I unfortunately updated to 27.3.0 on Ubuntu 24.04 tonight and now one grafana / promtail / cadvisor / loki stack is not working any more, on compose up -d I get the following error:
Error response from daemon: invalid mount config: must use either propagation mode “rslave” or “rshared” when mount source is within the daemon root, daemon root: “/var/lib/docker”, bind mount source: “/var/lib/docker”, propagation: “rprivate”
I suppose it has something to do with the volumes mount for cadvisor and promtail:
Just wanted to mention that - /var/run/docker.sock:/var/run/docker.sock:ro is not setting the socket to read-only, so the line implies a false sense of security. I personally think it should throw at least a warning.
The socket is like a TCP connection, it needs two-way communitcaition to work, like http. To secure the Docker socket, you would need to use a Docker socket proxy that restricts GET and potentially disallows all POST.
It seems to me that the error message tells you the solution. It tells you that the daemon root is /var/lib/docker and that when you mount something from that folder, you need to set either rslave or rshared. It also says it is set to rprivate.
I had the same issue with one of the service in my setup. Seems this issue crept in Compose CLI update (2.29.6) yesterday and fixed swiftly today ([2.29.7] (Release v2.29.7 · docker/compose · GitHub)). After update, same compose file now working and no error.