Arch Linux User Repository

After upgrading my kernel to 6.2.2-arch1-1 from 6.1.7-arch1-1, concourse failed to create containers as follows:

run check: find or create container on worker concourse-worker-2: starting task: new task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "proc" to rootfs at "/proc": mount proc:/proc (via /proc/self/fd/11), flags: 0xe: operation not permitted: unknown

This problem does not reproduce on creating privileged container:

platform: linux
image_resource:
  type: docker-image
  source:
    repository: archlinux
run:
  path: echo
  args:
  - hello

$ fly -t target execute -c sample.yml --> fail
$ fly -t target execute -c sample.yml -p --> success

I assum that this is similar [1]. Please tell me if you have any information to resolve the problem.

• [1] https://github.com/opencontainers/runc/issues/3672#issuecomment-1335121007

@pancho

==> Starting prepare()...
/tmp/build/686d23aa/pkgbuild/PKGBUILD: line 29: go: command not found

Ooops! I forgot to add 'go' to the make-dependencies at 379824f. Thanks!

@cheatsc: thanks a lot for the quick update!

I recommend adding 'go' to the makedepends array; otherwise, building the package fails with a 'go: command not found' if the go package is not installed on the system, or if built within a chroot with aurutils¹.

Thanks again!

Happy hacking,

pancho

@pancho: Thank you for providing important information. I update the PKGBUILD as soon as possible (I'm testing it).

BTW, fantastic job maintaining this package, both for the multi-package and for keeping it up-to-date in a timely manner. Kudos!

I'm so glad to hear that :)

@cheatsc: I suggest replacing the makedepend go-pie with simply go, since go-pie is just an alias. go-pie was dropped almost two years ago¹. As per the Go package guidelines², in order to enable PIE, the setting must be explicitly set, either in the go build invocation, or in the GOFLAGS.

Hope that it helps.

BTW, fantastic job maintaining this package, both for the multi-package and for keeping it up-to-date in a timely manner. Kudos!

1: https://archlinux.org/todo/move-from-go-pie-dependency-to-go/

2: https://wiki.archlinux.org/title/Go_package_guidelines#Sample_PKGBUILD

This problem has been fixed since 7.6.0.

Recently, git resource cannot fetch repository as follows:

selected worker: concourse-worker
Cloning into '/tmp/git-resource-repo-cache'...
fatal: unable to access 'https://source.denx.de/u-boot/u-boot.git/': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

This problem probably relates that expired root CA of Let's encrypt...

https://letsencrypt.org/ja/docs/dst-root-ca-x3-expiration-september-2021/

From 7.4.0, concourse does not use hardcoded paths by the following commits:

• 9078d3962eb340d096f8eb2beb05e0349150fc98
• 8e96b380a9dca717ddef0b03e14f685429c6b6ba

concourse makes the paths from the own directory.

Therefore, users should use --containerd-init-bin /usr/lib/concourse/bin/init and --containerd-cni-plugins-dir /usr/lib/cni/ for workers

From Concourse docs

The concourse worker command automatically configures and runs gdn, but depending on the environment you're running Concourse in, you may need to pop open the hood and configure a few things

Since I don't use this package, I don't know its' inner workings. If you can provide a guide on how it works and what it requires (a Wiki page would be nice), I can look into it.

EDIT: It seems upstream updated to 5.5.11 which looks like a rollback?. I'm updating this to latest release.

Cheers.

Hi @raguel

I had some time to dig in.

as mentioned by @coderobe there are some missing dependencies. At least the gdn binary.

Regards Harm