Release Notes for Alpine 3.14.0

From Alpine Linux
Revision as of 13:31, 27 January 2021 by Hello71 (talk | contribs)

aports

faccessat2

faccessat2 syscall has been enabled in musl. Due to runc issue 2151, new system calls incorrectly return EPERM instead of ENOSYS when invoked under a Docker or libseccomp version predating their release. Therefore, Alpine Linux 3.14.0 requires the host Docker to be version 20.10.0 (which contains moby commit a181391) or greater and the host libseccomp to be version 2.4.4 (which contains backported libseccomp commit 5696c89) or greater, compiled against Linux UAPI headers 5.8 (which contains faccessat2 syscall definition) or greater. libseccomp 2.5.0 and greater do not use Linux UAPI header definitions. Docker for Windows issue 8326 tracks the process of updating libseccomp in Docker for Windows.

Therefore, as of writing, the following platforms are not suitable as Docker hosts for Alpine Linux 3.14.0, due to containing out-of-date libseccomp: Amazon Linux 1 or 2, CentOS 7 or 8, Debian stable (with or without backports), Raspbian stable, Ubuntu (any version), and Windows. This applies regardless of whether the Linux distribution Docker packages or separate Docker package repositories are used.

To check if your host libseccomp is faccessat2-compatible, invoke scmp_sys_resolver faccessat2. If 439 is returned, faccessat2 is supported. Note that Docker must still be at least version 20.10.0, regardless of the result of this command.

In order to run under old Docker or libseccomp versions, the moby default seccomp profile should be downloaded and on line 2, defaultAction changed to SCMP_ACT_TRACE, then --seccomp-profile=default.json can be passed to dockerd, or --security-opt=seccomp=default.json passed to docker create or docker run. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.