Enable SysBox container exec dmesg --clear klogctl failed: Operation not permitted

[xlw712]

I'm based on #750 in this environment.I found a problem, and executing dmesg --clear reported an error

dmesg: klogctl failed: Operation not permitted

I tried to remove the runtimeClassName: sysbox-runc configuration,and found command exec is pass.
I suspect it is a problem with sysbox. Is this problem a known problem? How do I check

An incorrect pod template was reported

apiVersion: v1
kind: Pod
metadata:
  name: pixiu-cicd-{{ POD_POSTFIX }}
  annotations:
    io.kubernetes.cri-o.userns-mode: "auto:size=65536"
  labels:
    app: web
spec:
  nodeSelector:
    using: pixiu_cicd
  runtimeClassName: sysbox-runc
  containers:
    - name: gocd-agent-container
      image: reg.docker.alibaba-inc.com/olap-qe/gocd-agent-docker-dind:aliunx3.8_adbmysql_20231120
      securityContext:
        privileged: true
      resources:
        requests:
          memory: 125000000Ki
          cpu: 28
        limits:
          memory: 125000000Ki
          cpu: 30

[xlw712]

@ctalledo You got a minute? Help me analyze it. Thanks

[ctalledo]

Hi @xlw712,

I found a problem, and executing dmesg --clear reported an error
dmesg: klogctl failed: Operation not permitted

Yes that's expected; dmesg --clear requires "true root" permissions since it's clearing the kernel's ring buffer; inside a Sysbox container, you have a "fake root" which only has root access to resources associated with the container (it's not a true root). Thus you can't clear the kernel ring buffer from within a Sysbox container.

In the future we may improve on this by emulating the kernel ring buffer inside each container, but we are not there yet.

Hope that helps!

[xlw712]

Well, look forward to this new feature. I tried to change the execution script