Unable to install Swift in docker-in-gvisor

[xpbowler]

Description

Building the following Dockerfile inside the docker-in-gvisor container hangs on the swiftly init line. I tried to strace, but wasn't sure what too look for inside .boot.txt. It works with docker-in-docker (outer docker with runc runtime).

I did find

grep "errno=4" runsc.log.20250722-192900.418184.boot.txt
I0722 19:29:01.676393       1 strace.go:614] [  23:  40] containerd X epoll_pwait(0x4 anon_inode:[eventpoll], 0x7eaebd7f95e4 {}, 0x80, 0xf4, null, 0x0) = 0 (0x0) errno=4 (request was interrupted) (4.714µs)
I0722 19:29:11.425557       1 strace.go:614] [  92:  94] docker-buildx X epoll_pwait(0x4 anon_inode:[eventpoll], 0xc00009b764 {}, 0x80, 0x94, null, 0x0) = 0 (0x0) errno=4 (request was interrupted) (72.522µs)
I0722 19:29:44.826417       1 strace.go:614] [ 3302: 3310] runc X epoll_pwait(0x4 anon_inode:[eventpoll], 0x7ef08ccb7624 {}, 0x80, 0xe73c, null, 0x0) = 0 (0x0) errno=4 (request was interrupted) (426.836µs)

due to getting the following error, but am not sure if its relevant.

 > [6/9] RUN /tmp/swiftly/swiftly init --quiet-shell-followup --assume-yes --skip-install --verbose:
1.713 runc run failed: unable to start container process: error during container init: reading from parent failed: fetch packet length from socket: interrupted system call

Dockerfile:

FROM ubuntu:24.04
ENV LANG="C.UTF-8"
ENV HOME=/root
ARG SWIFT_VERSION=6.1
RUN apt-get update && apt-get upgrade -y
RUN apt-get install -y curl tar gpg
RUN mkdir /tmp/swiftly \
    && cd /tmp/swiftly \
    && curl -O https://download.swift.org/swiftly/linux/swiftly-$(uname -m).tar.gz
RUN cd /tmp/swiftly && tar zxf swiftly-$(uname -m).tar.gz -C /tmp/swiftly/
RUN /tmp/swiftly/swiftly init --skip-install --quiet-shell-followup --assume-yes --verbose
RUN echo '. ~/.local/share/swiftly/env.sh' >> /etc/profile
RUN bash -lc "swiftly install --use ${SWIFT_VERSION}"
RUN rm -rf /tmp/swiftly

Steps to reproduce

Run the following script:

#!/bin/bash

docker run --runtime runsc -d --rm --cap-add all --name docker-in-gvisor docker-in-gvisor
docker exec docker-in-gvisor mkdir -p /build

docker exec docker-in-gvisor bash -c "cat > /build/Dockerfile <<EOF
FROM ubuntu:24.04
ENV LANG=\"C.UTF-8\"
ENV HOME=/root
ARG SWIFT_VERSION=6.1
RUN apt-get update && apt-get upgrade -y
RUN apt-get install -y curl tar gpg
RUN mkdir /tmp/swiftly \\
    && cd /tmp/swiftly \\
    && curl -O https://download.swift.org/swiftly/linux/swiftly-\\\$(uname -m).tar.gz
RUN cd /tmp/swiftly && tar zxf swiftly-\\\$(uname -m).tar.gz -C /tmp/swiftly/
RUN /tmp/swiftly/swiftly init --skip-install --quiet-shell-followup --assume-yes --verbose
RUN echo '. ~/.local/share/swiftly/env.sh' >> /etc/profile
RUN bash -lc \"swiftly install --use \${SWIFT_VERSION}\"
RUN rm -rf /tmp/swiftly
EOF"

docker exec docker-in-gvisor bash -c "docker build --network=host -t base_image --load /build"

runsc version

runsc version release-20250707.0-15-g830cc9884e4d
spec: 1.2.0

docker version (if using docker)

Docker version 28.3.2, build 578ccf6

uname

Linux ip-10-1-14-250.ec2.internal 5.15.0-307.178.5.el9uek.x86_64 #2 SMP Wed Mar 19 13:03:40 PDT 2025 x86_64 x86_64 x86_64 GNU/Linux

[avagin]

In my case, it is stuck on swiftly init:

It appears to be a network issue. Two UDP sockets were connected to the loopback address. One process sent data through one socket, but another process, waiting on the second socket, received no data:

$ cat /tmp/runsc.log5 | grep 'socket:\[50[56]\]'
I0723 22:08:09.434253       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E bind(0x10 socket:[505], 0x7ec75f1d8450 {Family: AF_INET, Addr: 127.0.0.1, Port: 0}, 0x10)
I0723 22:08:09.434349       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X bind(0x10 socket:[505], 0x7ec75f1d8450 {Family: AF_INET, Addr: 127.0.0.1, Port: 0}, 0x10) = 0 (0x0) (53.663µs)
I0723 22:08:09.434431       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E getsockname(0x10 socket:[505], 0x7ec75f1d8450, 0x7ec75f1d8420 {length=16})
I0723 22:08:09.434459       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X getsockname(0x10 socket:[505], 0x7ec75f1d8450 {Family: AF_INET, Addr: 127.0.0.1, Port: 60556}, 0x7ec75f1d8420 {length=16}) = 0 (0x0) (4.388µs)
I0723 22:08:09.434663       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E bind(0x11 socket:[506], 0x7ec75f1d8460 {Family: AF_INET, Addr: 127.0.0.1, Port: 0}, 0x10)
I0723 22:08:09.434705       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X bind(0x11 socket:[506], 0x7ec75f1d8460 {Family: AF_INET, Addr: 127.0.0.1, Port: 0}, 0x10) = 0 (0x0) (27.283µs)
I0723 22:08:09.434778       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E getsockname(0x11 socket:[506], 0x7ec75f1d8460, 0x7ec75f1d8420 {length=16})
I0723 22:08:09.434797       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X getsockname(0x11 socket:[506], 0x7ec75f1d8460 {Family: AF_INET, Addr: 127.0.0.1, Port: 40959}, 0x7ec75f1d8420 {length=16}) = 0 (0x0) (1.887µs)
I0723 22:08:09.434873       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E connect(0x10 socket:[505], 0x7ec75f1d8460 {Family: AF_INET, Addr: 127.0.0.1, Port: 40959}, 0x10)
I0723 22:08:09.434903       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X connect(0x10 socket:[505], 0x7ec75f1d8460 {Family: AF_INET, Addr: 127.0.0.1, Port: 40959}, 0x10) = 0 (0x0) (16.223µs)
I0723 22:08:09.435002       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E connect(0x11 socket:[506], 0x7ec75f1d8450 {Family: AF_INET, Addr: 127.0.0.1, Port: 60556}, 0x10)
I0723 22:08:09.435039       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X connect(0x11 socket:[506], 0x7ec75f1d8450 {Family: AF_INET, Addr: 127.0.0.1, Port: 60556}, 0x10) = 0 (0x0) (12.982µs)
I0723 22:08:09.435234       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E ioctl(0x10 socket:[505], 0x5421, 0x7ec75f1d8450)
I0723 22:08:09.435256       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X ioctl(0x10 socket:[505], 0x5421, 0x7ec75f1d8450) = 0 (0x0) (2.309µs)
I0723 22:08:09.435526       1 strace.go:567] [ 3613(   7): 3614(   8)] swiftly E ioctl(0x11 socket:[506], 0x5421, 0x7ec75f1d8450)
I0723 22:08:09.435567       1 strace.go:605] [ 3613(   7): 3614(   8)] swiftly X ioctl(0x11 socket:[506], 0x5421, 0x7ec75f1d8450) = 0 (0x0) (5.009µs)
I0723 22:08:09.439494       1 strace.go:576] [ 3613(   7): 3614(   8)] swiftly E sendto(0x10 socket:[505], 0x7ec75f1d841f, 0x1, 0x0, null, 0x0)
I0723 22:08:09.439842       1 strace.go:614] [ 3613(   7): 3614(   8)] swiftly X sendto(0x10 socket:[505], 0x7ec75f1d841f, 0x1, 0x0, null, 0x0) = 1 (0x1) (297.1µs)
I0723 22:08:09.447267       1 strace.go:561] [ 3619(  13): 3619(  13)] swiftly E close(0x10 socket:[505])
I0723 22:08:09.447279       1 strace.go:599] [ 3619(  13): 3619(  13)] swiftly X close(0x10 socket:[505]) = 0 (0x0) (1.57µs)
I0723 22:08:09.447294       1 strace.go:561] [ 3619(  13): 3619(  13)] swiftly E close(0x11 socket:[506])
I0723 22:08:09.447305       1 strace.go:599] [ 3619(  13): 3619(  13)] swiftly X close(0x11 socket:[506]) = 0 (0x0) (684ns)

[avagin]

@xpbowler As a temporary workaround, you can rebuild the docker image with this patch:

diff --git a/images/basic/docker/start-dockerd.sh b/images/basic/docker/start-dockerd.sh
index d5007d4f7..edc019d00 100755
--- a/images/basic/docker/start-dockerd.sh
+++ b/images/basic/docker/start-dockerd.sh
@@ -16,11 +16,4 @@
 
 set -xe -o pipefail
 
-dev=$(ip route show default | sed 's/.*\sdev\s\(\S*\)\s.*$/\1/')
-addr=$(ip addr show dev "$dev"  | grep -w inet | sed 's/^\s*inet\s\(\S*\)\/.*$/\1/')
-
-echo 1 > /proc/sys/net/ipv4/ip_forward
-iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p tcp
-iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p udp
-
-exec /usr/bin/dockerd --iptables=false --ip6tables=false -D
+exec /usr/bin/dockerd --iptables=false --ip6tables=false -D --bridge=none

[avagin]

@milantracy this issue is triggered by iptable rules. It can be reproduced without running dockerd in a containers:

$ docker run --runtime runsc -it --rm ubuntu
# all other commands should be executed in a docker container:
$ apt update && apt install -y iptables python3 iproute2
$ dev=$(ip route show default | sed 's/.*\sdev\s\(\S*\)\s.*$/\1/')
$ addr=$(ip addr show dev "$dev"  | grep -w inet | sed 's/^\s*inet\s\(\S*\)\/.*$/\1/')
$ iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p tcp
$ iptables-legacy -t nat -A POSTROUTING -o "$dev" -j SNAT --to-source "$addr" -p udp
$ cat > test.py <<EOF
import socket
a = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
b = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
a.bind(("127.0.0.1", 0))
b.bind(("127.0.0.1", 0))
b.connect(a.getsockname())
a.connect(b.getsockname())
a.send(b"test")
print(b.recv(4))
EOF
$ python3 test.py

[xpbowler]

@avagin Thank you for this! I came across another bug however in the same swiftly init line after the networking issue was solved. Do you know why this might happen? Setting --systemd-cgroup didn't seem to work and I don't believe the cgroup is read-only.

ERROR: failed to build: failed to solve: process "/bin/sh -c /tmp/swiftly/swiftly init --quiet-shell-followup -y" 
did not complete successfully: runc did not terminate successfully: exit status 1: unable to destroy container: 
unable to remove container's cgroup: Failed to remove paths:
map[cpu:/sys/fs/cgroup/cpu/docker/buildkit/34a9f4ikszvdo5i1f8ikfo2nf
cpuacct:/sys/fs/cgroup/cpuacct/docker/buildkit/34a9f4ikszvdo5i1f8ikfo2nf
cpuset:/sys/fs/cgroup/cpuset/docker/buildkit/34a9f4ikszvdo5i1f8ikfo2nf
devices:/sys/fs/cgroup/devices/docker/buildkit/34a9f4ikszvdo5i1f8ikfo2nf
memory:/sys/fs/cgroup/memory/docker/buildkit/34a9f4ikszvdo5i1f8ikfo2nf
pids:/sys/fs/cgroup/pids/docker/buildkit/34a9f4ikszvdo5i1f8ikfo2nf]

[EtiennePerot]

You might be hitting #11933. Edit: Disregard.

[avagin]

@EtiennePerot this is different. Here, the error is reported by runc running within sandbox. But #11933 is about how runsc manages host cgroups.

[avagin]

@xpbowler I can't reproduce this issue. In my environment, swiftly init exits successfully. But this is definitely a different issue, so I recommend to file a new bug for it.

[xpbowler]

Ah sorry about that. I got the bug when removing --skip-install from RUN /tmp/swiftly/swiftly init --skip-install --quiet-shell-followup -y --verbose, but will make a new issue.