Mount not working inside docker, and not sure if sysbox is used at all

[joernheissler]

Hello,
my goal is to run things like debootstrap inside a gitlab-ci job.
I installed sysbox 6.7 on Debian 11 (kernel 6.1.0),12,13 with Debian's docker.io package.

Is "mount" supposed to work inside the container?

host ~ # docker run --runtime sysbox-runc -it debian:trixie /bin/bash
root@b7987faa9999:/# mount none /mnt -t tmpfs
mount: /mnt: permission denied.
       dmesg(1) may have more information after failed mount system call.

When I run the container with --security-opt seccomp=unconfined or with --privileged, mount works.

When running ps on the host, it appears like sysbox-runc isn't used, but containerd-shim-runc-v2:

host ~ # ps axfww
      1 ?        Ss     0:02 /sbin/init
    242 ?        Ss     0:00 /lib/systemd/systemd-journald
    269 ?        Ss     0:00 /lib/systemd/systemd-udevd
    418 ?        Ss     0:00 /usr/sbin/haveged --Foreground --verbose=1
    428 ?        Ss     0:00 /usr/sbin/cron -f
    429 ?        Ss     0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only    
    431 ?        Ssl    0:00 /usr/sbin/rsyslogd -n -iNONE
    432 ?        Ssl    0:18 /usr/bin/sysbox-mgr
    433 ?        Ss     0:00 /lib/systemd/systemd-logind
    495 ?        Ssl    0:00 /usr/bin/sysbox-fs 
    515 tty1     Ss+    0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
    520 ?        Ss     0:00 /bin/sleep infinity
    523 ?        Ssl    0:11 /usr/bin/containerd
    535 ?        Ssl    0:00 /usr/sbin/ntpd -p /var/run/ntpd.pid -g -u 106:112
    550 ?        Ss     0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
   1396 ?        Ss     0:00  \_ sshd: root@pts/0
   1411 pts/0    Ss     0:00  |   \_ -bash
   1419 pts/0    Sl+    0:00  |       \_ docker run --runtime sysbox-runc -it debian:trixie /bin/bash
   1689 ?        Ss     0:00  \_ sshd: root@pts/1
   1696 pts/1    Ss     0:00      \_ -bash
   1710 pts/1    R+     0:00          \_ ps axfww 
    562 ?        Ssl    0:01 /usr/sbin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
    587 ?        Ss     0:00 /usr/sbin/xinetd -pidfile /run/xinetd.pid -stayalive -inetd_compat -inetd_ipv6
   1399 ?        Ss     0:00 /lib/systemd/systemd --user
   1400 ?        S      0:00  \_ (sd-pam)
   1484 ?        Sl     0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id b7987faa999927c639a58a3076c73fbfc05d94e4db92ad1385a0fecacc31a458 -address /run/containerd/containerd.sock
   1527 pts/0    Ss+    0:00  \_ /bin/bash

Any hints?

[joernheissler]

nestybox/sysbox-fs#96