20.04 vs. 22.04 inside docker, with a 16.04 host == thread start failures?

Question

I wouldn't believe it if it wasn't right in front of me.

So this is obviously an old host, I'm not even looking for a fix just telling you what I'm seeing so the next poor soul to google this nonsense doesn't feel as lonely.

docker run -ti ubuntu:22.04 /bin/bash
# apt update; apt install nodejs
...
E: Problem executing scripts DPkg::Post-Invoke 'rm -f /var/cache/apt/archives/*.deb /var/cache/apt/archives/partial/*.deb /var/cache/apt/*.bin || true'
E: Sub-process returned an error code

root@f0bb472a2a44:/# nodejs
nodejs[2608]: ../src/node_platform.cc:61:std::unique_ptr<long unsigned int> node::WorkerThreadsTaskRunner::DelayedTaskScheduler::Start(): Assertion `(0) == (uv_thread_create(t.get(), start_thread, this))' failed.
 1: 0x7f620e2893cc node::Abort() [/lib/x86_64-linux-gnu/libnode.so.72]
 2: 0x7f620e28945b  [/lib/x86_64-linux-gnu/libnode.so.72]
 3: 0x7f620e30bde2 node::WorkerThreadsTaskRunner::WorkerThreadsTaskRunner(int) [/lib/x86_64-linux-gnu/libnode.so.72]
 4: 0x7f620e30bf16 node::NodePlatform::NodePlatform(int, v8::TracingController*) [/lib/x86_64-linux-gnu/libnode.so.72]
 5: 0x7f620e2542c8 node::InitializeOncePerProcess(int, char**) [/lib/x86_64-linux-gnu/libnode.so.72]
 6: 0x7f620e2544ac node::Start(int, char**) [/lib/x86_64-linux-gnu/libnode.so.72]
 7: 0x7f620d7c2d90  [/lib/x86_64-linux-gnu/libc.so.6]
 8: 0x7f620d7c2e40 __libc_start_main [/lib/x86_64-linux-gnu/libc.so.6]
 9: 0x5563adef00f5 _start [nodejs]
Aborted (core dumped)

Do the same thing on the same host but start with

docker run -ti ubuntu:20.04 /bin/bash

and.. no problem. Both also work when the host is 20.04. It isn't just nodejs.

root@f0bb472a2a44:/# curl www.google.com
curl: (6) getaddrinfo() thread failed to start

Pretty weird. I'm seeing 16.04 w/Epyc as not working and 20.04/Xeon working. If anyone can reproduce I'm rather curious. Plenty of memory, pid counts and thread counts are relatively low and overall system load is modest.

In the interest of completeness, I tried the same with ubuntu:21.10 and it also works.

What causes these thread creation failures in docker 22.04? Host Kernel? Underlying hardware? Something else?

Answer 1

I was able to reproduce this issue running ubuntu:22.04 from a ubuntu:20.04 host. I believe it is a seccomp issue with glibc, as I can run it with option --security-opt seccomp=unconfined

this runs cleanly for me:

sudo docker run -it --security-opt seccomp=unconfined ubuntu:22.04 /bin/bash -c "apt update; apt install -y curl; curl www.google.com

more info about docker seccomp security: https://docs.docker.com/engine/security/seccomp/

Answer 2

you should never use "seccomp=unconfined" its maximum unsecure.

npm docker security settings error node::WorkerThreadsTaskRunner::DelayedTaskScheduler::Start
node[8]: ../src/node_platform.cc:61:std::unique_ptr<long unsigned int> node::WorkerThreadsTaskRunner::DelayedTaskScheduler::Start(): Assertion `(0) == (uv_thread_create(t.get(), start_thread, this))' failed.

I faced the issue with npm nodejs express in docker for Ubuntu 22.04 I compared the original docker seccomp file line by line with my own file (https://github.com/moby/moby/blob/master/profiles/seccomp/default.json)

i had add a lot of line above but the bugfixing lines are to add

        {
        "names": [
            "reboot"
        ],
        "action": "SCMP_ACT_ALLOW",
        "args": [],
        "comment": "",
        "includes": {
            "caps": [
                "CAP_SYS_BOOT"
            ]
        },
        "excludes": {}
    },

so my run command looks like

docker run --security-opt seccomp:<YOUROWNSecComp.json> -it <IMAGENAME>