2

I'm trying to write a hardening script to remove the cron directory in an alpine Linux based docker image.

docker run -it alpine:3.7
rm -rf /var/spool/cron
rm: can't remove '/var/spool/cron': Invalid argument

Sometimes the cron directory appears to have a crontabs file in it sometimes not, and removing it makes no difference to being able to delete the folder.

The odd part is that this is on an Amazon Linux 2 Image, if I try from my Windows development box or an Ubuntu AMI the directory is able to be removed without issue.

Whats going on here?

  • Did you check dmesg? Maybe it says more. – Peter Feb 25 at 11:25
  • I just checked it on a fresh new Amazon Linux 2 t2.micro instance and the deletion works for me. Can you please verify that it happens in other servers than the one you tried? – Itai Ganot Feb 25 at 16:56
  • I was unable to reproduce this on a fresh Amazon Linux 2 instance. You say it sometimes has crontabs and sometimes not? That doesn't match with your example. It would be a clean image each time and would not change. Are you using any --volume arguments? What else can you tell us about the host system? Any special configuration? Did you configure a different storage driver for Docker? An Invalid argument error is usually due to the underlying filesystem not implementing something. – Jeff Snider Feb 25 at 16:58
  • This occured on both a Windows 7 enterprise machine running docker 18.06.1-ce-win73 and on the current latest AL2 image, nothing was customised in either install and no extra volumes were mounted. – Daniel Powell Feb 26 at 6:17
  • 1
    Can you edit your question and add the steps you go through on AWS to recreate this? What region? Instance type? Commands run over ssh? A full copy of the terminal output for instance would be helpful. I don't think you're going to get an answer without providing more details. – Jeff Snider Mar 1 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.