nsenter: failed to unshare namespaces: Invalid argument script returned exit code 20

[marshallford]

I was excited to see this sentence in the README and figured I give it ago having not tried the last couple of releases:

Since img v0.5.7, you don't need to specify any securityContext for running img as a Kubernetes container.

Pod:

apiVersion: v1
kind: Pod
spec:
  containers:
  - name: jnlp
    image: jenkins/jnlp-slave:3.29-1-alpine
  - name: img
    image: jess/img:v0.5.7
    command:
    - cat
    tty: true

Dockerfile used to test:

➜ cat Dockerfile
FROM alpine
RUN date

Output:

img build -t foo:latest .
nsenter: failed to unshare namespaces: Invalid argument
script returned exit code 20

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.86. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[AkihiroSuda]

you might need to disable seccomp and apparmor, and enable unpriv userns

[marshallford]

Needs more info from me?

[AkihiroSuda]

yes, e.g. kernel, kube distribution

[marshallford]

Let me know if you need anything else!

OpenShift Master: v3.10.83
Kubernetes Master: v1.10.0+b81c8f8
OpenShift Web Console: v3.10.83

cat [root@server~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.5 (Maipo)
[root@server~]# uname -a
Linux xoshiftmp1 3.10.0-862.9.1.el7.x86_64 #1 SMP Wed Jun 27 04:30:39 EDT 2018 x86_64 x86_64 x86_64 GNU/Linux

[AkihiroSuda]

sudo sh -c "echo 28633 > /proc/sys/user/max_user_namespaces"

[marshallford]

@AkihiroSuda inside the container or on the hosts?

[AkihiroSuda]

host

[xiaods]

WSL 1.0

came across this issue.