Unable to use clone3 in gitpod environment

[fyuan1316]

cat /etc/issue
Ubuntu 20.04.5 LTS \n \l

cat /proc/version
Linux version 5.15.0-47-generic (buildd@lcy02-amd64-060) (gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #51-Ubuntu SMP Thu Aug 11 07:51:15 UTC 2022

env : gitpod.io

sudo ./youki create -b tutorial tutorial_container
[ERROR crates/youki/src/main.rs:145] 2023-04-29T06:50:57.458340977+00:00 error in executing command: failed to create container

Caused by:
0: failed to fork process
1: failed to run clone3
2: 38
Error: failed to create container

Caused by:
0: failed to fork process
1: failed to run clone3
2: 38

same error messge #1826

[utam0k]

@fyuan1316 Thanks for your report. I invested in this error and can reproduce it. Since this is caused by gitpod env, we can't do anything 😭

[utam0k]

👋 Hi, @Furisto, Do you know gitpod has a plan to support clone3(2)?

05:08:35.595773 clone3({flags=0, exit_signal=SIGCHLD, stack=NULL, stack_size=0}, 88) = -1 ENOSYS (Function not implemented) <0.000020>

[yihuaf]

@fyuan1316 Thanks for your report. I invested in this error and can reproduce it. Since this is caused by gitpod env, we can't do anything 😭

Is this because gitpod is running inside a container that blocks the clone3 call? Does gitpod has an environment that is more privileged?

[utam0k]

@yihuaf The workspace from gitpod runs on the original rootless container on the pod. It is special 😄 As far as I know, it allows clone3(2)

[utam0k]

@fyuan1316 Sorry, but this is an issue for gitpod. May I ask you to create the issue on gitpod?

[utam0k]

We might consider supporting codespace.

[yihuaf]

I just realized that for this issue, clone3 is returning ENOSYS. It is possible that the underlying kernel supports clone3 since it is showing as 5.15, but something on the gitpod system, such as seccomp actually blocks it with ENOSYS. Normally, clone3 returning ENOSYS is not a big deal because caller would just fallback. However, we decided to not implement a fallback, which is an issue here.

Actually I will open a new issue to discuss this.