nerdctl run - failed to add the address (failed to add the address 10.4.0.17/32 to trusted zone: Not Authorized(uid): org.fedoraproject.FirewallD1.config)

[nealef]

When running nerdctl run in rootless mode I fail with:

FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 1, stdout: , stderr: time="2023-03-09T21:29:12-05:00" level=fatal msg="failed to call cni.Setup: plugin type=\"firewall\" failed (add): failed to add the address 10.4.0.17/32 to trusted zone: Not Authorized(uid): org.fedoraproject.FirewallD1.config"

Have I missed a configuration step?

[AkihiroSuda]

What's your host OS, nerdctl version, and CNI plugin version?

[nealef]

Linux (Alma Linux 9)

[qintang]

➜ ~ nerdctl run --debug --name nginx nginx:alpine
DEBU[0000] stateDir: /run/user/1000/containerd-rootless
DEBU[0000] rootless parent main: executing "/usr/bin/nsenter" with [-r/ -w/home/xxx --preserve-credentials -m -n -U -t 2808 -F nerdctl run --debug --name nginx nginx:alpine]
DEBU[0000] verifying process skipped
DEBU[0000] generated log driver: binary:///usr/local/bin/nerdctl?_NERDCTL_INTERNAL_LOGGING=%2Fhome%2Fxxx%2F.local%2Fshare%2Fnerdctl%2F1935db59
DEBU[0000] remote introspection plugin filters filters="[type==io.containerd.snapshotter.v1, id==overlayfs]"
FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 1, stdout: , stderr: time="2023-04-16T13:40:32+08:00" level=fatal msg="failed to call cni.Setup: plugin type="firewall" failed (add): failed to add the address 10.4.0.25/32 to trusted zone: "
Failed to write to log, write /home/xxx/.local/share/nerdctl/1935db59/containers/default/29934486761ebf4b13a1e57b238b8ba83eb1b8f1e2cd8a14cd624585c3a8c244/oci-hook.createRuntime.log: file already closed: unknown

---

host version info

➜ ~ nerdctl -v
nerdctl version 1.3.0
➜ ~
➜ ~ uname -a
Linux localhost.localdomain 4.18.0-425.13.1.el8_7.x86_64 #1 SMP Tue Feb 21 04:20:52 EST 2023 x86_64 x86_64 x86_64 GNU/Linux
➜ ~
➜ ~ cat /etc/redhat-release
AlmaLinux release 8.7 (Stone Smilodon)
➜ ~
➜ ~
➜ ~ nerdctl network ls
NETWORK ID NAME FILE
17f29b073143 bridge /home/xxx/.config/cni/net.d/nerdctl-bridge.conflist
service_compose_host_default /home/xxx/.config/cni/net.d/service_compose_host_default.conflist
service_docker_compose_default /home/xxx/.config/cni/net.d/service_docker_compose_default.conflist
test_default /home/xxx/.config/cni/net.d/test_default.conflist
host
none

➜ ~ nerdctl network inspect bridge
[
{
"Name": "bridge",
"Id": "17f29b073143d8cd97b5bbe492bdeffec1c5fee55cc1fe2112c8b9335f8b6121",
"IPAM": {
"Config": [
{
"Subnet": "10.4.0.0/24",
"Gateway": "10.4.0.1"
}
]
},
"Labels": {
"nerdctl/default-network": "true"
}
}
]

[tuananh]

When running nerdctl run in rootless mode I fail with:

FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error running hook #0: error running hook: exit status 1, stdout: , stderr: time="2023-03-09T21:29:12-05:00" level=fatal msg="failed to call cni.Setup: plugin type=\"firewall\" failed (add): failed to add the address 10.4.0.17/32 to trusted zone: Not Authorized(uid): org.fedoraproject.FirewallD1.config"

Have I missed a configuration step?

did you manage to solve it?

[AkihiroSuda]

This seems to fix the issue

--- /home/suda.linux/.config/cni/net.d/nerdctl-bridge.conflist.bak	2024-02-14 17:27:37.281279702 +0900
+++ /home/suda.linux/.config/cni/net.d/nerdctl-bridge.conflist	2024-02-14 17:30:16.410469639 +0900
@@ -37,7 +37,8 @@
     },
     {
       "type": "firewall",
-      "ingressPolicy": "same-bridge"
+      "ingressPolicy": "same-bridge",
+      "backend": "iptables"
     },
     {
       "type": "tuning"

Originally posted by @AkihiroSuda in #2818 (comment)

Proper fix:

• [cherry-picked to v1.7.4] rootless: fix Not Authorized(uid): org.fedoraproject.FirewallD1.config #2819