{"action":"created","issue":{"url":"https://api.github.com/repos/girder/girder_worker/issues/116","repository_url":"https://api.github.com/repos/girder/girder_worker","labels_url":"https://api.github.com/repos/girder/girder_worker/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/girder/girder_worker/issues/116/comments","events_url":"https://api.github.com/repos/girder/girder_worker/issues/116/events","html_url":"https://github.com/girder/girder_worker/issues/116","id":224222352,"number":116,"title":"girder_worker errors when dockerd is run with --selinux-enabled","user":{"login":"neal-siekierski","id":26284234,"avatar_url":"https://avatars3.githubusercontent.com/u/26284234?v=3","gravatar_id":"","url":"https://api.github.com/users/neal-siekierski","html_url":"https://github.com/neal-siekierski","followers_url":"https://api.github.com/users/neal-siekierski/followers","following_url":"https://api.github.com/users/neal-siekierski/following{/other_user}","gists_url":"https://api.github.com/users/neal-siekierski/gists{/gist_id}","starred_url":"https://api.github.com/users/neal-siekierski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neal-siekierski/subscriptions","organizations_url":"https://api.github.com/users/neal-siekierski/orgs","repos_url":"https://api.github.com/users/neal-siekierski/repos","events_url":"https://api.github.com/users/neal-siekierski/events{/privacy}","received_events_url":"https://api.github.com/users/neal-siekierski/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-04-25T17:58:50Z","updated_at":"2017-04-25T19:36:31Z","closed_at":null,"body":"Running `girder_worker` with the `docker` plugin enabled when `dockerd` was started with the flag `--selinux-enabled` results in errors relating to file access and chmod when attempting to run a container. Cf. the output below. Starting `dockerd` without this flag results in a clean run.\r\n\r\n```\r\nINFO:root:Created LRU Cache for 'tilesource' with 1934 maximum size\r\nWARNING:ctk_cli.module:'reference' attribute of 'file' is not part of the spec yet (CTK issue #623)\r\n\r\n>> CLI Parameters ...\r\n\r\nNamespace(analysis_mag=20.0, analysis_roi=[14504.0, 17107.0, 767.0, 811.0], analysis_tile_size=4096.0, foreground_threshold=60.0, inputImageFile='/mnt/girder_worker/data/TCGA-02-0010-01Z-00-DX4.07de2e55-a8fe-40ee-9e98-bcb78050b9f7.svs/TCGA-02-0010-01Z-00-DX4.07de2e55-a8fe-40ee-9e98-bcb78050b9f7.svs', local_max_search_radius=10.0, max_radius=30.0, min_fgnd_frac=0.5, min_nucleus_area=80.0, min_radius=20.0, outputNucleiAnnotationFile='/mnt/girder_worker/data/output.anot', reference_mu_lab=[8.63234435, -0.11501964, 0.03868433], reference_std_lab=[0.57506023, 0.10403329, 0.01364062], scheduler_address='', stain_1='hematoxylin', stain_2='eosin', stain_3='null')\r\nTraceback (most recent call last):\r\n  File \"NucleiDetection/NucleiDetection.py\", line 368, in <module>\r\n    main(CLIArgumentParser().parse_args())\r\n  File \"NucleiDetection/NucleiDetection.py\", line 182, in main\r\n    raise IOError('Input image file does not exist.')\r\nIOError: Input image file does not exist.\r\n[2017-04-25 10:44:36,516] ERROR: Error setting perms on docker tempdir /home/neal/work/DSA-dev/tmp/tmpYxc3a3.\r\nSTDOUT: \r\nSTDERR:chmod: /mnt/girder_worker/data: Permission denied\r\nchmod: /mnt/girder_worker/data: Permission denied\r\n\r\nException: Docker tempdir chmod returned code 1.\r\n  File \"/home/neal/work/DSA-dev/virtualenv/lib/python2.7/site-packages/celery/app/trace.py\", line 367, in trace_task\r\n    R = retval = fun(*args, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/virtualenv/lib/python2.7/site-packages/celery/app/trace.py\", line 622, in __protected_call__\r\n    return self.run(*args, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/tasks.py\", line 17, in run\r\n    return core.run(*pargs, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/core/utils.py\", line 122, in wrapped\r\n    return fn(*args, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/core/__init__.py\", line 366, in run\r\n    events.trigger('run.finally', info)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/core/events.py\", line 73, in trigger\r\n    handler['handler'](e)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/plugins/docker/__init__.py\", line 99, in task_cleanup\r\n    raise Exception('Docker tempdir chmod returned code %d.' % p.returncode)"},"comment":{"url":"https://api.github.com/repos/girder/girder_worker/issues/comments/297141207","html_url":"https://github.com/girder/girder_worker/issues/116#issuecomment-297141207","issue_url":"https://api.github.com/repos/girder/girder_worker/issues/116","id":297141207,"user":{"login":"neal-siekierski","id":26284234,"avatar_url":"https://avatars3.githubusercontent.com/u/26284234?v=3","gravatar_id":"","url":"https://api.github.com/users/neal-siekierski","html_url":"https://github.com/neal-siekierski","followers_url":"https://api.github.com/users/neal-siekierski/followers","following_url":"https://api.github.com/users/neal-siekierski/following{/other_user}","gists_url":"https://api.github.com/users/neal-siekierski/gists{/gist_id}","starred_url":"https://api.github.com/users/neal-siekierski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/neal-siekierski/subscriptions","organizations_url":"https://api.github.com/users/neal-siekierski/orgs","repos_url":"https://api.github.com/users/neal-siekierski/repos","events_url":"https://api.github.com/users/neal-siekierski/events{/privacy}","received_events_url":"https://api.github.com/users/neal-siekierski/received_events","type":"User","site_admin":false},"created_at":"2017-04-25T19:36:31Z","updated_at":"2017-04-25T19:36:31Z","body":"If I change the relevant part of `plugins/docker/__init__.py` to add the `:Z` option, the `chmod` error disappears, but the input file still doesn't exist and now the output file cannot be found (perhaps in relation to the script not finishing because the input isn't found). It still runs clean when leaving out the `--selinux-enabled` flag with `:Z` option added.\r\n\r\n```diff\r\n@@ -87,7 +87,7 @@ def task_cleanup(e):\r\n     if e.info['task']['mode'] == 'docker' and '_tempdir' in e.info['kwargs']:\r\n         tmpdir = e.info['kwargs']['_tempdir']\r\n         cmd = [\r\n-            'docker', 'run', '--rm', '-v', '%s:%s' % (tmpdir, DATA_VOLUME),\r\n+            'docker', 'run', '--rm', '-v', '%s:%s:Z' % (tmpdir, DATA_VOLUME),\r\n             'busybox', 'chmod', '-R', 'a+rw', DATA_VOLUME\r\n         ]\r\n         p = subprocess.Popen(args=cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)\r\n```\r\n\r\n```\r\nINFO:root:Created LRU Cache for 'tilesource' with 1934 maximum size\r\nWARNING:ctk_cli.module:'reference' attribute of 'file' is not part of the spec yet (CTK issue #623)\r\n\r\n>> CLI Parameters ...\r\n\r\nNamespace(analysis_mag=20.0, analysis_roi=[14175.0, 16923.0, 762.0, 771.0], analysis_tile_size=4096.0, foreground_threshold=60.0, inputImageFile='/mnt/girder_worker/data/TCGA-02-0010-01Z-00-DX4.07de2e55-a8fe-40ee-9e98-bcb78050b9f7.svs/TCGA-02-0010-01Z-00-DX4.07de2e55-a8fe-40ee-9e98-bcb78050b9f7.svs', local_max_search_radius=10.0, max_radius=30.0, min_fgnd_frac=0.5, min_nucleus_area=80.0, min_radius=20.0, outputNucleiAnnotationFile='/mnt/girder_worker/data/output2.anot', reference_mu_lab=[8.63234435, -0.11501964, 0.03868433], reference_std_lab=[0.57506023, 0.10403329, 0.01364062], scheduler_address='', stain_1='hematoxylin', stain_2='eosin', stain_3='null')\r\nTraceback (most recent call last):\r\n  File \"NucleiDetection/NucleiDetection.py\", line 368, in <module>\r\n    main(CLIArgumentParser().parse_args())\r\n  File \"NucleiDetection/NucleiDetection.py\", line 182, in main\r\n    raise IOError('Input image file does not exist.')\r\nIOError: Input image file does not exist.\r\nException: Output filepath /home/neal/work/DSA-dev/tmp/tmpRJtayd/output2.anot does not exist.\r\n  File \"/home/neal/work/DSA-dev/virtualenv/lib/python2.7/site-packages/celery/app/trace.py\", line 367, in trace_task\r\n    R = retval = fun(*args, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/virtualenv/lib/python2.7/site-packages/celery/app/trace.py\", line 622, in __protected_call__\r\n    return self.run(*args, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/tasks.py\", line 17, in run\r\n    return core.run(*pargs, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/core/utils.py\", line 122, in wrapped\r\n    return fn(*args, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/core/__init__.py\", line 319, in run\r\n    auto_convert=auto_convert, validate=validate, **kwargs)\r\n  File \"/home/neal/work/DSA-dev/girder_worker/girder_worker/plugins/docker/executor.py\", line 207, in run\r\n    raise Exception('Output filepath %s does not exist.' % path)\r\n```"}}
{"actor":{"display_login":"neal-siekierski"}}