2

I'm running Ubuntu Xenial and set up simple unprivileged user container from template (also Xenial).

When I attach inside and try to just do upgrade or install anything 'apt-get' fails with following messages:

root@c1:/# apt-get update
E: setgroups 65534 failed - setgroups (22: Invalid argument)
E: setegid 65534 failed - setegid (22: Invalid argument)
Reading package lists... Done
E: setgroups 65534 failed - setgroups (22: Invalid argument)
E: setegid 65534 failed - setegid (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
E: Method http has died unexpectedly!
E: Sub-process http returned an error code (112)
E: Method http has died unexpectedly!
E: Sub-process http returned an error code (112)

So the question is - what's going on here?

3 Answers 3

2

By default user '_apt' has uid=65534, but lxc (and host) is configured to allow only 10000 subuids and subgids for user (and therefore unprivileged containers).

One solution might be to set user '_apt' uid inside container below 10000.

The other way is to up subuids/subgids limit on the host. Use command sudo usermod --add-subuids 260000-325536 --add-subgids 260000-325536 $USER for user that owns container, and ensure lxc user containers are configured with:

lxc.id_map = u 0 260000 65536
lxc.id_map = g 0 260000 65536
2
  • I don't think ubuntu is configured with 10000 subuids. I think it's configured for 65536, starting at 10000. Changing _apt uid to something below 10000 (in my case I tried 106) resulted in the same error: E: setgroups 106 failed - setgroups (1: Operation not permitted) Aug 9, 2018 at 19:56
  • In case it helps anyone else, for me the failure was writing deny to /proc/<pid>/setgroups from within the user namespace Aug 9, 2018 at 20:57
0

I got a similar error when building my docker container. Turns out that I forgot to write sudo before my docker build command.

0

In my case, @Alwin's solution cannot be used as I'm running rootless. Regarding @dilettant solution, there isn't lxc in my environment, nevertheless replaced _apt's uid using sed -i 's/_apt:x:100:65534/_apt:x:100:100/g' /etc/passwd. Also followed @cheshirekow's comment and in my case /proc/<pid>/setgroups contained allow and not deny.

I solved it indirectly by installing brew as an alternative using:

RUN /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
ENV PATH=$MVND_HOME/home/linuxbrew/.linuxbrew/bin:$PATH

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.