[BUG] `fatal: can only run as pid 1` when running on fly.io

[abitrolly]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The image fails to run with fly.io.

$ fly logs
...
[info] INFO Preparing to run: `/init` as root
[info] INFO [fly api proxy] listening at /.fly/api
[info]s6-overlay-suexec: fatal: can only run as pid 1

It seems fly.io uses its own /init process [reference needed], which takes pid 1.

Expected Behavior

No response

Steps To Reproduce

Save this to fly.toml.

app = 'wgflyvpn'

[[services]]
  internal_port = 51820
  protocol = 'udp'

  [[services.ports]]
    port = 51820

[build]
  image = 'lscr.io/linuxserver/wireguard'

[env]
  PEERS = '1'

[mounts]
  source = 'wgflyvpn_data'
  destination = '/config'

Run

fly deploy

When it fails, run

fly logs

Environment

- OS:
- How docker service was installed:

CPU architecture

x86-64

Docker creation

fly deploy

Container logs

[info] INFO Preparing to run: `/init` as root
[info] INFO [fly api proxy] listening at /.fly/api
[info]s6-overlay-suexec: fatal: can only run as pid 1

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[Roxedus]

This is not a bug, our containers are just simply incompatible with solutions that inject their own init.

[abitrolly]

@Roxedus the choice to be incompatible, does it worth it?

[abitrolly]

The error stems from using https://github.com/just-containers/s6-overlay

Is it possible to run WireGuard in a container without it?

[Roxedus]

No, that would be a unsupported configuration for our images.

[Roxedus]

All our logic( and therefore benefits) relies on the overlay, it makes complete sense to mark a custom init as incompatible.

[abitrolly]

@Roxedus I am not familiar with the overlay. What logic specifically?

If the overlay needs to be run as PID 1, can unshare call be used to make it happy (https://community.fly.io/t/i-want-to-set-up-a-server-with-wireguard-to-use-vpn-from-mobile-devices-but-when-i-start-it-i-get-the-error-error-failed-to-spawn-command-init-wrapper-no-such-file-or-directory-os-error-2/17298)?

[Roxedus]

Everything the container does is handled by s6. Like generating the keys and starting wireguard.

No, we will not use a shim to get a new namespace in the namespace.

[abitrolly]

@Roxedus so s6 is a bash replacement. But PID 1 - what is it for?

[Roxedus]

It is not.

[abitrolly]

No, we will not use a shim to get a new namespace in the namespace.

Yes, it doesn't make sense. But also I fail to see the reason enforce PID 1 in the tightly controlled process container environment.