0

I'm fairly new to both Docker and Buildroot. I'm trying to launch a simple docker image (hello-world) from inside a basic embedded system which I created through one of the provided buildroot configurations. Specifically, I'm using the provided qemu_x86_64_defconfig. I've added the following modules through 'make menuconfig'

BR2_PACKAGE_DOCKER_CLI=y BR2_PACKAGE_DOCKER_COMPOSE=y BR2_PACKAGE_DOCKER_ENGINE=y BR2_PACKAGE_CONTAINERD=y BR2_PACKAGE_RUNC=y

I am able to boot into my system via qemu, and launch docker; however, when I try and run the basic hello-world image, I get an error:

> docker run hello-world
Unable to find image 'hello-world:latest' locally
docker: Error response from daemon: Get "https://registry-1.docker.io/v2/": x509: certificate 
signed by unknown authority.
See 'docker run --help'.

Googling this particular error, all the suggestions seem to indicate issues with firewalls, proxy's, VPN connections, etc. Some people point to instructions on adding security certificates, such as this: https://docs.docker.com/engine/security/certificates/. On the other hand, I have no issue installing and running the docker "hello-world" image in any of my standard Linux distributions (running via WSL), or on Windows itself. My guess is that the error is unrelated to needing certificates and is a red herring for a different "buildroot embedded system" related issue.

Has anyone had any success running docker images inside a buildroot generated embedded system? I found this old post which seems to be when docker support was still being patched into buildroot. The latest 2022/2023 versions have these modules included it seems, though I'm not sure I've included all the necessary components for a working system.

Lucky Mike
  • 779
  • 2
  • 6
  • 17
  • Posted this on reddit as well, one comment that might be relevant: Looks like it throws the error when you establish https to *.docker.io, maybe your system is missing the standard certificate store? Not sure how buildroot includes root certs but I would start looking there to validate whether or not you have them on your system. Doesn't feel to me like a docker-specific problem. – Lucky Mike Mar 26 '23 at 01:23
  • Issue was that I need to install BR2_PACKAGE_CA_CERTIFICATES=y Now I'm hitting this new issue docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: seccomp: config provided but seccomp not supported: unknown. – Lucky Mike Mar 26 '23 at 02:11

1 Answers1

0

Final missing piece was to include LIBSECCOMP libraries. Here's the full list of buildroot packages required to run the hello-world docker image inside a buildroot generated embedded image:

BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS=y
BR2_PACKAGE_LIBSECCOMP=y
BR2_PACKAGE_CA_CERTIFICATES=y 
BR2_PACKAGE_DOCKER_CLI=y 
BR2_PACKAGE_DOCKER_COMPOSE=y 
BR2_PACKAGE_DOCKER_ENGINE=y 
BR2_PACKAGE_CONTAINERD=y 
BR2_PACKAGE_RUNC=y
Lucky Mike
  • 779
  • 2
  • 6
  • 17