From b760951aa7eab2e413edc9309d401cd3bde52600 Mon Sep 17 00:00:00 2001 From: Vitaliy Filippov Date: Tue, 11 Mar 2025 00:41:59 +0300 Subject: [PATCH] Add seccomp=unconfined for vitastor docker OSDs to not break io_uring --- docker/etc/systemd/system/vitastor-host.service | 2 +- docker/etc/systemd/system/vitastor-osd@.service | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/docker/etc/systemd/system/vitastor-host.service b/docker/etc/systemd/system/vitastor-host.service index 56f4cf8f..5ee4c049 100644 --- a/docker/etc/systemd/system/vitastor-host.service +++ b/docker/etc/systemd/system/vitastor-host.service @@ -8,7 +8,7 @@ PartOf=vitastor.target Restart=always EnvironmentFile=/etc/vitastor/docker.conf ExecStart=bash -c 'docker run --rm -i -v /etc/vitastor:/etc/vitastor -v /dev:/dev -v /run:/run \ - --privileged --log-driver none --network host --name vitastor vitastor:$VITASTOR_VERSION \ + --security-opt seccomp=unconfined --privileged --log-driver none --network host --name vitastor vitastor:$VITASTOR_VERSION \ sleep.sh' ExecStartPost=udevadm trigger ExecStop=docker stop vitastor diff --git a/docker/etc/systemd/system/vitastor-osd@.service b/docker/etc/systemd/system/vitastor-osd@.service index c9fcfdf9..e02bd552 100644 --- a/docker/etc/systemd/system/vitastor-osd@.service +++ b/docker/etc/systemd/system/vitastor-osd@.service @@ -12,7 +12,8 @@ EnvironmentFile=/etc/vitastor/docker.conf SyslogIdentifier=vitastor-osd%i ExecStart=bash -c 'docker run --rm -i -v /etc/vitastor:/etc/vitastor -v /dev:/dev \ $(for i in $(ls /dev/vitastor/osd%i-*); do echo --device $i:$i; done) \ - --log-driver none --network host --ulimit nofile=1048576 --ulimit memlock=-1 $CONTAINER_OPTIONS --name vitastor-osd%i \ + --log-driver none --network host --ulimit nofile=1048576 --ulimit memlock=-1 \ + --security-opt seccomp=unconfined $CONTAINER_OPTIONS --name vitastor-osd%i \ vitastor:$VITASTOR_VERSION vitastor-disk exec-osd /dev/vitastor/osd%i-data' ExecStartPre=+docker exec vitastor vitastor-disk pre-exec /dev/vitastor/osd%i-data ExecStop=docker stop vitastor-etcd%i