docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

rootless: remove outdated SELinux workaround for `/run/xtables.lock` 

The SELinux workaround for `/run/xtables.lock` is no longer needed
since Docker 20.10.8 (moby/moby PR 42462)

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2021-08-27 16:02:34 +09:00
parent 0416aeb03f
commit de0d13322a
No known key found for this signature in database
GPG Key ID: 49524C6F9F638F1A
1 changed files with 4 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
engine/security/rootless.md
View File

@ -106,11 +106,7 @@ testuser:231072:65536
- You might need `sudo dnf install -y iptables`. - You might need `sudo dnf install -y iptables`.
- When SELinux is enabled, you may face `can't open lock file /run/xtables.lock: Permission denied` error. - Known to work on CentOS 8, RHEL 8, and Fedora 34.
A workaround for this is to `sudo dnf install -y policycoreutils-python-utils && sudo semanage permissive -a iptables_t`.
This issue is tracked in [moby/moby#41230](https://github.com/moby/moby/issues/41230).
- Known to work on CentOS 8, RHEL 8, and Fedora 33.
</div> </div>
<div id="hint-centos7-rhel7" class="tab-pane fade in" markdown="1"> <div id="hint-centos7-rhel7" class="tab-pane fade in" markdown="1">
- Add `user.max_user_namespaces=28633` to `/etc/sysctl.conf` (or - Add `user.max_user_namespaces=28633` to `/etc/sysctl.conf` (or
@ -478,15 +474,14 @@ up automatically. See [Usage](#usage).
**iptables failed: iptables -t nat -N DOCKER: Fatal: can't open lock file /run/xtables.lock: Permission denied** **iptables failed: iptables -t nat -N DOCKER: Fatal: can't open lock file /run/xtables.lock: Permission denied**
This error may happen when SELinux is enabled on the host. This error may happen with an older version of Docker when SELinux is enabled on the host.
A known workaround is to run the following commands to disable SELinux for `iptables`: The issue has been fixed in Docker 20.10.8.
A known workaround for older version of Docker is to run the following commands to disable SELinux for `iptables`:
```console ```console
$ sudo dnf install -y policycoreutils-python-utils && sudo semanage permissive -a iptables_t $ sudo dnf install -y policycoreutils-python-utils && sudo semanage permissive -a iptables_t
``` ```
This issue is tracked in [moby/moby#41230](https://github.com/moby/moby/issues/41230).
### `docker pull` errors ### `docker pull` errors
**docker: failed to register layer: Error processing tar file(exit status 1): lchown &lt;FILE&gt;: invalid argument** **docker: failed to register layer: Error processing tar file(exit status 1): lchown &lt;FILE&gt;: invalid argument**