docs: document the issue with seccomp and claiming (#12192)
Ilya Mashchenko committed
Feb 21, 2022 at 21:28 UTC
4b03a0d0e05e54ebb353a4458c3b88072785b12c
1 file changed
+61
claim/README.md
+61
@@ -116,6 +116,67 @@ For the connection process to work, the contents of `/var/lib/netdata` _must_ be
116
restarts using a persistent volume. See our [recommended `docker run` and Docker Compose
117
examples](/packaging/docker/README.md#create-a-new-netdata-agent-container) for details.
118
119
+#### Known issues on older hosts with seccomp enabled
120
+
121
+The nodes running on the following hosts **cannot be claimed**:
122
+
123
+- `libseccomp` version less than v2.3.3.
124
+- Docker version less than v18.04.0-ce.
125
+- The kernel is configured with CONFIG_SECCOMP enabled.
126
+
127
+To check if your kernel supports `seccomp`:
128
+
129
+```cmd
130
+# grep CONFIG_SECCOMP= /boot/config-$(uname -r) 2>/dev/null || zgrep CONFIG_SECCOMP /proc/config.gz 2>/dev/null
131
+CONFIG_SECCOMP=y
132
+```
133
+
134
+To resolve the issue, do one of the following actions:
135
+
136
+- Update to a newer version of Docker and `libseccomp` (recommended).
137
+- Create a custom profile and pass it for the container.
138
+- Run [without the default seccomp profile](https://docs.docker.com/engine/security/seccomp/#run-without-the-default-seccomp-profile) (unsafe, not recommended).
139
+
140
+<details>
141
+<summary>See how to create a custom profile</summary>
142
+
143
+1. Download the moby default seccomp profile and change `defaultAction` to `SCMP_ACT_TRACE` on line 2.
144
+
145
+ ```cmd
146
+ sudo wget https://raw.githubusercontent.com/moby/moby/master/profiles/seccomp/default.json -O /etc/docker/seccomp.json
147
+ sudo sed -i '2s/SCMP_ACT_ERRNO/SCMP_ACT_TRACE/' /etc/docker/seccomp.json
148
+ ```
149
+
150
+2. Specify the new policy for the container explicitly.
151
+
152
+ - When using `docker run`:
153
+
154
+ ```cmd
155
+ docker run -d --name=netdata \
156
+ --security-opt=seccomp=/etc/docker/seccomp.json \
157
+ ...
158
+ ```
159
+
160
+ - When using `docker-compose`:
161
+
162
+ > :warning: The security_opt option is ignored when deploying a stack in swarm mode.
163
+
164
+ ```yaml
165
+ version: '3'
166
+ services:
167
+ netdata:
168
+ security_opt:
169
+ - seccomp:/etc/docker/seccomp.json
170
+ ...
171
+ ```
172
+
173
+ - When using `docker stack deploy`:
174
+
175
+ Change the default profile globally by adding `--seccomp-profile=/etc/docker/seccomp.json` to the options passed to
176
+ dockerd on startup.
177
+
178
+</details>
179
+
180
#### Using environment variables
181
182
The Netdata Docker container looks for the following environment variables on startup: