtime error: container_linux.go:265: starting container process caused "process_linux.go:368: container init caused \"rootfs_linux.go:57: mounting \\\"proc\\\" to rootfs \\\"/var/lib/docker/vfs/dir/20a621a73755db3f4030bc67bbf7ff9540bd1d63bb348d8be440d8ca63d3c922\\\" at \\\"/proc\\\" caused \\\"permission denied\\\"\"".

I've tried deploying as the ubuntu user to my LXD container, and as root, and that hasn't helped. There's obviously some permissions issue here, but I don't know where to start debugging this problem.

Answer 1

According to https://discuss.linuxcontainers.org/t/having-trouble-using-docker/383 it sounds like you might need to set security.nesting=true. Stop the container (lxc stop deploy-container), configure nesting on (lxc config set deploy-container security.nesting true as per https://insights.ubuntu.com/2015/10/30/nested-containers-in-lxd) and lxc start deploy-container.

Answer 2

For Proxmox users: https://www.youtube.com/watch?v=79KiCBNbsbg

Enable Nesting feature on the container to fix the following error

ERROR: for mysql-8.0  Cannot start service mysql-8.0:
failed to create shim: OCI runtime create failed:
container_linux.go:380: starting container process caused: process_linux.go:545:
container init caused: rootfs_linux.go:76: mounting "proc" to rootfs at
"/proc" caused: mount through procfd: permission denied: unknown

But other users Proxmox users say to enable keyctl too.

If you still have errors you may need to remove domain_name and hostname from the docker-compose config to fix the following errors as said here.

ERROR: for mariadb10-4  Cannot start service mariadb10-4: failed to create shim: OCI runtime create failed: container_linux.go:380:
starting container process caused: process_linux.go:545:
container init caused: write sysctl key kernel.domainname:
open /proc/sys/kernel/domainname: permission denied: unknown