Running buildah in a systemd-nspawn container since systemd-253

[enku]

I upgraded a bare-metal machine to systemd-253. On the bare-metal machine I run Jenkins in a systemd-nspawn container (without user namespaces). Inside the Jenkins container are build jobs that run buildah (rootless). This worked fine when until the host was upgraded to systemd-253 for now which the build jobs get:

buildah run $container -- ...
error running container: from /usr/bin/crun creating container for [/usr/bin/make -f- emerge-info]: mount `proc` to `/proc`: Operation not permitted

I left some buildah flags out of the example above just to remove some noise but can include them if needed (mainly volume mounts).

Does anyone know what might be causing it or what a workaround is? For now I've just downgraded to systemd-252.6 on the host.

[enku]

It might matter so I'll mention that the Jenkins (systemd-nspawn) container is running systemd-252.4.

[rhatdan]

The /proc issue is because systemd-nspawn is modifying the /proc mount point, which is blocking the use of containers attempting to etup their own /proc

buildah run -v /proc:/proc ...
Might fix the problem.

[enku]

Sounds reasonable. I was looking for something like that in the systemd-253 release notes but for the life of me I can't find it.

[enku]

Sounds reasonable. I was looking for something like that in the systemd-253 release notes but for the life of me I can't find it.

... nevertheless that seems to have done the trick so I'll mark this as fixed. Thanks @rhatdan.

[enku]

Perhaps it's not fixed or only fixed sometimes? It appears that /usr/bin/crun tries to mount /proc regardless of the --volume flag:

buildah run --mount=type=tmpfs,tmpfs-mode=755,destination=/run --volume /proc:/proc --volume /var/lib/jenkins/distfiles:/var/cache/distfiles --volume /var/tmp/jenkins/testing:/var/tmp/portage testing-root -- make -f- world < Makefile.container
error running container: from /usr/bin/crun creating container for [/usr/bin/make -f- world]: mount `proc` to `/proc`: Operation not permitted

I realize that crun is not a part of buildah per-se. Perhaps I should be asking over there?

[enku]

It seems that sometimes the Jenkins builds work with the same buildah run command and sometimes they fail.