docker change data-root as loop device,fail to run container

General Discussions
1

Here is my case.

[root@dc-rclone-55 ~]# grep data /etc/docker/daemon.json 
    "data-root": "/data1/docker"
[root@dc-rclone-55 ~]# lsblk 
NAME            MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
fd0               2:0    1    4K  0 disk 
sda               8:0    0   50G  0 disk 
├─sda1            8:1    0  500M  0 part /boot
└─sda2            8:2    0 49.5G  0 part 
  ├─centos-root 253:0    0 45.6G  0 lvm  /
  └─centos-swap 253:1    0  3.9G  0 lvm  [SWAP]
sr0              11:0    1 1024M  0 rom  
loop0             7:0    0    5G  0 loop /data1
[root@dc-rclone-55 ~]# ll /data/disk.raw 
-rw-r--r-- 1 root root 5368709120 Sep 13 09:42 /data/disk.raw
[root@dc-rclone-55 ~]# docker images
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
ubuntu       22.04     53a843653cbc   4 weeks ago   77.9MB
[root@dc-rclone-55 ~]# docker run -it  --rm ubuntu:22.04 bash
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/data1/docker/containers/accd8f9eb3e6f4ca3f5070c554fdd29e102ab8925f669a896542d998889bfbe7/resolv.conf" to rootfs at "/etc/resolv.conf": possibly malicious path detected -- refusing to operate on /etc/resolv.conf: unknown.

It’s good to change the docker’s root data as mount point loop device.
The loop device create from

1. fallocate -l 1G disk.raw​
2. mkfs.ext4 disk.raw​
3. losetup -f --show disk.raw
4. mkdir /data1 
5. mount /dev/loop0 /data1/
2

Please share the output of docker info. I am curious which Storage Driver was used.

3

Of course, here is the command output.

[root@dc-rclone-55 ~]# docker info
Client: Docker Engine - Community
 Version:    26.1.4
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.14.1
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.27.1
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 1
  Running: 0
  Paused: 0
  Stopped: 1
 Images: 1
 Server Version: 26.1.4
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: false
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: d2d58213f83a351ca8f528a95fbd145f5654e957
 runc version: v1.1.12-0-g51d5e94
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
 Kernel Version: 3.10.0-327.el7.x86_64
 Operating System: CentOS Linux 7 (Core)
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 3.703GiB
 Name: dc-rclone-55
 ID: 808a6888-a8e4-4003-aff3-82667ab31c43
 Docker Root Dir: /data1/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  10.110.3.78:7860
  115.236.100.11:27860
  121.199.53.95:30002
  192.168.182.10:7000
  mirrorhub.swdcmg.com
  127.0.0.0/8
 Registry Mirrors:
  https://hub.rat.dev/
 Live Restore Enabled: true

WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
4

I was wondering if the engine actually detects that the backing filesystem of the data-root is ext4. It does and it even uses the overlay2 storage driver.

It looks like it refuses to mount the container filesystem (or at least a single file from it).
Though, I have no idea what causes this behavior. You could try if it makes a difference if selinux is disabled for testing.

Just to be sure: you are not running your docker engine in an lxc container, right?