Project: gVisor (Runtime / Container Runtime)
File: FAQ.md

[TOC] Today, gVisor requires Linux. gVisor currently supports compatible processors. Preliminary support is also available for . No. gVisor is capable of running unmodified Linux binaries. gVisor supports Linux binaries. Binaries run in gVisor should be built for the or CPU architectures. Yes. Please see the . Yes. Please see the . See the [Production guide]. See the . If youre having problems running a container with `runsc` its most likely due to a compatibility issue or a missing feature in gVisor. See . You are using an older version of Linux which doesn't support `memfd_create`. This is tracked in . You're using an old version of Docker. See . For performance reasons, gVisor caches directory contents, and therefore it may not realize a new file was copied to a given directory. To invalidate the cache and force a refresh, create a file under the directory in question and list the contents again. As a workaround, shared root filesystem can be enabled. See . This bug is tracked in . Note that `kubectl cp` works because it does the copy by exec'ing inside the sandbox, and thus gVisor's internal cache is made aware of the new files and directories. Make sure that permissions is correct on the `runsc` binary. ```bash sudo chmod a+rx /usr/local/bin/runsc ``` If your Kernel is configured with YAMA LSM (see https://www.kernel.org/doc/Documentation/security/Yama.txt and https://man7.org/linux/man-pages/man2/ptrace.2.html) gVisor may fail in certain modes (i.e., systrap and/or directfs) with this error if `/proc/sys/kernel/yama/ptrace_scope` is set to 2. If this is the case, try setting `/proc/sys/kernel/yama/ptrace_scope` to max of mode 1: ```bash sudo cat /proc/sys/kernel/yama/ptrace_scope 2 sudo bash -c 'echo 1 > /proc/sys/kernel/yama/ptrace_scope' ``` There is a bug in Linux kernel versions 5.1 to 5.3.15, 5.4.2, and 5.5. Upgrade to a newer kernel or add the following to `/lib/systemd/system/containerd.service` as a

``` LimitMEMLOCK=infinity ``` And run `systemctl daemon-reload && systemctl restart containerd` to restart containerd. See for more details. This error indicates that the Kubernetes CRI runtime was not set up to handle `runsc` as a runtime handler. Please ensure that containerd configuration has been created properly and containerd has been restarted. See the for more details. If you have ensured that containerd has been set up properly and you used kubeadm to create your cluster please check if Docker is also installed on that system. Kubeadm prefers using Docker if both Docker and containerd are installed. Please recreate your cluster and set the `--cri-socket` option on kubeadm commands. For example: ```bash kubeadm init --cri-socket=/var/run/containerd/containerd.sock ... ``` To fix an existing cluster edit the `/var/lib/kubelet/kubeadm-flags.env` file and set the `--container-runtime` flag to `remote` and set the `--container-runtime-endpoint` flag to point to the containerd socket. e.g. `/var/run/containerd/containerd.sock`. This is normally indicated by errors like `bad address 'container-name'` when trying to communicate to another container in the same network. Docker user defined bridge uses an embedded DNS server bound to the loopback interface on address 127.0.0.10. This requires access to the host network in order to communicate to the DNS server. runsc network is isolated from the host and cannot access the DNS server on the host network without breaking the sandbox isolation. There are a few different workarounds you can try: Use default bridge network with `--link` to connect containers. Default bridge doesn't use embedded DNS. Use option in runsc, however beware that it will use the host network stack and is less secure. Use IPs instead of container names. Use . Container name lookup works fine in Kubernetes. This error may happen when using `gvisor-containerd-shim` with a `containerd` that does not contain the fix for [CVE-2020-15257]. The resolve the issue, update containerd to 1.3.9 or 1.4.3 (or newer versions respectively).