Closed
Description
Description
Running a service with an option security_opt: [ "systempaths=unconfined" ] yields following error:
Error response from daemon: invalid --security-opt 2: "systempaths=unconfined"
However, providing the same option to docker client (--security-opt systempaths=unconfined) works properly:
> docker run --rm --security-opt systempaths=unconfined ubuntu ls /sys/firmware
devicetree ftd
Steps to reproduce the issue:
1.
cat > docker-compose.yml << E
version: "3"
services:
ls:
image: ubuntu:latest
command: "ls /sys/firmware"
security_opt: [ "systempaths=unconfined" ]
E
docker compose run ls
Describe the results you received:
Error response from daemon: invalid --security-opt 2: "systempaths=unconfined"
Describe the results you expected:
devicetree ftd
Additional information you deem important (e.g. issue happens only occasionally):
Output of docker compose version:
Docker Compose version v2.5.0
Output of docker info:
Client:
Context: default
Debug Mode: false
Plugins:
app: Docker App (Docker Inc., v0.9.1-beta3)
buildx: Docker Buildx (Docker Inc., v0.8.2-docker)
compose: Docker Compose (Docker Inc., v2.5.0)
Server:
Containers: 1
Running: 0
Paused: 0
Stopped: 1
Images: 6
Server Version: 20.10.16
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
userxattr: false
Logging Driver: json-file
Cgroup Driver: systemd
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 212e8b6fa2f44b9c21b2798135fc6fb7c53efc16
runc version: v1.1.1-0-g52de29d
init version: de40ad0
Security Options:
seccomp
Profile: default
cgroupns
Kernel Version: 5.15.32-v7l+
Operating System: Raspbian GNU/Linux 11 (bullseye)
OSType: linux
Architecture: armv7l
CPUs: 3
Total Memory: 7.714GiB
Name: raspberrypi
ID: LBW3:Z6MM:4JJR:4SOJ:E2FQ:HARU:WMQY:UZLQ:WNYB:Y4O4:IJM2:CDQZ
Docker Root Dir: /var/lib/docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false
WARNING: No memory limit support
WARNING: No swap limit support
Additional environment details:
arch: armv7l
Metadata
Metadata
Assignees
Labels
No labels