Toolbox fails with error "Error: failed to get the Podman version"

a commented

2022-04-18 00:30:08 +00:00

Owner

This is the complete output:

guest@exozyme ~> toolbox enter --verbose
DEBU Running as real user ID 1001                 
DEBU Resolved absolute path to the executable as /usr/bin/toolbox 
DEBU Running on a cgroups v2 host                 
DEBU Checking if /etc/subgid and /etc/subuid have entries for user guest 
DEBU Validating sub-ID file /etc/subuid           
DEBU Validating sub-ID file /etc/subgid           
DEBU TOOLBOX_PATH is /usr/bin/toolbox             
DEBU Migrating to newer Podman                    
DEBU Toolbox config directory is /home/guest/.config/toolbox 
Error: error creating tmpdir: mkdir /run/user/1001: permission denied
DEBU Migrating to newer Podman: failed to get the Podman version: failed to invoke podman(1) 
Error: failed to get the Podman version

This is the complete output: ``` guest@exozyme ~> toolbox enter --verbose DEBU Running as real user ID 1001 DEBU Resolved absolute path to the executable as /usr/bin/toolbox DEBU Running on a cgroups v2 host DEBU Checking if /etc/subgid and /etc/subuid have entries for user guest DEBU Validating sub-ID file /etc/subuid DEBU Validating sub-ID file /etc/subgid DEBU TOOLBOX_PATH is /usr/bin/toolbox DEBU Migrating to newer Podman DEBU Toolbox config directory is /home/guest/.config/toolbox Error: error creating tmpdir: mkdir /run/user/1001: permission denied DEBU Migrating to newer Podman: failed to get the Podman version: failed to invoke podman(1) Error: failed to get the Podman version ```

a added the

bug

label 2022-04-18 00:30:08 +00:00

a added this to the (deleted) project 2022-04-18 00:30:08 +00:00

a started working 2022-04-18 00:30:11 +00:00

a commented

2022-04-18 00:33:44 +00:00

Author

Owner

Alright, I'm pretty sure the bug is becaue Podman and our JupyterHub sandboxing don't play well together. I'm thinking of just disabling the sandboxing for JupyterHub (which is bad for security of course), which should fix the issue. Or you can use Nix instead.

a stopped working 2022-04-18 00:34:00 +00:00

3 minutes 49 seconds

a commented

2022-04-18 00:35:56 +00:00

Author

Owner

FYI this is the (default) systemd sandboxing that we use for JupyterHub:

# Apply some service hardening.
# The default LocalProcess spawner needs SETUID and SETGID to run the
# single-user servers.
CapabilityBoundingSet=CAP_SETUID CAP_SETGID
LockPersonality=true
NoNewPrivileges=true
PrivateTmp=true
PrivateDevices=true
ProtectClock=true
ProtectControlGroups=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=full
ReadWritePaths=/etc/jupyterhub
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service

FYI this is the (default) systemd sandboxing that we use for JupyterHub: ``` # Apply some service hardening. # The default LocalProcess spawner needs SETUID and SETGID to run the # single-user servers. CapabilityBoundingSet=CAP_SETUID CAP_SETGID LockPersonality=true NoNewPrivileges=true PrivateTmp=true PrivateDevices=true ProtectClock=true ProtectControlGroups=true ProtectHostname=true ProtectKernelLogs=true ProtectKernelModules=true ProtectKernelTunables=true ProtectProc=invisible ProtectSystem=full ReadWritePaths=/etc/jupyterhub RestrictNamespaces=true RestrictRealtime=true RestrictSUIDSGID=true SystemCallArchitectures=native SystemCallErrorNumber=EPERM SystemCallFilter=@system-service ```

a commented

2022-04-18 01:01:58 +00:00

Author

Owner

I uninstalled Toolbox so that "fixes" this bug.

a closed this issue

2022-04-18 01:01:58 +00:00

a commented

2022-04-18 01:04:03 +00:00

Author

Owner

I confirmed that Nix doesn't suffer from this bug since it doesn't use any virtualization.