linux spec user: unable to find user root: no matching entries in passwd file

[dougbtv]

ISSUE TYPE

• Bug Report

container.yml

defaults:
  PROXY_DOMAIN: "toad.tld"
  PROXY_LOG_LEVEL: "DEBUG"
version: '2'
services:
  # fails with "root user not found" (or some such.)
  proxy:
    image: traefik
    command: --web --docker --docker.domain={{ PROXY_DOMAIN }} --docker.exposedbydefault=false --logLevel={{ PROXY_LOG_LEVEL }}
    user: traefik
    ports:
      - "80:80"
      - "8080:8080"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /dev/null:/traefik.toml
  jenkins_master:
    image: centos:centos7
    # build:
    #   context: ./dockerfiles
    #   dockerfile: centos7_base
    # container_name: jenkins_master
    entrypoint: /sbin/init
    privileged: true
    # depends_on:
    #   - proxy
    # security_opt:
    #   - seccomp:unconfined
    volumes:
      - /run
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
      - ./:/opt/toad
      - ./container_data/jenkins/data:/var/lib/jenkins/userContent
      - ./container_data/jenkins/log:/var/log/jenkins
      - ./container_data/jenkins/jobs:/etc/jenkins_jobs
    labels:
      - "traefik.enable=true"
      - "traefik.backend=jenkins_master"
      - "traefik.frontend.rule=Host:jenkins.{{ PROXY_DOMAIN }}"
      - "traefik.port=8080"
    expose:
      - "8080"

main.yml

- hosts: all
  gather_facts: false
- hosts: jenkins_master
  vars_files:
    - "../vars/main.yml"
    - ./vars/toad_vars.yml
  tags:
    - jenkins_master
  vars:
    sudo_defaults:
      - defaults: '!requiretty'
  tasks: 
    - name: Do things
      shell: >
        echo foo

OS / ENVIRONMENT

Ansible Container, version 0.3.0-pre
Linux, demoans, 3.10.0-514.el7.x86_64, #1 SMP Tue Nov 22 16:42:41 UTC 2016, x86_64
2.7.5 (default, Nov  6 2016, 00:28:07) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] /bin/python
No DOCKER_HOST environment variable found. Assuming UNIX socket at /var/run/docker.sock
{u'Architecture': u'x86_64',
 u'BridgeNfIp6tables': False,
 u'BridgeNfIptables': False,
 u'CPUSet': True,
 u'CPUShares': True,
 u'CgroupDriver': u'systemd',
 u'ClusterAdvertise': u'',
 u'ClusterStore': u'',
 u'Containers': 8,
 u'ContainersPaused': 0,
 u'ContainersRunning': 1,
 u'ContainersStopped': 7,
 u'CpuCfsPeriod': True,
 u'CpuCfsQuota': True,
 u'Debug': False,
 u'DefaultRuntime': u'docker-runc',
 u'DockerRootDir': u'/var/lib/docker',
 u'Driver': u'devicemapper',
 u'DriverStatus': [[u'Pool Name', u'docker-253:1-800-pool'],
                   [u'Pool Blocksize', u'65.54 kB'],
                   [u'Base Device Size', u'10.74 GB'],
                   [u'Backing Filesystem', u'xfs'],
                   [u'Data file', u'/dev/loop0'],
                   [u'Metadata file', u'/dev/loop1'],
                   [u'Data Space Used', u'1.658 GB'],
                   [u'Data Space Total', u'107.4 GB'],
                   [u'Data Space Available', u'4.556 GB'],
                   [u'Metadata Space Used', u'2.818 MB'],
                   [u'Metadata Space Total', u'2.147 GB'],
                   [u'Metadata Space Available', u'2.145 GB'],
                   [u'Thin Pool Minimum Free Space', u'10.74 GB'],
                   [u'Udev Sync Supported', u'true'],
                   [u'Deferred Removal Enabled', u'false'],
                   [u'Deferred Deletion Enabled', u'false'],
                   [u'Deferred Deleted Device Count', u'0'],
                   [u'Data loop file',
                    u'/var/lib/docker/devicemapper/devicemapper/data'],
                   [u'Metadata loop file',
                    u'/var/lib/docker/devicemapper/devicemapper/metadata'],
                   [u'Library Version', u'1.02.135-RHEL7 (2016-11-16)']],
 u'ExecutionDriver': u'',
 u'ExperimentalBuild': False,
 u'HttpProxy': u'',
 u'HttpsProxy': u'',
 u'ID': u'R3Q7:5GXS:UT6E:422K:WJDP:Z5LK:BQOA:PFN7:JBXH:OUCQ:KXWM:DJON',
 u'IPv4Forwarding': True,
 u'Images': 5,
 u'IndexServerAddress': u'https://index.docker.io/v1/',
 u'IndexServerName': u'docker.io',
 u'KernelMemory': True,
 u'KernelVersion': u'3.10.0-514.el7.x86_64',
 u'Labels': None,
 u'LiveRestoreEnabled': False,
 u'LoggingDriver': u'journald',
 u'MemTotal': 3974926336,
 u'MemoryLimit': True,
 u'NCPU': 4,
 u'NEventsListener': 0,
 u'NFd': 26,
 u'NGoroutines': 37,
 u'Name': u'demoans',
 u'NoProxy': u'',
 u'OSType': u'linux',
 u'OomKillDisable': True,
 u'OperatingSystem': u'CentOS Linux 7 (Core)',
 u'PkgVersion': u'docker-common-1.12.6-11.el7.centos.x86_64',
 u'Plugins': {u'Authorization': None,
              u'Network': [u'null', u'host', u'bridge', u'overlay'],
              u'Volume': [u'local']},
 u'Registries': [{u'Name': u'docker.io', u'Secure': True}],
 u'RegistryConfig': {u'IndexConfigs': {u'docker.io': {u'Mirrors': None,
                                                      u'Name': u'docker.io',
                                                      u'Official': True,
                                                      u'Secure': True}},
                     u'InsecureRegistryCIDRs': [u'127.0.0.0/8'],
                     u'Mirrors': None},
 u'Runtimes': {u'docker-runc': {u'path': u'/usr/libexec/docker/docker-runc-current'},
               u'runc': {u'path': u'docker-runc'}},
 u'SecurityOptions': [u'seccomp', u'selinux'],
 u'ServerVersion': u'1.12.6',
 u'SwapLimit': True,
 u'Swarm': {u'Cluster': {u'CreatedAt': u'0001-01-01T00:00:00Z',
                         u'ID': u'',
                         u'Spec': {u'CAConfig': {},
                                   u'Dispatcher': {},
                                   u'Orchestration': {},
                                   u'Raft': {},
                                   u'TaskDefaults': {}},
                         u'UpdatedAt': u'0001-01-01T00:00:00Z',
                         u'Version': {}},
            u'ControlAvailable': False,
            u'Error': u'',
            u'LocalNodeState': u'inactive',
            u'Managers': 0,
            u'NodeAddr': u'',
            u'NodeID': u'',
            u'Nodes': 0,
            u'RemoteManagers': None},
 u'SystemStatus': None,
 u'SystemTime': u'2017-03-16T20:00:16.349858786Z'}
{u'ApiVersion': u'1.24',
 u'Arch': u'amd64',
 u'BuildTime': u'2017-03-07T09:23:34.785530776+00:00',
 u'GitCommit': u'96d83a5/1.12.6',
 u'GoVersion': u'go1.7.4',
 u'KernelVersion': u'3.10.0-514.el7.x86_64',
 u'Os': u'linux',
 u'PkgVersion': u'docker-common-1.12.6-11.el7.centos.x86_64',
 u'Version': u'1.12.6'}

SUMMARY

When running a container that is supposed to be run from a downloaded image (e.g. not one managed by this ansible-container project) it happens to fail with this error:

ERROR: for proxy  Cannot start service proxy: linux spec user: unable to find user root: no matching entries in passwd file
Execution failed with <class 'compose.project.ProjectError'>

In this case the image specifically is traefik and likely uses alpine linux.

The container.yml is borrowed from a working docker-compose.yml (with docker-compose, as you'd guess).

STEPS TO REPRODUCE

ansible-container build

EXPECTED RESULTS

No error.

ACTUAL RESULTS

ERROR: for proxy  Cannot start service proxy: linux spec user: unable to find user root: no matching entries in passwd file
Execution failed with <class 'compose.project.ProjectError'>

[chouseknecht]

@dougbtv, I'm confused by your main.yml. Specifically the first two lines:

- hosts: all
  gather_facts: false

This is an empty play, meaning there are no tasks. However, I suspect that Ansible may still be attempting to connect to each (or all) of the hosts. Can you remove these two lines, and give it another try.

[dougbtv]

@chouseknecht thanks for the eyes to check that out. Wondering where I got that, I think it was copy-pasta from some reference ansible-container main.yml I found in the wild.

I went ahead and re-ran it with main.yml with just:

- hosts: jenkins_master
  vars_files:
    - "../vars/main.yml"
    - ./vars/toad_vars.yml
  tags:
    - jenkins_master
  vars:
    sudo_defaults:
      - defaults: '!requiretty'
  tasks: 
    - name: Do things
      shell: >
        echo foo

And I had the same results:

[root@demoans toad]# ansible-container build
No DOCKER_HOST environment variable found. Assuming UNIX socket at /var/run/docker.sock
Starting Docker Compose engine to build your images...
Attaching to ansible_ansible-container_1
Cleaning up Ansible Container builder...
No image found for tag toad-jenkins_master:latest, so building from scratch
No image found for tag toad-proxy:latest, so building from scratch

ERROR: for proxy  Cannot start service proxy: linux spec user: unable to find user traefik: no matching entries in passwd file
Execution failed with <class 'compose.project.ProjectError'>

Something that also jumps out at me is:

No image found for tag toad-proxy:latest, so building from scratch

In this case, I don't actually need to or want to customize this image. Is there a way to specifically say in the containers.yml that "I don't want to build this image -- I just want the third party image as downloaded from some registry -- don't bother trying to build it, just run the container from this image"?

I tried reading through the container.yml reference but, I'm not seeing anything there. Seeing it's a really stripped down image that I don't want to modify, I'm wondering if it's having trouble trying to run it "in a special ansible-containers" way.

Thanks again, too!

[michalmedvecky]

I'm running into this issue too.

docker.errors.APIError: 500 Server Error: Internal Server Error ("linux spec user: unable to find user root: no matching entries in passwd file")

this is my container.yml:

version: "2"
settings:
  conductor_base: ubuntu:16.10
services:
  ssportal:
    from: ubuntu:16.04
    roles:
      - ansible-ssportal
    ports:
    - 80
    entrypoint: ['/usr/bin/dumb-init', '/usr/bin/entrypoint.sh']
volumes:
  static:
    docker: {}
registries: {}

the ansible-ssportal role just tries to install apache2 package on ubuntu:16.10.

[LeHack]

@michalmedvecky

I encountered the same issue with a similar setup:

version: "2"
settings:
  conductor_base: centos:7
services:
  web:
    roles:
      - testapp

Where the testapp role actually uses python:3 as the base image.
I tried a couple of things, each time cleaning up the old conductor images and volumes and then it struck me that I never seen the python:3 image when running: docker image ls
On a hunch I've run: docker image pull python:3 and it helped.
Looks like for some reason ansible-container did not pull the image itself (I'm using 0.9.2rc0, that's the current HEAD in develop).

Thus try pulling ubuntu:16.04 and see if it helps (since your conductor uses 16.10)

[mhumeSF]

Was running into this issue and think it would be a cool feature when passing around ansible-container projects, to be able to pull necessary docker images before running ansible-container build project. Or if docker images not found locally or remotely, throwing a better warning

[LeHack]

@mhumeSF Actually I'd consider it more of a bug, since if it handles fetching the conductor image from remote, it should also be able to do the same for each service built.

[rokroskar]

I have the same problem -- running on macos 10.10.5 with Docker version 17.03.1-ce, build c6d412e and current ansible-container develop branch. It seems to go away if add a dummy service at the beginning that just loads the centos image and does nothing else, e.g.:

services: 
  test: 
    from: 'centos:7'

[chouseknecht]

@rokroskar:

Can you share a more complete container.yml that will reproduce the issue. I would like to see if we can solve this.

Thanks!

[rokroskar]

@chouseknecht -- unreal, I'm just trying to reproduce it again (after staring at that error for many hours yesterday) and I cannot. I will report back here if I manage to break it again.

I believe what fixed it was

pip install -U --force-reinstall --no-cache-dir -e .\[docker\]

[mhumeSF]

Having trouble creating a reproducible test case, but our scenario is referencing an image from a private aws container repo. These containers are referenced from the local tag name. If the containers have not been pulled from the private repo and tagged appropriately, the error above happens. I do see the Could not find container for <service> error, but maybe if that were more prominent

[flaub]

I have reproduced this issue with the following container.yml:

version: "2"
settings:
  project_name: bug
  conductor_base: ubuntu:14.04
services:
  ubuntu-14.04:
    from: ubuntu:14.04
    roles:
    - role: container-bootstrap
    command: ['/bin/true']
  ubuntu-17.04:
    from: ubuntu:17.04
    roles:
    - role: container-bootstrap
    command: ['/bin/true']

The container-bootstrap role is defined as:

---
- name: Install python for ansible-container support
  raw: which python || apt-get -y update && apt-get install -y python
- name: Gather facts
  setup:

This is what I get from running ansible-container build:

Building Docker Engine context...
Starting Docker build of Ansible Container Conductor image (please be patient)...
Parsing conductor CLI args.
Docker™ daemon integration engine loaded. Build starting.	project=bug
Building service...	project=bug service=ubuntu-14.04
mount: warning: /tmp/tmpFrbgrP/files seems to be mounted read-only.
mount: warning: /tmp/tmpFrbgrP/templates seems to be mounted read-only.

PLAY [ubuntu-14.04] ************************************************************

TASK [Gathering Facts] *********************************************************
ok: [ubuntu-14.04]

PLAY RECAP *********************************************************************
ubuntu-14.04               : ok=1    changed=0    unreachable=0    failed=0

Applied role to service	role=ordereddict([('role', 'container-bootstrap')]) service=ubuntu-14.04
Committed layer as image	image=sha256:08b47d538f90bce3232527491656f82329cbda3e150c9d03b58b1ca69ce1abd4 service=ubuntu-14.04
Build complete.	service=ubuntu-14.04
Building service...	project=bug service=ubuntu-17.04
Traceback (most recent call last):
  File "/usr/local/bin/conductor", line 11, in <module>
    load_entry_point('ansible-container', 'console_scripts', 'conductor')()
  File "/_ansible/container/__init__.py", line 19, in __wrapped__
    return fn(*args, **kwargs)
  File "/_ansible/container/cli.py", line 378, in conductor_commandline
    **params)
  File "/_ansible/container/__init__.py", line 19, in __wrapped__
    return fn(*args, **kwargs)
  File "/_ansible/container/core.py", line 735, in conductorcmd_build
    container_id = engine.run_container(cur_image_id, service_name, **run_kwargs)
  File "/_ansible/container/docker/engine.py", line 83, in __wrapped__
    return fn(self, *args, **kwargs)
  File "/_ansible/container/__init__.py", line 19, in __wrapped__
    return fn(*args, **kwargs)
  File "/_ansible/container/docker/engine.py", line 202, in run_container
    **run_kwargs
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 703, in run
    container.start()
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 333, in start
    return self.client.api.start(self.id, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/utils/decorators.py", line 19, in wrapped
    return f(self, resource_id, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 1079, in start
    self._raise_for_status(res)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 222, in _raise_for_status
    raise create_api_error_from_http_exception(e)
  File "/usr/local/lib/python2.7/dist-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation)
docker.errors.APIError: 500 Server Error: Internal Server Error ("linux spec user: unable to find user root: no matching entries in passwd file")
Conductor terminated. Cleaning up.	command_rc=1 conductor_id=16efa6a44a883e2f258d7d0052e4d3487efb212b4d22c1225fa7eee34523a143 save_container=False
ERROR	Conductor exited with status 1

I'm using the HEAD of develop:

$ ansible-container version
Ansible Container, version 0.9.2rc0

[SalahAdDin]

Yes, i have the same problem with the same version:

Traceback (most recent call last):
  File "/usr/local/bin/conductor", line 11, in <module>
    load_entry_point('ansible-container', 'console_scripts', 'conductor')()
  File "/_ansible/container/__init__.py", line 19, in __wrapped__
    return fn(*args, **kwargs)
  File "/_ansible/container/cli.py", line 378, in conductor_commandline
    **params)
  File "/_ansible/container/__init__.py", line 19, in __wrapped__
    return fn(*args, **kwargs)
  File "/_ansible/container/core.py", line 736, in conductorcmd_build
    container_id = engine.run_container(cur_image_id, service_name, **run_kwargs)
  File "/_ansible/container/docker/engine.py", line 83, in __wrapped__
    return fn(self, *args, **kwargs)
  File "/_ansible/container/__init__.py", line 19, in __wrapped__
    return fn(*args, **kwargs)
  File "/_ansible/container/docker/engine.py", line 202, in run_container
    **run_kwargs
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 703, in run
    container.start()
  File "/usr/local/lib/python2.7/dist-packages/docker/models/containers.py", line 333, in start
    return self.client.api.start(self.id, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/utils/decorators.py", line 19, in wrapped
    return f(self, resource_id, *args, **kwargs)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/container.py", line 1079, in start
    self._raise_for_status(res)
  File "/usr/local/lib/python2.7/dist-packages/docker/api/client.py", line 222, in _raise_for_status
    raise create_api_error_from_http_exception(e)
  File "/usr/local/lib/python2.7/dist-packages/docker/errors.py", line 31, in create_api_error_from_http_exception
    raise cls(e, response=response, explanation=explanation)
docker.errors.APIError: 500 Server Error: Internal Server Error ("linux spec user: unable to find user root: no matching entries in passwd file")
2017-07-11T02:21:52.089779 Conductor terminated. Cleaning up. [container.docker.engine] caller_file=/home/salahaddin/Proyectos/Works/text-ansible-container/ansible-container/container/docker/engine.py caller_func=await_conductor_command caller_line=356 command_rc=1 conductor_id=089b46a965035175845fac5ba3436af60dbafcc336ff6e835bb33868c48926a2 save_container=False
2017-07-11T02:21:52.703598 Conductor exited with status 1 [container.cli] caller_file=/home/salahaddin/Proyectos/Works/text-ansible-container/ansible-container/container/cli.py caller_func=__call__ caller_line=290