Solved: Docker-Related Container: Install Error - failed to create task for container (containerd.io Issues / external)

[shhyguuy]

✅ Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

Komodo

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/ct/komodo.sh)"

⚙️ What settings are you using?

• Default Settings
• Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 12

📈 Which Proxmox version are you on?

pve-manager/9.0.11/3bf5476b8a4699e2 (running kernel: 6.14.11-4-pve)

📝 Provide a clear and concise description of the issue.

After selecting either database, I get the following errors:

Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied: unknown

[ERROR] in line 85: exit code 0: while executing command $STD docker compose -p komodo -f /opt/komodo/$DB_COMPOSE_FILE --env-file /opt/komodo/compose.env up -d

[ERROR] in line 1345: exit code 0: while executing command lxc-attach -n "$CTID" -- bash -c "$(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/install/${var_install}.sh)"

🔄 Steps to reproduce the issue.

Step 1: Run the install script
Step 2: Select a database (either option gives the same error)

❌ Paste the full error output (if available).

✔️ Installed Docker
Choose the database for Komodo installation:
1) MongoDB (recommended)
2) FerretDB
Enter your choice (default: 1):
✔️ Setup Komodo Environment
[+] Running 33/33Komodo
✔ core Pulled 15.2s
✔ periphery Pulled 12.0s
✔ mongo Pulled 28.2s
[+] Running 4/6
✔ Network komodo_default Created 0.0s
✔ Volume komodo_mongo-data Created 0.0s
✔ Volume komodo_mongo-config Created 0.0s
⠼ Container komodo-mongo-1 Starting 0.5s
⠼ Container komodo-periphery-1 Starting 0.5s
✔ Container komodo-core-1 Created 0.0s
Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied: unknown

[ERROR] in line 85: exit code 0: while executing command $STD docker compose -p komodo -f /opt/komodo/$DB_COMPOSE_FILE --env-file /opt/komodo/compose.env up -d

[ERROR] in line 1345: exit code 0: while executing command lxc-attach -n "$CTID" -- bash -c "$(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxVE/raw/branch/main/install/${var_install}.sh)"

🖼️ Additional context (optional).

No response

[shhyguuy]

While searching reddit I found this thread opened just hours ago, which seems to suggest an issue with a new version of containerd released today.

containerd.io/bookworm 1.7.28-2~debian.12~bookworm amd64 - Throws errors

Rolling back to 1.7.28-1 with apt install containerd.io=1.7.28-1~debian.12~bookworm and trying to upgrade inside the LXC appears to be successful, but I'm not sure what I'm missing anything by not going through the install script completely.

[MickLesk]

Are you good in Proxmox?

Can you try following:

pct stop CTID
nano /etc/pve/lxc/CTID.conf

#Add below:
lxc.apparmor.profile: unconfined

pct start CTID

After that, enter in your LXC, f.e. /opt/komodo and hit docker compose up -d

[MickLesk]

Ah allright. Fancy. I cannot reproduce it.

[ianespana]

Found the same issue with a new installation of the Docker LXC

Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied: unknown

[L01P]

It is related to the following issue,
containerd/containerd#12484

[cyphar]

This is due to an AppArmor bug, see lxc/incus#2624 for the changes needed to the LXC AppArmor configuration to work around this. There is also a hotfix version in lxc/incus#2623 (comment).

The runc update included in the containerd update contains fixes for 3 high-severity CVEs, I would strongly recommend against downgrading.

[Powerbless]

This is due to an AppArmor bug, see lxc/incus#2624 for the changes needed to the LXC AppArmor configuration to work around this. There is also a hotfix version in lxc/incus#2623 (comment).

The runc update included in the containerd update contains fixes for 3 high-severity CVEs, I would strongly recommend against downgrading.

So what does that mean? Do I have to update my Proxmox host?

[MickLesk]

you can try my howto above, with apparmor. Maybe this work. The issue doesnt affected my system, so i cant test

[Landelor]

@MickLesk steps above fixed it for me for now.

[MickLesk]

Thx, then i can implement it for docker based containers

[Powerbless]

Are you good in Proxmox?

Can you try following:

pct stop CTID

nano /etc/pve/lxc/CTID.conf

Add below: lxc.apparmor.profile: unconfined

pct start CTID

Go into LXC, /opt/komodo and hit docker compose up -d

Thank you, worked. When can I delete the line I just added?

[jlssmt]

when i add lxc.apparmor.profile: unconfined
and reboot the lxc on pve i get this

pct reboot 101
explicitly configured lxc.apparmor.profile overrides the following settings: features:fuse, features:nesting

and inside the lxc starting a docker container i get this

Error response from daemon: Could not check if docker-default AppArmor profile was loaded: open /sys/kernel/security/apparmor/profiles: permission denied

proxmox v9 (debian 13) + lxc ubuntu 22.04 (debian 12)