Unable to run buildkit. Missing binary?

[lindhe]

Hi! Since the advent of Docker 20.10, I got exited to try out rootless for the first time. I'm quite familiar with Docker, but rootless is new territory for me.

I followed the guide, including the common first steps, and simple things works (e.g. docker run hello-world, docker run -it --rm -p 8080:80 httpd and even docker run -it --rm alpine ping -c 3 1.1.1.1). Great!

So then I wanted to see if I could get buildkit to work with me on this project. I went to https://github.com/moby/buildkit/blob/master/docs/rootless.md#running-buildkit-in-rootless-mode and checked out the instructions. Now here's when I run into troubles.

$ rootlesskit buildkitd
[rootlesskit:child ] error: command [buildkitd] exited: exec: "buildkitd": executable file not found in $PATH
[rootlesskit:parent] error: child exited: exit status 1

Fair enough, it's not in my PATH. But I have no idea where to find it. It's not in apt or snap, and it was not included in the bundle of binaries that rootlesskit helped me install in ~/bin either.

And if I try to skip that step and go right to https://github.com/moby/buildkit/blob/master/docs/rootless.md#containerized-deployment I have insufficient privileges to to a UID map:

$ docker run --name buildkitd -it --rm --privileged moby/buildkit:rootless
[rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 11 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted
: exit status 1

I'm not quite sure what I should be asking for here, but it feels like there's a step missing in the instructions or perhaps I've just mucked something up. Please help me find a better issue title if you have an idea of what else this could be...

System info

OS: Ubuntu 20.04.1 LTS (Focal Fossa)
Kernel: 5.4.0-58-generic
systemd: 245
docker: 20.10.1
rootlesskit: 0.11.0

[AkihiroSuda]

Fair enough, it's not in my PATH. But I have no idea where to find it. It's not in apt or snap, and it was not included in the bundle of binaries that rootlesskit helped me install in ~/bin either.

https://github.com/moby/buildkit/releases/download/v0.8.1/buildkit-v0.8.1.linux-amd64.tar.gz

$ docker run --name buildkitd -it --rm --privileged moby/buildkit:rootless
[rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 11 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted
: exit status 1

Please try setting sysctl values on the host

• kernel.unprivileged_userns_clone=1
• user.max_user_namespaces=28633
  https://rootlesscontaine.rs/getting-started/common/sysctl/

[lindhe]

Thanks! I've downloaded those binaries now and put them in my PATH. Something works better now:

$ rootlesskit buildkitd
INFO[0000] auto snapshotter: using overlayfs            
INFO[0000] found worker "9sberhgzig3d9iajnyhyx47xw", labels=map[org.mobyproject.buildkit.worker.executor:oci org.mobyproject.buildkit.worker.hostname:blaptop org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/amd64 linux/386] 
WARN[0000] rootless mode is not supported for containerd workers. disabling containerd worker. 
INFO[0000] found 1 workers, default="9sberhgzig3d9iajnyhyx47xw" 
WARN[0000] currently, only the default worker can be used. 
INFO[0000] running server on /run/user/1000/buildkit/buildkitd.sock 

Please try setting sysctl values on the host

• kernel.unprivileged_userns_clone=1
• user.max_user_namespaces=28633
• https://rootlesscontaine.rs/getting-started/common/sysctl/

Since the sysctl page says "These steps are not needed for Ubuntu." I initially skipped them. But then I tried them again when not everything worked out-of-the-box. After your additional suggestions (which I cannot find on that page), my /etc/sysctl.d/99-rootless.conf looks like this:

#kernel.unprivileged_userns_clone=1
#net.ipv4.ping_group_range = 0 2147483647
#net.ipv4.ip_unprivileged_port_start=0

kernel.unprivileged_userns_clone=1
user.max_user_namespaces=28633

I've reloaded by sudo sysctl --system and even restarted my computer. No luck; same error as before:

$ docker run --name buildkitd -it --rm --privileged moby/buildkit:rootless
[rootlesskit:parent] error: failed to setup UID/GID map: newuidmap 12 [0 1000 1 1 100000 65536] failed: newuidmap: write to uid_map failed: Operation not permitted
: exit status 1