【25.09】【RISC-V】lcr 运行时下需要添加 --security-opt seccomp=unconfined 参数才可以启动系统容器-iSulad-AtomGit

Open

【25.09】【RISC-V】lcr 运行时下需要添加 --security-opt seccomp=unconfined 参数才可以启动系统容器 #111

peeweepAdd on Oct 31, 2025

Oct 31, 2025 Create

【缺陷描述】：请补充详细的缺陷问题现象描述

一、缺陷信息

【缺陷所属的os版本】

25.09 qemu: https://dl-cdn.openeuler.openatom.cn/openEuler-25.09/virtual_machine_img/riscv64/openEuler-25.09-riscv64.qcow2.xz
24.03 sp2 docker: https://dl-cdn.openeuler.openatom.cn/openEuler-24.03-LTS-SP2/docker_img/riscv64/openEuler-docker.riscv64.tar.xz

【内核版本】
6.6.0-102.0.0.5.oe2509.riscv64

【缺陷所属软件及版本号】
iSulad-2.1.5-21.oe2509.riscv64
lcr-2.1.4-21.oe2509.riscv64
lxcfs-5.0.4-3.oe2509.riscv64
lxcfs-tools-0.3-36.oe2509.riscv64
syscontainer-tools-0.9-67.oe2509.riscv64

【环境信息】

【问题复现步骤】

https://docs.openeuler.openatom.cn/zh/docs/25.09/cloud/container_form/system_container/overview.html

根据文档内容，在测试系统容器特性的过程中，发现 RISC-V 架构下无法启动系统容器。具体来说是在 lcr 运行时下无法启动任何容器，包括系统容器或者最基础的 busybox 容器，需要添加 --security-opt seccomp=unconfined 才可以启动。

以下测试步骤以启动 2403 sp2 riscv 系统容器为例

安装isulad，更改运行时为 lcr 并启动

yum install -y iSulad syscontainer-tools lxcfs-tools lxcfs tar lcr wget
sed -i '/runc/s/runc/lcr/' /etc/isulad/daemon.json
systemctl start lxcfs
systemctl restart isulad

wget https://dl-cdn.openeuler.openatom.cn/openEuler-24.03-LTS-SP2/docker_img/riscv64/openEuler-docker.riscv64.tar.xz
isula load -i openEuler-docker.riscv64.tar.xz

mkdir /opt/rootfs
cp openEuler-docker.riscv64.tar.xz /opt/rootfs
xz -d /opt/rootfs/openEuler-docker.riscv64.tar.xz
img_tar=$(find /opt/rootfs -name "*.tar" | awk -F"/" '{print $NF}')
tar -xf "/opt/rootfs/$img_tar" --directory /opt/rootfs
root_tar=$(ls /opt/rootfs/*tar* | grep -v "$img_tar" | awk -F"/" '{print $NF}')
tar -xf /opt/rootfs/"$root_tar" --directory /opt/rootfs

运行 system-container

isula run -itd -n systest --system-container --external-rootfs /opt/rootfs openeuler-24.03-lts-sp2

由于使用默认的 runc 运行时会遇到与 https://gitee.com/src-openeuler/iSulad/issues/I9U4JI 同样的报错，因此在启动 isulad 前已经将 runc 改为 lcr 运行时

【实际结果】

在 lcr 运行时下启动镜像失败:

[root@localhost ~]# isula run -itd -n systest --system-container --external-rootfs /opt/rootfs openeuler-24.03-lts-sp2
68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d
Error response from daemon: Start container error: Container is not running:68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d

journalctl -f -u isulad 看到日志报错： sync - ../src/lxc/sync.c:sync_wake:47 -Broken pipe - Sync wake failure

Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.109 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: Creating systest}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.111 ERROR    /home/lkp/rpmbuild/BUILD/iSulad-v2.1.5/src/daemon/modules/image/oci/storage/image_store/image_store.c:image_store_exists:1790 - Image /opt/rootfs:latest not known
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.125 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: preparing rootfs with image openeuler-24.03-lts-sp2}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.125 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: prepared rootfs with image openeuler-24.03-lts-sp2}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.135 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: mounting rootfs}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.135 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: mounted rootfs}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.135 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: umounting rootfs}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.135 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: umounted rootfs}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.152 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: Created systest}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.257 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: Starting}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.269 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: mounting rootfs}
Oct 31 03:35:30 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033530.270 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: mounted rootfs}
Oct 31 03:35:31 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033531.250 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: Resizing}
Oct 31 03:35:32 localhost.localdomain isulad[4660]: f9d8d9126f5e19d 20251031033532.483 ERROR    sync - ../src/lxc/sync.c:sync_wake:47 -Broken pipe - Sync wake failure
Oct 31 03:35:32 localhost.localdomain isulad[4660]: f9d8d9126f5e19d 20251031033532.485 ERROR    lxccontainer - ../src/lxc/lxccontainer.c:wait_on_daemonized_start:966 -Received container state "ABORTING" instead of "RUNNING"
Oct 31 03:35:32 localhost.localdomain isulad[4660]: f9d8d9126f5e19d 20251031033532.488 ERROR    start - ../src/lxc/start.c:__lxc_start:2750 -Failed to spawn container "68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d"
Oct 31 03:35:32 localhost.localdomain isulad[4660]: f9d8d9126f5e19d 20251031033532.529 ERROR    lxc_start - ../src/lxc/tools/lxc_start.c:main:408 -The container failed to start
Oct 31 03:35:32 localhost.localdomain isulad[4660]: f9d8d9126f5e19d 20251031033532.530 ERROR    lxc_start - ../src/lxc/tools/lxc_start.c:main:411 -To get more details, run the container in foreground mode
Oct 31 03:35:32 localhost.localdomain isulad[4660]: f9d8d9126f5e19d 20251031033532.530 ERROR    lxc_start - ../src/lxc/tools/lxc_start.c:main:413 -Additional information can be obtained by setting the --logfile and --logpriority options
Oct 31 03:35:32 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033532.538 ERROR    /home/lkp/rpmbuild/BUILD/lcr-v2.1.4/src/runtime/lcrcontainer.c:wait_start_pid:235 - Start container failed
Oct 31 03:35:32 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033532.550 ERROR    /home/lkp/rpmbuild/BUILD/lcr-v2.1.4/src/runtime/lcrcontainer.c:lcr_check_container_running:326 - Container is not running
Oct 31 03:35:32 localhost.localdomain isulad[4660]:           iSula 20251031033532.551 ERROR    /home/lkp/rpmbuild/BUILD/lcr-v2.1.4/src/runtime/lcrcontainer.c:wait_start_pid:241 - Failed to stop container
Oct 31 03:35:32 localhost.localdomain isulad[4660]:           iSula 20251031033532.551 ERROR    /home/lkp/rpmbuild/BUILD/iSulad-v2.1.5/src/daemon/modules/runtime/engines/lcr/lcr_rt_ops.c:rt_lcr_start:169 - Start container error: Container is not running:68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d
Oct 31 03:35:32 localhost.localdomain isulad[4660]:           iSula 20251031033532.551 ERROR    /home/lkp/rpmbuild/BUILD/iSulad-v2.1.5/src/daemon/modules/service/service_container.c:wait_exit_fifo_epoll_callback:643 - The container 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d 's monitor on fd 23 has exited: -1
Oct 31 03:35:32 localhost.localdomain isulad[4660]:           iSula 20251031033532.566 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: umounting rootfs}
Oct 31 03:35:32 localhost.localdomain isulad[4660]:           iSula 20251031033532.566 - Event: {Object: 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d, Type: umounted rootfs}
Oct 31 03:35:32 localhost.localdomain isulad[4660]:           iSula 20251031033532.568 ERROR    /home/lkp/rpmbuild/BUILD/iSulad-v2.1.5/src/daemon/modules/service/service_container.c:start_container:1063 - Runtime start container failed
Oct 31 03:35:32 localhost.localdomain isulad[4660]: 68fa6ba760e4cd8 20251031033532.576 ERROR    /home/lkp/rpmbuild/BUILD/iSulad-v2.1.5/src/daemon/executor/container_cb/execution_extend.c:resize_container:1476 - Container 68fa6ba760e4cd8de152781d42adb23080fa99f71df7533b9f9d8d9126f5e19d is not running

关闭 seccomp 后可以成功启动，猜测是/etc/isulad/seccomp_default.json 中缺少某些 riscv 架构的 syscall

isula run -itd -n systest --security-opt seccomp=unconfined --system-container --external-rootfs /opt/rootfs openeuler-24.03-lts-sp2

【期望结果】

在 riscv 架构下，无需添加 seccomp=unconfined 参数即可启动容器

【其他相关附件信息】
比如系统message日志/组件日志、dump信息、图片等

【缺陷详情及分析指导参考链接】

二、缺陷分析结构反馈
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1
openEuler-24.03-LTS-SP2

P peeweep

Oct 31, 2025 创建了缺陷

openeuler-ci-botCollaborators

Oct 31, 2025 Comments：

Bug Issue Usage Guide

To change the issue status to 已验收, 已挂起, or 已取消, you need to perform the operation by commenting.
If the issue is not associated with a milestone, either the issue creator or repository maintainer can change its status to one of the three states by commenting as shown in the table below.
If the issue is associated with a milestone, refer to the table below.

Comment	Target Status	Who Can Do It
/state2accepted	已验收	Issue creator
/state2suspended	已挂起	Release managerment SIG maintainer
/state2cancelled	已取消	QA SIG maintainer

Notice ❗

When adding a milestone, if the current issue status is 已验收, 已挂起, or 已取消, manually change the status to 待办的.

openeuler-ci-botCollaborators

Oct 31, 2025 Comments：

Hi peeweep, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: iSulad, and any of the maintainers: @jingxiaolu , @jingwoo , @lifeng2221dd1 , @xuxuepeng , @caihaomin , @duguhaotian , any of the committers: @liuxu180400617 , @taotao-sauce

openeuler-ci-botCollaborators

Oct 31, 2025 将负责人设置为liuxu

openeuler-ci-botCollaborators

Oct 31, 2025 Comments：

@caihaomin , @duguhaotian , @jingxiaolu , @jingwoo , @lifeng2221dd1 , @xuxuepeng , @liuxu180400617 , @taotao-sauce
以下的要求不是强制性的, 未按模板评论时对issue无任何影响
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, 缺陷严重等级, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后defect-manager将无法正常解析填写内容.
评论区可能使用到的指令说明:

指令	指令说明	使用权限
/check-issue	触发defect-manager校验	不限
/reason xxx	/reason +挂起或取消条件	不限

影响性分析说明:

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):

openEuler-20.03-LTS-SP4:
openEuler-22.03-LTS-SP3:
openEuler-22.03-LTS-SP4:
openEuler-24.03-LTS:
openEuler-24.03-LTS-SP1:
openEuler-24.03-LTS-SP2:

abi变化(是/否):

openEuler-20.03-LTS-SP4:
openEuler-22.03-LTS-SP3:
openEuler-22.03-LTS-SP4:
openEuler-24.03-LTS:
openEuler-24.03-LTS-SP1:
openEuler-24.03-LTS-SP2:

缺陷issue处理具体操作请参考:
https://gitee.com/Coopermassaki/cve-manager/blob/master/cve-vulner-manager/doc/md/defect-manager-manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

openeuler-ci-botCollaborators

Oct 31, 2025 修改了描述

openeuler-ci-botCollaborators

Oct 31, 2025 添加了   DEFECT/UNFIXED 标签

openeuler-ci-botCollaborators

Oct 31, 2025 将计划截止日期设置为2025-12-01

openeuler-ci-botCollaborators

Oct 31, 2025 添加了   sig/iSulad 标签

openeuler-ci-botCollaborators

Oct 31, 2025 将计划开始日期设置为2025-10-31

P peeweep

Oct 31, 2025 修改了描述