Open /proc/sys/vm/overcommit_memory: permission denied

Environments Multi CPU Architecture
1

Hi,

Based on the blog here (https://docs.travis-ci.com/user/multi-cpu-architectures/), it seems like travis is ready for ARM, I am recently trying to enable CI on ARM and got some permission issue (https://travis-ci.com/chendave/kubeedge/jobs/247718001).

I guess this is related with apparmor, the issue might be addressed by setting the arpparmor’s profile to “unconfined”, is there any chance for us to configure the apparmor in lXD by ourselves and how?

BR,
Dave

2

Hi @chendave

Happy to see you testing the ARM builds!

Short answer: no, custom apparmor LXD host config won’t be available to the users as it impacts whole LXD host (where not only your builds can be run).

Having said that, couple of questions gave us information, that LXD-based build jobs are not sufficient for all scenarios out there. This could be handled (w/o diving into details) with ‘full VM’ approach. Is this something that would fit your scenario or would you rather adapt ARM build scenario for your code to work within LXD security rules?

Please check one of the topics where it’s been explained already and our updated Multi CPU Architecture documentation.

Hope it helps
Michał

3

Thank you @Michal for your quick response, the code there is not for ARM only, and change the code to fit with the case with LXD for ARM seems not a good approach, it makes the code not generic and I believe other maintainers will not happy with the change.

I’d love to see travis also provide us an option to run those CI with “full VM” approach for ARM platform as well, this will make thing easier.

4

Hi @chendave

I wouldn’t suggest changing the code itself either, rather the build process only for it for ARM if it’s even a considerable option (basically, avoid certain priviliged filesystems and folders access) - still, I can imagine sometimes it simply can’t be done. :slight_smile:

Thanks for voicing the necessity for full VM approach for ARM builds being available. I cannot share any timeline for it yet, but stay tuned please.

Happy building!
Michał

5

Thank you @Michal, pls do let me informed when this is got any process.

and btw, we hit another issue on ARM, this is used to work but hit permission issue today, so I guess traivs did some update recently.

6

It has been an while, so I dig into the source to see if I can work around this issue to get the CI up for ARM, here is the code where the issue comes from,

Kubelet has the code to read and set the system file, /proc/sys/vm/overcommit_memory for example, this is workable in my local LXD where default profile is used.

I guess travis must have done something around apparmor, maybe set apparmor to enforced for the LXD instance. Since this is a host configuration, I think there is no way for me to workaround it.

Is there anything traivs team could do for us to workaround this issue?

cc @Michal @BanzaiMan @mayeut @cyb70289

7

Hi @chendave
Sorry for longer silence - lots to handle :slight_smile:
Thanks for checking that, we’ll take a look on our end.

8

A full VM environment for ARM64 is now available: