runc error on pod termination

[Daxcor69]

Description

when terminating a pod, the connection is stuck in "Terminating" with the following error

error killing pod: [failed to "KillContainer" for "fvtt" with KillContainerError: "rpc error: code = Unknown desc = failed to kill container \"12aff81d2d78f86f71e98aed968756243fb66916e5adc67d779de177b55f390b\": unknown error after kill: runc did not terminate successfully: exit status 1: unable to signal init: permission denied\n: unknown", failed to "KillPodSandbox" for "6dcbfe19-e951-494a-8406-3018b62749b4" with KillPodSandboxError: "rpc error: code = Unknown desc = failed to stop container \"12aff81d2d78f86f71e98aed968756243fb66916e5adc67d779de177b55f390b\": failed to kill container \"12aff81d2d78f86f71e98aed968756243fb66916e5adc67d779de177b55f390b\": unknown error after kill: runc did not terminate successfully: exit status 1: unable to signal init: permission denied\n: unknown"]

Steps to reproduce the issue

Describe the results you received and expected

clean termination with all file handles closed.

What version of runc are you using?

VERSION:
1.1.12-0ubuntu3
spec: 1.0.2-dev
go: go1.22.2
libseccomp: 2.5.5

Host OS information

PRETTY_NAME="Ubuntu 24.04 LTS"
NAME="Ubuntu"
VERSION_ID="24.04"
VERSION="24.04 LTS (Noble Numbat)"
VERSION_CODENAME=noble
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=noble
LOGO=ubuntu-logo

Host kernel information

Linux wk1 6.8.0-31-generic #31-Ubuntu SMP PREEMPT_DYNAMIC Sat Apr 20 00:40:06 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

Installed via apt install containerd

Kubeadm cluster with kubernetes 1.29.2

Proxmox 8.0 hypervisor for nodes.

[tianon]

This is probably the same root cause as moby/moby#47749 (new upstream apparmor profile on runc, blocking orchestrators from signaling it 🙃)

[Daxcor69]

Sorry I am not familiar with apparmour. Is this something I can fix or are we waiting on that application to be fixed?

[kolyshkin]

This is not a runc issue -- it tries to send a signal to container's init and the kernel says "you're not allowed to do that". IOW there's nothing runc can do in this case.