podman build fails with segmentation fault when running nodejs while docker build (rancher) works

[michaelsantosus]

Hi,

I have a very simple Dockerfile that fails with a segmentation fault when I try to build with podman build, but successfully builds with docker build (docker engine via rancher).

note: This is just and example Dockerfile file in order to reproduce the error. The original file fails during an npm install. One of the packages calls a js file which fails when trying to run execSync.

Dockerfile

FROM node:18.17.1-buster
USER root

RUN mkdir -p /home/node/app
WORKDIR /home/node/app

COPY test.js test.js
RUN ls -lZ 
RUN node test.js

test.js

/**
 * test file
 */

var execSync = require('child_process').execSync;

/* Show make version */
printMakeVersion();

function printMakeVersion() {
    try {
        console.log("------------------------ STEP 1")
        var makeVersion = execSync('make -v').toString();
        console.log("------------------------ STEP 2")
        console.log(makeVersion)
    } catch (e) {
        console.log(e);
    }
}

podman

podman build command

podman build -t test:1 -f Dockerfile --platform=linux/amd64 --log-level=debug --no-cache .

podman build output

STEP 1/7: FROM node:18.17.1-buster
STEP 2/7: USER root
--> c42645fbf8ec
STEP 3/7: RUN mkdir -p /home/node/app
--> a0e80fe11dfb
STEP 4/7: WORKDIR /home/node/app
--> 35b709500c67
STEP 5/7: COPY test.js test.js
--> ab41ebc1ab00
STEP 6/7: RUN ls -lZ
total 4
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c188,c895 463 Apr 23 12:56 test.js
--> ab62713afc4d
STEP 7/7: RUN node test.js
------------------------ STEP 1
Segmentation fault (core dumped)
Error: building at STEP "RUN node test.js": while running runtime: exit status 139

.

docker

docker build command

docker build -t test:1 -f Dockerfile --platform=linux/amd64 --progress=plain --no-cache .

docker build output

#0 building with "rancher-desktop" instance using docker driver

#1 [internal] load build definition from Dockerfile
#1 transferring dockerfile: 177B done
#1 DONE 0.0s

#2 [internal] load .dockerignore
#2 transferring context: 251B done
#2 DONE 0.0s

#3 [internal] load metadata for docker.io/library/node:18.17.1-buster
#3 DONE 2.2s

#4 [1/6] FROM docker.io/library/node:18.17.1-buster@sha256:7923c641e2626803b58562ac1a337f27b419cf2068f8fb1368076ad33145d5c4
#4 CACHED

#5 [internal] load build context
#5 transferring context: 29B done
#5 DONE 0.0s

#6 [2/6] RUN mkdir -p /home/node/app
#6 DONE 0.2s

#7 [3/6] WORKDIR /home/node/app
#7 DONE 0.0s

#8 [4/6] COPY test.js test.js
#8 DONE 0.1s

#9 [5/6] RUN ls -lZ
#9 0.381 total 4
#9 0.381 -rw-r--r-- 1 root root ? 463 Apr 23 12:56 test.js
#9 DONE 0.4s

#10 [6/6] RUN node test.js
#10 0.796 ------------------------ STEP 1
#10 0.838 ------------------------ STEP 2
#10 0.838 GNU Make 4.2.1
#10 0.838 Built for x86_64-pc-linux-gnu
#10 0.838 Copyright (C) 1988-2016 Free Software Foundation, Inc.
#10 0.838 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
#10 0.838 This is free software: you are free to change and redistribute it.
#10 0.838 There is NO WARRANTY, to the extent permitted by law.
#10 0.838
#10 DONE 0.9s

#11 exporting to image
#11 exporting layers 0.0s done
#11 writing image sha256:cafdbc5578112ba51d7fbb2b9ec641fc206d3a64d3ede4211e2cd4f190ddaac9 done
#11 naming to docker.io/library/test:1 done
#11 DONE 0.0s
.

podman info

host:
  arch: arm64
  buildahVersion: 1.35.3
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - pids
  - rdma
  - misc
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.10-1.fc39.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: '
  cpuUtilization:
    idlePercent: 99.25
    systemPercent: 0.26
    userPercent: 0.49
  cpus: 4
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: coreos
    version: "39"
  eventLogger: journald
  freeLocks: 2048
  hostname: localhost.localdomain
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.8.4-200.fc39.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 1157443584
  memTotal: 15566155776
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.10.0-1.fc39.aarch64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.10.0
    package: netavark-1.10.3-1.fc39.aarch64
    path: /usr/libexec/podman/netavark
    version: netavark 1.10.3
  ociRuntime:
    name: crun
    package: crun-1.14.4-1.fc39.aarch64
    path: /usr/bin/crun
    version: |-
      crun version 1.14.4
      commit: a220ca661ce078f2c37b38c92e66cf66c012d9c1
      rundir: /run/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20240405.g954589b-1.fc39.aarch64
    version: |
      pasta 0^20240405.g954589b-1.fc39.aarch64-pasta
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.2-1.fc39.aarch64
    version: |-
      slirp4netns version 1.2.2
      commit: 0ee2d87523e906518d34a6b423271e4826f71faf
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 0
  swapTotal: 0
  uptime: 68h 1m 57.00s (Approximately 2.83 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.imagestore: /usr/lib/containers/storage
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 259240472576
  graphRootUsed: 17031761920
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1040
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 5.0.2
  Built: 1713312000
  BuiltTime: Tue Apr 16 20:00:00 2024
  GitCommit: ""
  GoVersion: go1.21.9
  Os: linux
  OsArch: linux/arm64
  Version: 5.0.2

podman machine inspect

[
     {
          "ConfigDir": {
               "Path": "/Users/michaelsantos/.config/containers/podman/machine/applehv"
          },
          "ConnectionInfo": {
               "PodmanSocket": {
                    "Path": "/var/folders/nz/_jnxjd9n3jj9r3wvt1r0m6xm0000gn/T/podman/podman-machine-default-api.sock"
               },
               "PodmanPipe": null
          },
          "Created": "2024-04-19T17:16:26.556207-04:00",
          "LastUp": "0001-01-01T00:00:00Z",
          "Name": "podman-machine-default",
          "Resources": {
               "CPUs": 4,
               "DiskSize": 242,
               "Memory": 15258,
               "USBs": []
          },
          "SSHConfig": {
               "IdentityPath": "/Users/michaelsantos/.local/share/containers/podman/machine/machine",
               "Port": 62359,
               "RemoteUsername": "core"
          },
          "State": "running",
          "UserModeNetworking": true,
          "Rootful": true
     }
]

what I tried

I understand podman adds some extra security to the images, such as selinux. I added a RUN ls -lZ to the Dockerfile and I can see the file has the selinux labels.

podman engine test -lZ

-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c1022,c1023 463 Apr 23 12:56 test.js

docker engine test -lZ

-rw-r--r-- 1 root root ? 463 Apr 23 12:56 test.js

Because I assumed this could be permissions related, the things I have tried during the podman build:

• chmod 777 on both the node binary and the test.js file
• tried removing the selinux labels without success (chcon, setfattr)
• tried turning selinux off, only to find out it does not actually seem to be running during the build stage
• tried the --security-opt=label=disable flag option
• tried running as su RUN su root -c "node test.js"

So far no luck. Any thoughts or ideas would be appreciated, thanks!

[tnk4on]

This is same problem #22445.
You have to wait for Rosetta support to be released.

% podman machine inspect --format {{.Rosetta}}
true
% podman build -t test:1 --platform=linux/amd64 --no-cache .
STEP 1/7: FROM node:18.17.1-buster
STEP 2/7: USER root
--> 98c42224f885
STEP 3/7: RUN mkdir -p /home/node/app
--> 6000290ecb80
STEP 4/7: WORKDIR /home/node/app
--> 7c23ec6052de
STEP 5/7: COPY test.js test.js
--> 90c57a525f82
STEP 6/7: RUN ls -lZ
total 4
-rw-r--r--. 1 root root system_u:object_r:container_file_t:s0:c78,c652 409 Apr 23 20:02 test.js
--> bbf0f1804b20
STEP 7/7: RUN node test.js
------------------------ STEP 1
------------------------ STEP 2
GNU Make 4.2.1
Built for x86_64-pc-linux-gnu
Copyright (C) 1988-2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

COMMIT test:1
--> 5c9af5d00c7d
Successfully tagged localhost/test:1
5c9af5d00c7dee1b1557284fba2343b7e0fcf8eb6864324efc5cfcc049574c24

[michaelsantosus]

Thank you!