Version 0.82.1ubuntu2.1 breaks unattended upgrades on unprivileged Docker containers

Bug #1433584 reported by Foo
This bug report is a duplicate of:  Bug #1422345: stop being nice does not work. Edit Remove
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
unattended-upgrades (Ubuntu)
New
Undecided
Unassigned

Bug Description

Since update of the unattended-upgrades package to version 0.82.1ubuntu2.1, unprivileged Docker containers cannot properly perform unattended upgrades anymore. They fail with the following error message:

=================================================
Traceback (most recent call last):
  File "/usr/bin/unattended-upgrade", line 1186, in <module>
    main(options)
  File "/usr/bin/unattended-upgrade", line 993, in main
    os.nice(-19)
PermissionError: [Errno 1] Operation not permitted
=================================================

This is due to the fact that the script tries to set a negative nice value, which is by default not allowed on unprivileged Docker containers. In previous package versions, the script was trying to set a nice value of 0, which was allowed.

To solve this issue, two solutions could be considered:
- The unattended-upgrades package should remain using a nice value of 0
- The containers should be started with the "--cap-add=CAP_SYS_NICE" option. Unfortunately, it is not possible to add this capability to running containers.

More information:

# lsb_release -rd
Description: Ubuntu 14.04.1 LTS
Release: 14.04

# apt-cache policy unattended-upgrades
unattended-upgrades:
  Installed: 0.82.1ubuntu2.1
  Candidate: 0.82.1ubuntu2.1
  Version table:
 *** 0.82.1ubuntu2.1 0
        500 http://ubunturepo/ trusty-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     0.82.1ubuntu2 0
        500 http://ubunturepo/ trusty/main amd64 Packages

Foo (foo-foo-ch)
description: updated
Revision history for this message
Rolf Wojtech (rolf-g) wrote :
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.