Podman run inside pod fails with: Error: OCI runtime error: crun: sd-bus call: Invalid unit name '.': Invalid argument

[rocketraman]

I am attempting to run rootless a container inside an existing pod, but when attempting to do so I get the error:

$ podman run --rm --pod=pod1 quay.io/podman/hello
Error: OCI runtime error: crun: sd-bus call: Invalid unit name '.': Invalid argument

There are no error logs from selinux, either in the user or system journal.

If I run the same container without a pod spec, or after creating a new pod and running it inside that, it works fine.

Comparing the podman pod inspect output of the non-working and working pods, I note that the working pod has a line like this:

     "CgroupPath": "user.slice/user-libpod_pod_ccb1a86db5466e260a3ad60912ea02f4ce13f3cb19465bd239c0bebe28b5cf2a.slice",

but the non-working pod does not. Everything else is basically the same (except expected differences like pod names, container ids, etc.). It is likely this pod was created using earlier versions of podman and the kernel.

podman system migrate does not fix the issue.

Debug logs from the failing run show this:

time="2022-10-31T16:38:26-04:00" level=debug msg="ExitCode msg: \"crun: [conmon:d]: failed to write to /proc/self/oom_score_adj: permission denied\\n\\nsd-bus call: invalid unit name '.': invalid argument: oci permission denied\""
Error: crun: [conmon:d]: failed to write to /proc/self/oom_score_adj: Permission denied

sd-bus call: Invalid unit name '.': Invalid argument: OCI permission denied

Podman version 4.2.1 on Fedora 36 with rawhide debug kernel 6.1-rc2.

[Luap99]

@giuseppe PTAL

[giuseppe]

opened an issue and the PR:

• Podman run inside pod fails with: Error: OCI runtime error: crun: sd-bus call: Invalid unit name '.': Invalid argument #16376
• runtime: add check for valid pod systemd cgroup #16377