docker on ubuntu 16.04 error when killing container

Question

I can't kill or stop any docker container. I've allowed non-privileged users to run Docker commands. And docker run hello-world works fine. But I can't stop any other container.

I got following:

$ docker stop 59e3b815d1dc
Error response from daemon: cannot stop container: 59e3b815d1dc: 
Cannot kill container 59e3b815d1dcf2d8c8bcd3dd641c3c033b83ac68ea2f0257a32a76468af7374c: 
unknown error after kill: docker-runc did not terminate sucessfully: 
container_linux.go:393: signaling init process caused "permission denied"
: unknown

The same error with sudo. Meanwhile, all containers run successfully, but to stop them is possible only a full reboot of the system.

Docker compose example: # Use postgres/example user/password credentials version: '3.1'

services:

  db:
    image: postgres
    restart: always
    environment:
      POSTGRES_PASSWORD: example

  adminer:
    image: adminer
    restart: always
    ports:
      - 8080:8080

Docker info:

$ docker info
Containers: 7
 Running: 2
 Paused: 0
 Stopped: 5
Images: 10
Server Version: 17.12.1-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 9b55aab90508bd389d7654c4baf173a981477d55
runc version: 9f9c96235cc97674e935002fc3d78361b696a69e
init version: 949e6fa
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.4.0-116-generic
Operating System: Ubuntu 16.04.4 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 11.61GiB
Name: peter-pen
ID: P6FS:C76H:WIAO:LCWC:TCHT:JEYB:6W3M:HXYD:S4E2:KTUZ:2T3Q:3GPI
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support

It's probably AppArmor. Maybe you installed the Ubuntu Docker packages then the Docker one and the profiles got mixed up? — Matt, Mar 05 '18 at 08:02
There were docker and docker-engine but I've purged they. The "permission denied" error was with that packages too and I decided to install docker considered with official manual. — Peter, Mar 05 '18 at 08:09
@MichalCiechan It's not the better way, but I disabled AppArmor for Docker — Peter, Oct 12 '18 at 06:43

score 118 · Answer 1 · edited Jan 28 '19 at 12:48

118

For me removing the unknown from AppArmor works:

sudo aa-remove-unknown

edited Jan 28 '19 at 12:48

Carlos Mermingas

3,402
2
17
38

answered Jan 28 '19 at 10:32

5

It works! but I'm wondering where is the magic behind this command ? – Haroun Mohammedi Mar 20 '19 at 14:50
I mount a docker service on Windows NTFS and it failed to stop, using this command works, but I still need to know the reason behind. – Brian Ng Apr 05 '19 at 14:49
This link had some discussion about what this is: https://docs.docker.com/engine/security/apparmor/ – jersey bean May 30 '19 at 17:26
2

I want to know behind the scenes work of "sudo aa-remove-unknown". Yes it solved my issue but how? – Ajay Apr 20 '20 at 06:23
This seems to have messed up my install of multiple things. Beware. `snap-confine has elevated permissions and is not confined but should be. Refusing to continue to avoid permission escalation attacks` – Fishrock123 Jan 22 '21 at 00:20
1

Rebooting seems to have fixed my issues. – Fishrock123 Jan 22 '21 at 00:30

score 19 · Accepted Answer · answered Mar 30 '18 at 11:31

AppArmor (Application Armor) is a Linux security module that protects an operating system and its applications from security threats. To use it, a system administrator associates an AppArmor security profile with each program. Docker expects to find an AppArmor policy loaded and enforced. Check default profiles with:

# sudo apparmor_status

To use docker default profile on a container, run:

$ docker run --rm -it --name test-container --security-opt apparmor=docker-default image-name

You disable it using the commands:

--security-opt apparmor=unconfined

With the docker run commands.

To disable apparmor service, use:

# systemctl stop apparmor && systemctl disable apparmor

For Ubuntu 14. Use:

# service apparmor stop
# update-rc.d -f apparmor remove

It’s recommended to set working profiles for Docker apparmor than disabling it, especially for production setups.

Check this awesome google document on Securing Containers with AppArmor.

https://cloud.google.com/container-optimized-os/docs/how-to/secure-apparmor

Sidharth Srivastava · Answer 3 · 2018-12-10T16:00:50.973

11

This command will stop all docker containers.

sudo killall docker-containerd-shim

This command will remove all docker containers.

sudo docker-compose down

edited Dec 10 '18 at 16:00

answered Dec 10 '18 at 09:32

Sidharth Srivastava

509
7
10

3

Why would the OP do that? Explain what these commands do and why it might help – laruiss Dec 10 '18 at 12:15
1

My mind blown, Thank you so much, it worked awesome :) – deeptimancode May 02 '19 at 10:05

score 6 · Answer 4 · answered Jan 27 '20 at 07:20

6

Just run this command in the terminal, all docker running container will stoped

sudo systemctl restart docker.service

answered Jan 27 '20 at 07:20

Shajed

497
7
13

score 3 · Answer 5 · edited Apr 10 '20 at 18:46

3

After using the below commands I was able to use docker-compose stop again:

sudo apt-get purge --auto-remove apparmor
sudo service docker restart
docker system prune --all --volumes

edited Apr 10 '20 at 18:46

Paul Roub

35,100
27
72
83

answered Apr 10 '20 at 18:44

abdul azeem

47
1

1

it removes all the snap installation – Fateh Feb 01 '21 at 22:19

score 1 · Answer 6 · answered Nov 11 '19 at 08:12

Follow these steps to be able to stop the container:

Disable the apparmor service:

sudo systemctl disable apparmor.service --now

Unload AppArmor profiles:

sudo service apparmor teardown

Check AppArmor status:

sudo aa-status

You should be able to stop and kill your container now.

Credits

docker on ubuntu 16.04 error when killing container

6 Answers6

Linked