FreeBSD, podman and dotnet (mlock)

[josh-endries]

Hello,

I have been trying to get the Jellyfin container running via podman on FreeBSD. I am able to run other Linux containers/commands, but Jellyfin uses dotnet, which seems to be causing an issue ("Failed to create CoreCLR, HRESULT: 0x8007FF02"). From my research it seems like this is due to .NET locking a single page of memory (I think for locks/semaphores).

It seems like the typical way this gets solved elsewhere (e.g. when running via jails) is by enabling "mlock" within the jail, but I haven't been able to find anything related to "mlock" for podman, which isn't too surprising if it's a FreeBSD-ism (there are dozens of us!). I have tried various switches like --privileged, --cap-add=IPC_LOCK and other semi-random things I've found reference to, but nothing helps. Is there a way to enable this functionality? Or maybe I am looking in the wrong place. Or maybe it's just not possible.

My typical command is sudo podman run --os=linux docker.io/jellyfin/jellyfin. Using the ghcr.io image or without --os gives the same result.

FreeBSD 15.0
podman-5.6.1 (pkg)
ocijail 0.4.0 (pkg)

[mvanbaak]

I have the same problem when trying to run the nzbdav container image:

root@freebsd01:/root # podman run --privileged --rm --os=linux -it -p 3000:3000 docker.io/nzbdav/nzbdav:alpha
Running database maintenance.
Failed to create CoreCLR, HRESULT: 0x8007FF02
Database migration failed. Exiting with error code 0.

Same FreeBSD and package versions :)

[2a46m4]

It looks like the current workaround is to patch ocijail: https://daemonless.io/guides/ocijail-patch/

[josh-endries]

Great find, that led me to find this issue which is also relevant and has some more information: dfr/ocijail#3

I will close this since we have pointers to patches/hooks and plans to fix it in an upcoming release.