`error: open .kube/config.lock: permission denied`

[samuel-mellert]

What happened: I'm running kubectl inside of a docker container. The user's .kube folder is mounted from the host system via volume mount. Since I'm running macOS I'm using virtiofs. When running kubectl config use-context {context-name} I get this error message: error: open /home/user/.kube/config.lock: permission denied

In the .kube/ directory there's now a file config.lock with chmod 0: ---------- 1 user user 0 Jul 22 07:25 config.lock

What you expected to happen: The .kube/config file gets modified and the current-context: is saved.

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?: This does NOT happen when using the regular host filesystem mounts, only in combination with virtiofs.

Environment:

• Kubernetes client and server versions (use kubectl version):
• Cloud provider or hardware configuration:
• OS (e.g: cat /etc/os-release):

[k8s-ci-robot]

@samuel-mellert: This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[samuel-mellert]

I admit that this issue is pretty specific for a setup that's probably not too common atm, however it was curious enough so I wanted to leave some sort of documentation.

I'm currently using a workaround using sed to replace the current-context: line inside of the config file. This works for me as long as the file format doesn't change, but maybe there's an easy fix for this issue.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Jonnymcc]

This issue affects us. The setup is going to become more common because in Docker for Mac 4.21.0 VirtioFS is now the default. I saw somewhere that VirtioFS doesn't support remote file locking and I'm guessing it is related. What alternatives are there to removing the lock file implementation altogether?

[Jonnymcc]

/reopen

[k8s-ci-robot]

@Jonnymcc: You can't reopen an issue/PR unless you authored it or you are a collaborator.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[Jonnymcc]

/remove-lifecycle rotten

[mike-potter]

Not sure how to get progress on this. We are also running into this issue and it's preventing us from using VirtioFS with Docker Desktop. But not sure if this is really something Kubernetes needs to fix, or if it's an issue that VirtioFS and Docker Desktop need to fix.

One of our users is testing OrbStack instead of Docker Desktop and even though OrbStack also uses VirtioFS it doesn't seem to have this problem with Kubernetes.