I'm trying to run a container on a RHEL 6.5 but I keep hitting this problem:
sudo docker run -u postgres -it registry/postgres /bin/bash /bin/bash: error while loading shared libraries: libtinfo.so.5: cannot open shared object file: Permission denied
When run as user 'root', the container starts fine but the problem appears again when trying to switch to another user:
$ sudo docker run -u root -it registry/database /bin/bash [root@8a20410eaa5e /]# su postgres su: /bin/bash: Permission denied
This is a specific container built by us, based on CentOS 6.5 an that runs Postgres. The Dockerfile to build it has "USER postgres" in it, and it works fine elsewhere except these servers. I can reproduce the same behaviour with a busybox container:
$ sudo docker run -u nobody -it 10.188.13.136:8080/busybox / $ ls /bin/sh: ls: Permission denied
The RHEL 6.5 host has SELinux enabled. We have other other hosts where SELinux and this container works fine there. The audit log for this host looks clean, no error messages that I can see when trying to run the container.
This is what we've tried so far:
- update the SELinux policies in RHEL ("sudo yum upgrade selinux-policy"), as they were not the latest versions
- get SELinux into permissive mode (setenforce 0); not tried to switch it off completely and reboot
- start the Docker daemon with "--selinux-enabled=true"
- start the container with --privileged
- start the container with --security-opt=:label:disable
- we're running the latest RHEL 6.5 kernel: 2.6.32-504.16.2.el6.x86_64
Also run a strace session for the 'su ' command within the container but could not see much beyond these:
17 setgid(10000) = 0 17 setuid(10000) = 0 17 munmap(0x7f07a3540000, 2101304) = 0 17 munmap(0x7f07a311c000, 2113776) = 0 17 munmap(0x7f07a2f03000, 2196352) = 0 17 munmap(0x7f07a2cea000, 2198192) = 0 17 munmap(0x7f07a2ae8000, 2101272) = 0 17 munmap(0x7f07a28e4000, 2109624) = 0 17 munmap(0x7f07a26e0000, 2109672) = 0 17 munmap(0x7f07a24d3000, 2148896) = 0 17 munmap(0x7f07a22d0000, 2105488) = 0 17 munmap(0x7f07a20cb000, 2113848) = 0 17 munmap(0x7f07a1ec5000, 2118168) = 0 17 munmap(0x7f07a3321000, 2221912) = 0 17 execve("/bin/bash", ["bash"], [/* 15 vars */]) = -1 EACCES (Permission denied) 17 write(2, "su: ", 4) = 4 17 write(2, "/bin/bash", 9) = 9
The full strace dump is here in case it's needed: http://pastebin.com/42C2B8LP.
We're not sure what to look for next, any ideas?