ThreadError: can't create Thread: Operation not permitted

[hagaygo]

Hi

Tried upgrading old 4.2.x install to 5.X (amd64)

When installing version 5.0.0 for example , everything works fine.

When trying 5.0.6 or 5.1.0 i get the following error on the log (the one on the issue title) :

redmine            | Your Gemfile lists the gem puma (>= 0) more than once.
redmine            | You should probably keep only one of them.
redmine            | Remove any duplicate entries and specify the gem only once.
redmine            | While it's not a problem now, it could cause errors if you change the version of one of them later.
redmine            | The Gemfile's dependencies are satisfied
redmine            | rake aborted!
redmine            | ThreadError: can't create Thread: Operation not permitted
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:323:in `initialize'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:323:in `new'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:323:in `spawn_thread'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:314:in `block in register_pool'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:312:in `synchronize'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:312:in `register_pool'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:354:in `run'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:411:in `initialize'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/pool_config.rb:56:in `new'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/pool_config.rb:56:in `block in pool'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/pool_config.rb:56:in `pool'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:1072:in `block in establish_connection'
redmine            | /usr/local/bundle/gems/activesupport-6.1.7.6/lib/active_support/notifications/instrumenter.rb:24:in `instrument'
redmine            | /usr/local/bundle/gems/activerecord-6.1.7.6/lib/active_record/connection_adapters/abstract/connection_pool.rb:1071:in `establish_connection'

When adding "privileged" to my docker compose file both 5.1.0 and 5.0.6 runs without any issues.

Any reason for that ?
Is it a new requirement ?
Any way to work around it ?

Thanks in advance.

[yosifkit]

This sounds basically the same as docker-library/python#837 (comment) and docker-library/official-images#16829.

TL;DR: update libseccomp and docker on the host running the containers

[hagaygo]

Thanks for the pointers.

The docker host is running on updated ubuntu 22.04.3 and the error still happens.

Adding to the docker-compose.yaml

security_opt:
      - seccomp:unconfined

Also works and as far i can understand is a little better than using privileged.

[hagaygo]

After upgrading to ubuntu 24.04.2 we still have this error and the image (redmine 6.0.3) wont run without seccomp:unconfied

While it is working fine we really do prefer to run the image without higher privileges.

Any thing else we should try ?

Thanks in advance.

[tianon]

Which versions of Docker, containerd, runc, and libseccomp?

[hagaygo]

Docker version 20.10.7, build f0df350
docker-compose version 1.29.2
libseccomp2/noble-updates,now 2.5.5-1ubuntu3.1 amd64 [installed,automatic]
containerd.io/now 1.4.6-1 amd64 [installed,local]

runc not installed

[yosifkit]

This is very likely the clone3 syscall, so Docker 23+ is required to have a seccomp with this syscall in the allowed set (moby/moby#42681)