Docker Issue - exit status 34

Question

I am facing "exit status 34" while creating docker service. please suggest what is the issue.

Docker version : Docker version 17.09.1-ce, build 19e2cf6 Error Log :nsenter: failed to unshare namespaces: Cannot allocate memory container_linux.go:265: starting container process caused "process_linux.go:270: running exec setns process for init caused \"exit status 34\"" ERROR: Service 'web' failed to build: oci runtime error: container_linux.go:265: starting container process caused "process_linux.go:270: running exec setns process for init caused \"exit status 34\""

Answer 1

We have seen a similar error. "nsenter: failed to unshare namespaces: cannot allocate memory".

In my experience it was directly related to memory, and in our case swap. We have our swap space set fairly low but our Red Hat OS was still using it. We have found two actions that seem to help.

1. Increasing the RAM on our host to have enough overhead where it discourages RHEL from using swap. This is not a bad option if you have the ability to add RAM.

2. We followed this document and that helped. However you will need to do some analysis on whether this is right for you. Once you make this change, you will use more active ram. For example, we have an angular build that was using 4GB of RAM and 2GB of swap. After this change, all 6GB was in RAM. So if you choose this method you will need to be careful that you don't end up using up all of your ram and forcing the OS to use swap for critical work.

https://success.docker.com/article/node-using-swap-memory-instead-of-host-memory

Answer 2

I'm facing this issue too.

Here what I did find:

• Can be a out of memory in host (not my case)
• Can happen if you open more than 1023 containers in same host

• Can be a kernel bug (v < 3.10.x) fixed in a patch, so upgrade the kernel should fix it:

  https://github.com/opencontainers/runc/issues/1513

  https://bugzilla.redhat.com/show_bug.cgi?id=1499046

  RHEL Patch: https://bugzilla.redhat.com/show_bug.cgi?id=1499046

• Can be a config issue on RHEL: https://success.docker.com/article/user-namespace-runtime-error

  $ grubby --args="namespace.unpriv_enable=1 user_namespace.enable=1" --update-kernel="$(grubby --default-kernel)" $ echo "user.max_user_namespaces=15000" >> /etc/sysctl.conf $ reboot

• May be the user namespace is not enabled: https://github.com/moby/moby/issues/34011

  grubby --args="user_namespace.enable=1" --update-kernel="$(grubby --default-kernel)"

• This script can help to identify config gaps on host: https://raw.githubusercontent.com/moby/moby/master/contrib/check-config.sh

• To understand more about docker using user namespaces: https://docs.docker.com/engine/security/userns-remap/

I have a situation where the client reports that the hosts was running and after some unknown update it stop working. I'm still looking for a coherent explanation. I'll update when fix it.