blocky 0.17 running in docker/portainer always marked as "unhealthy"

[ikarisan]

Hi!

I am running blocky within a docker container. But after upgrading blocky from 0.16 to 0.17 the container is always shown as "unhealthy".

The last errors (16 within 14 minutes) I got are:

"OCI runtime exec failed: exec failed: container_linux.go:344: starting container process caused "process_linux.go:95: adding pid 25494 to cgroups caused "failed to write 25494 to cgroup.procs: write /sys/fs/cgroup/cpu,cpuacct/docker/e9d2d16dc71273df00ba003fdad43d44dcd7b4c146c1de252f422a81be37e252/cgroup.procs: invalid argument"": unknown

[...]

"time.c:126: Operation not permitted timer.c:617: fatal error: RUNTIME_CHECK(isc_time_now((&now)) == 0) failed Aborted (core dumped)"

The last error repeats every minute.

Is this a serious problem? How to fix this?`

[0xERR0R]

Do you run it on a raspberry pi?

[ikarisan]

Yes, I am running it on an RaspberryPi 4

[0xERR0R]

Its a bug in raspbian, see alpinelinux/docker-alpine#110

You can either install libseccomp2 from backports or updrade to newer raspbian version.

You can also temporarily disable healthcheck in your docker-compose

[ikarisan]

Diasbling healthcheck did the trick.
Installing libseccomp2 from backports did not change anything. :(

Its a bug in raspbian, see alpinelinux/docker-alpine#110

You can either install libseccomp2 from backports or updrade to newer raspbian version.

You can also temporarily disable healthcheck in your docker-compose

[0xERR0R]

I had the same problem with navidrome in docker on pi3 (navidrome/navidrome#773), but it was fixed after I updated the libseccomp package. My blocky (latest dev version) is healthy now.

[kwitsch]

I'm using the the image from timebertt for 3/4 year on PI-2/3/4.

blocky 0.17 deployed as stack with portainer on a 5 node swarm(3 manager) without a problem(healthcheck enabled & no errors).

configuration snippets

cloud-config:

package_update: true
package_upgrade: true
package_reboot_if_required: true

apt:
  sources:
    docker.list:
      source: deb [arch=arm64,armhf] https://download.docker.com/linux/debian $RELEASE stable
      keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88

packages:
  - docker-ce
  - docker-ce-cli

service definition:

  blocky:
    image: spx01/blocky
    logging: *logging
    networks: *network-internal
    deploy: *deploy-endpoint
    ports:
      - target: 53
        published: 53
        protocol: tcp
        mode: host
      - target: 53
        published: 53
        protocol: udp
        mode: host
    configs:
      - source: blocky_config
        target: /app/config.yml
    environment:
      TZ: Europe/Berlin

[0xERR0R]

If I understand it right, the problem occurs only on arm7 and only with older raspbian/debian (<= buster). OS upgrade or installation of libseccomp2 from backport solves the problem. This problem occurs since upgrade to alpine 3.13.

[ikarisan]

This is my system:

Raspbian GNU/Linux 10
Linux dns 5.10.63-v8+ #1496 SMP PREEMPT Wed Dec 1 15:59:46 GMT 2021 aarch64 GNU/Linux
libseccomp2:armhf 2.5.1-1~bpo10+1

What do you meen with Alpine 3.13? The image blocky 0.17 is based on?

[kwitsch]

Shouldn't the installed version for arm-v8+ be arm64?

My system output:

cat /proc/version
Linux version 5.10.60-v8+ (dom@buildbot) (aarch64-linux-gnu-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1449 SMP PREEMPT Wed Aug 25 15:01:33 BST 2021

apt list libseccomp2

Listing... Done
libseccomp2/oldstable,now 2.3.3-4 arm64 [installed]
libseccomp2/oldstable 2.3.3-4 armhf

[0xERR0R]

This is my system:

Raspbian GNU/Linux 10 Linux dns 5.10.63-v8+ #1496 SMP PREEMPT Wed Dec 1 15:59:46 GMT 2021 aarch64 GNU/Linux libseccomp2:armhf 2.5.1-1~bpo10+1

What do you meen with Alpine 3.13? The image blocky 0.17 is based on?

Yes, blocky is based on Alpine 3.14

[0xERR0R]

This is the output from my pi3. Healthcheck is working (I've installed libseccomp2 as backport a long time ago):

pi@pi3:~$ cat /proc/version 
Linux version 5.10.63-v7+ (dom@buildbot) (arm-linux-gnueabihf-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1459 SMP Wed Oct 6 16:41:10 BST 2021
pi@pi3:~$ apt list libseccomp2
Listing... Done
libseccomp2/now 2.5.1-1 armhf [installed,local]
N: There is 1 additional version. Please use the '-a' switch to see it
pi@pi3:~$ docker ps | grep blocky
113c4dcfe49a   92f11f2ae46a                     "/sbin/tini -- /app/…"   3 weeks ago     Up 3 weeks (healthy)                                                                                                                         blocky

[kwitsch]

So far:

@0xERR0R v7 -> armhf working
@kwitsch v8 -> arm64 working
@ikarisan v8 -> armhf not working