【containerd错误解决系列】failed to create shim task, OCI runtime create failed, unable to retrieve OCI...

环境

# cat /etc/redhat-release
CentOS Linux release 8.0.1905 (Core) 

# uname -r
4.18.0-348.rt7.130.el8.x86_64

问题及现象

1. pod的状态全部都是ContainerCreating的状态

2. containerd进程有大量报错，主要有：

failed to create containerd task: failed to create shim task: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/containerd/io.containerd.runtime.v2.task/k8s.io/c4847070fad34a8da9b16b5c20cdc38e28a15cfcf9913d712e4fe60d8c9029f7/log.json: no such file or directory): runc did not terminate successfully: exit status 127: unknown

解决方案

查看现有libseccomp版本

# sudo rpm -qa | grep libseccomp
libseccomp-2.3.3-3.el8.x86_64

卸载低版本libseccomp

# sudo rpm -e libseccomp-2.3.3-3.el8.x86_64 --nodeps

# sudo rpm -qa | grep libseccomp
#

安装高版本libseccomp

# yum provides libseccomp
Last metadata expiration check: 0:48:39 ago on Tue 28 Mar 2023 01:49:06 PM CST.
libseccomp-2.5.2-1.el8.i686 : Enhanced seccomp library
Repo        : Base
Matched from:
Provide    : libseccomp = 2.5.2-1.el8

libseccomp-2.5.2-1.el8.x86_64 : Enhanced seccomp library
Repo        : Base
Matched from:
Provide    : libseccomp = 2.5.2-1.el8


# yum install libseccomp-2.5.2-1.el8.x86_64
Last metadata expiration check: 0:49:46 ago on Tue 28 Mar 2023 01:49:06 PM CST.
Dependencies resolved.
======================================================================================================================================================================
 Package                                   Arch                                  Version                                    Repository                           Size
======================================================================================================================================================================
Installing:
 libseccomp                                x86_64                                2.5.2-1.el8                                Base                                 71 k

Transaction Summary
======================================================================================================================================================================
Install  1 Package

Total download size: 71 k
Installed size: 166 k
Is this ok [y/N]: y
Downloading Packages:
libseccomp-2.5.2-1.el8.x86_64.rpm                                                                                                      38 MB/s |  71 kB     00:00    
----------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                 7.0 MB/s |  71 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                              1/1 
  Installing       : libseccomp-2.5.2-1.el8.x86_64                                                                                                                1/1 
  Running scriptlet: libseccomp-2.5.2-1.el8.x86_64                                                                                                                1/1 
  Verifying        : libseccomp-2.5.2-1.el8.x86_64                                                                                                                1/1 

Installed:
  libseccomp-2.5.2-1.el8.x86_64                                                                                                                                       

Complete!


# sudo rpm -qa | grep libseccomp
libseccomp-2.5.2-1.el8.x86_64

解决后现象

1. pod状态

安装之后，不用重启containerd进程，就看到了目前pod的状态都正常了

2. runc中依赖的libseccomp
   libseccomp已经是高版本的了

# runc --version
runc version 1.1.4
commit: v1.1.4-0-g5fd4c4d1
spec: 1.0.2-dev
go: go1.18.10
libseccomp: 2.5.2

原理

libseccomp需要高于2.4版本

containerd.io 要求安装版本为 2.4.0 的 libseccomp

具体官方依据还未找到，后续找到补充

参考

k8s系列-06-containerd的基本操作 卸载安装libeseccomp
containerd.io depends libseccomp2 ( = 2.4.0) but 2.3.1-2.1ubuntu4 is to be installed