Mailinglist Archive: opensuse-factory (765 mails)

< Previous Next >
Re: [opensuse-factory] kernel 4.14 and docker

Am Freitag, 24. November 2017 schrieb Knurpht - Gertjan Lettink:
The above combo gives an internal server error when using collabora
online in my nextcloud setup on a TW server . When I reboot into
kernel 4.13 everything works as expected. I've tried reconfiguring
the whole setup to make it work with 4.14 ( incl reïnstalling docker
after removing all configs and data in / var ) only to find out that
I didn't make any mistakes ( i.e. with 4.13 everything works fine ).
Any hints, clues ?

Without seeing any error messages, I can only guess. At least the fact
that booting with 4.13 solves the problem gives a hint, therefore my
guess is...

Maybe it's related to AppArmor - in 4.14, support for mount, signal and
pivot_root rules was upstreamed, so you might need to adjust your
AppArmor profiles. Check /var/log/audit/audit.log for DENIED messages.
You can update your profiles manually or using aa-logprof [1].

I tested quite a few things with 4.14rc kernels to find out which
profiles need an update (it mostly affected libvirt), but I have to
admit I don't use docker and therefore didn't test if its AppArmor
profile [2] needs some additions.

There's also a kernel bug that was fixed today, but isn't in any
snapshot yet:
If you are affected by this, keep 4.13.x until the fixed kernel reaches


Christian Boltz

[1] aa-logprof doesn't support adding mount and pivot_root rules because
their usage is too rare and because I'm lazy ;-) Docker _might_ be
one of the few programs that need such rules.
If in doubt, open a bugreport and attach your audit.log, and I'll
check which rules you need.

[2] Last time I checked the Docker AppArmor profile, I copied some lines
from it to my "AppArmor Crash Course" slides where they now serve as
a bad example. And that was _after_ I helped to fix some issues with

Wäre es nicht eine Verbesserung, wenn bei der nächsten Win Version
anstatt der beängstigenden Meldung "schwerer Ausnahmefehler" ein
beruhigendes "ärgerliches Standardproblem" den bevorstehenden
Absturz ankündigte? [Hans Goebl in de.etc.bahn.eisenbahn]

To unsubscribe, e-mail: opensuse-factory+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse-factory+owner@xxxxxxxxxxxx

< Previous Next >