flake: completion test: ioctl(TUNSETIFF): Operation not permitted

[edsantiago]

I don't even know where to begin with this one:

podman run -d --name exited-sWcfgQam1qWZAnOIe7X3kRnxoLX6K3-con --pod exited-sWcfgQam1qWZAnOIe7X3kRnxoLX6K3 quay.io/libpod/testimage:20200929 echo exited
time="2021-01-15T06:26:40-06:00" level=error msg="error starting some container dependencies"
time="2021-01-15T06:26:40-06:00" level=error msg="\"/usr/bin/slirp4netns failed: \\\"ioctl(TUNSETIFF): Operation not permitted\\\\nWARNING: Support for seccomp is experimental\\\\nchild failed(1)\\\\nWARNING: Support for seccomp is experimental\\\\n\\\"\""
Error: error starting some containers: internal libpod error
[ rc=126 (** EXPECTED 0 **) ]

podman/test/system/600-completion.bats

Line 243 in 47616fe

run_podman run --name exited-$random_container_name -d $IMAGE echo exited

Only two instances, one today, one last week:

sys: podman shell completion test

• gce_instance:prior-fedora : sys podman fedora-32 rootless host
  • PR swagger.go: Fix compilation error #9080
    • 01-24 18:33
  • PR Bump to containers/buildah 1.19.2 #8978
    • 01-15 07:26

@Luap99 do you have any idea what this could be about?

[Luap99]

@AkihiroSuda @giuseppe What does this error message mean?
/usr/bin/slirp4netns failed: \\\"ioctl(TUNSETIFF): Operation not permitted\\\\nWARNING: Support for seccomp is experimental\\\\nchild failed(1)\\\\nWARNING: Support for seccomp is experimental

The test is just as simple podman pod create followed by podman run with that pod.

podman/test/system/600-completion.bats

Lines 251 to 252 in 47616fe

	run_podman pod create --name exited-$random_pod_name
	run_podman run -d --name exited-$random_pod_name-con --pod exited-$random_pod_name $IMAGE echo exited

[AkihiroSuda]

slirp4netns seems facing a permission error because it is not properly joining the UserNS.

As slirp4netns is almost single-threaded, I guess this issue is a race condition on Podman side rather than on slirp4netns side, but not 100% sure.

[Luap99]

I see this error also in the integration tests:
https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/5499289146228736/html/int-podman-fedora-32-rootless-host.log.html#t--podman-attach-to-a-container-with---sig-proxy-set-to-false--1

[edsantiago]

Thank you for logging that instance. Unfortunately, my flake-finder tool only catalogs by test name; it does not capture the error string[*]. The flake you report above is in the podman attach to a container with --sig-proxy set to false test, and there are no flakes in that test within the last 60 days. (Your PR #8910 in which this happened is not in my database because I only count PRs that are merged -- it is nearly impossible to programmatically distinguish "flake" from "actual error in an in-progress PR").

[*] because that is a Much Harder Problem

I've just done a manual perusal of the flake tool, log by log, and all I see is #9379 (newly filed) and #7139 and a few others that are new but they're one- or two-offs, and I'm on PTO this week so they can wait.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@edsantiago Any update on this?

[edsantiago]

The only instances I see of this are on f32, and it looks like we got rid of CI on f32 (#9474). I guess we can close this.