Docker daemon fails with following output

[HanJoHibender]

This bug-tracker is monitored by developers and other technical types. We like detail! So please use this form and tell us, concisely but precisely, what's up. Please fill out ALL THE FIELDS!

If you have a feature request, please post to the UserVoice. If you're reporting a BSOD, don't post here! Instead, e-mail "[email protected]", and if possible attach the minidump from "C:\Windows\minidump".

• Your Windows build number: (Type ver at a Windows Command Prompt)

• What you're doing and what's happening: (Copy&paste specific commands and their output, or include screen shots)

• What's wrong / what should be happening instead:

• Strace of the failing command, if applicable: (If <cmd> is failing, then run strace -o strace.txt -ff <cmd>, and post the strace.txt output here)

See our contributing instructions for assistance.

[HanJoHibender]

Microsoft Windows [Version 10.0.15063]

Within the Bash on Ubuntu on Windows environment I successfuly installed docker.io with apt.

Subsequently I try to activate a docker container following https://github.com/tensorflow/tensorflow/tree/master/tensorflow/examples/udacity

Thereafter I get bash telling me the docker daemon is not running. Trying to run dockerd (the daemon) result in the following output:

INFO[0000] libcontainerd: new containerd process, pid: 124
WARN[0001] Failed to configure golang's threads limit: open /proc/sys/kernel/threads-max: no such file or directory
ERRO[0001] 'overlay' not found as a supported filesystem on this host. Please ensure kernel is new enough and has overlay support loaded.
INFO[0001] Graph migration to content-addressability took 0.00 seconds
WARN[0001] Your kernel does not support cgroup memory limit
WARN[0001] Unable to find cpu cgroup in mounts
WARN[0001] Unable to find blkio cgroup in mounts
WARN[0001] Unable to find cpuset cgroup in mounts
WARN[0001] mountpoint for pids not found
FATA[0001] Error starting daemon: Devices cgroup isn't mounted``

[MikeGitb]

Please fill out the issue template above (especially what version of Windows you are using and what where the exact command that failed. That being said, I believe docker is not yet supported by wsl

[tr-dev]

Are there any plans to add support for docker to wsl?

Here's my information if it can be any help.

ver - Microsoft Windows [Version 10.0.15063]
strace -o strace.txt -ff service docker start - stacktace
/var/log/docker.log

[fruch]

seeing the exact same issue as @HanJoHibender, I know it's not simple, but having docker run like that on windows, is a game changer. it would be amazing. (I don't have the Pro version on my home computer, and the vm based docker is a pain, and slow)

[chadacaldwell]

+1

[siddhpant]

The version of docker you're using is obsolete. It's version 1.something. The current version is 17.something.
I'm having a problem with ivoke-rc.d though.

[onomatopellan]

I'm glad to say Docker daemon finally runs on WSL. I'm testing on build 17134.

The most important part is dockerd will only run on an elevated console (run as Admin) and cgroup should be always mounted before running the docker daemon.

The steps to install docker on Ubuntu Xenial are:

sudo apt install docker.io
sudo usermod -aG docker $USER

And every time you need to run the daemon, always on an elevated ubuntu.exe:

sudo cgroupfs-mount
sudo service docker start

After that I tried these and did work:

docker run --rm hello-world

docker run --rm -it alpine sh

docker run -p 8888:8888 --name tensorflow-udacity -it gcr.io/tensorflow/udacity-assignments:1.0.0

It's important to note that docker version in Xenial repositories is moby 1.13.1 which would be docker-ce 17.02. The last docker-ce version that works right now on build 17134 is 17.09.0. Anything after that fails on extracting the docker images.

Thanks to @targat1982's post on reddit

[DzeryCZ]

That's great news!

Unfortunately, docker-compose still doesn't work. I'm getting :

jerry@PC:/mnt/c/Users/jerry/projects/my-project$ docker-compose up -d
Creating network "project_project" with driver "bridge"
ERROR: Failed to Setup IP tables: Unable to enable NAT rule:  (iptables failed: iptables --wait -t nat -I POSTROUTING -s 172.20.0.0/16 ! -o br-9e8373fca539 -j MASQUERADE: iptables: No chain/target/match by that name.
 (exit status 1))

There is a problem with iptables which is not fully supported via WSL yet.

Please upvote here: https://wpdev.uservoice.com/forums/266908-command-prompt-console-bash-on-ubuntu-on-windo/suggestions/32025199-support-iptables

[stevefan1999-personal]

I tried to run a hello world example in the latest version of docker provided by Ubuntu Bionic (using lxrunoffline yes) and I strace'd the result, I have the data boiled down to the core:

...
write(2, "9bb5a5d4561a: ", 149bb5a5d4561a: )          = 14
ioctl(1, TIOCGWINSZ, {ws_row=30, ws_col=120, ws_xpixel=0, ws_ypixel=0}) = 0
write(2, "Extracting [===================="..., 79Extracting [==================================================>]     9) = 795B
futex(0xc4204d2148, FUTEX_WAKE, 1)      = 1
write(2, "\33[1B", 4)                   = 4
read(3, 0xc420084000, 4096)             = -1 EAGAIN (Resource temporarily unavailable)
futex(0x1693c08, FUTEX_WAIT, 0, NULL)   = 0
docker: failed to register layer: Error processing tar file(exit status 1): invalid argument.
See 'docker run --help'.
epoll_pwait(4,  <unfinished ...>
+++ exited with 125 +++

Perhaps it has some diagnostic?

EDIT: Nevermind, I overlooked the solution above, by completely wiping docker and install 17.09.0 did work for me.

Then I added cgroupfs-mount to ~/.bashrc. You still have to manually start docker tho, not sure why...

[onomatopellan]

@stevefan1999 Are you on build 17134? That problem was due non supported MS_SLAVE flag on mount. It was fixed in build 17666

Running docker from Bionic (docker-ce 17.12.1) on latest insider builds works but containerd-shim shows high CPU usage on idle. Probably some syscall that was stubbed but not implemented yet.

[stevefan1999-personal]

@onomatopellan Exactly! I'm not using insider build though, nor will I be tempted to, as it's too risky to take but I can tolerate manually starting docker every time I start bash (better yet I can use an alias for one character boot). I wouldn't mind waiting till November for Autumn update for a better workaround.

By the way, how do I switch another docker engine connection on my native windows? localhost:4243 is open and receiving, but docker keeps connecting to //./pipe/docker_engine, scratching my head for that...

EDIT: Setting DOCKER_HOST in environment variable, just like usual *nix setup, did work.

[onomatopellan]

@stevefan1999 Even in latest builds running Dockerd inside WSL is right now for kicks and giggles. It's just not ready for normal usage (there are some problems with overlay2 driver) and it's just for testing where is the limit. Some scenarios work surprisingly well though, like the process of compiling docker from docker-ce repo which pulls and runs debian/ubuntu containers in order to create the binaries.

[WSLUser]

@onomatopellan Can you document (in some blog or something) everything that has lit up with native Docker? Also, if there are several scenarios working then new issues should be opened for the fine-tune tweaking (such as eliminating high cpu usage) to get a fully functional docker engine in WSL. I wouldn't mind alittle more slowness compared to Windows if it was made to be not so unbearable but if not all scenarios are working yet, as you said, no point in running it other than giggles.

[stevefan1999-personal]

@DarthSpock Portainer, for example, didn't work. I don't know the exact reason but docker ps -a shows it's dead instantly.

[onomatopellan]

@DarthSpock The reddit thread already has some issues people are finding out. Since I'm not a Docker expert and I can't compare it to Docker for Windows (no Hyper-V support) I just like to follow Docker tutorials and see how far I can get in WSL on latest insider builds. So far only the tutorial for compiling Docker-ce worked for me.

I'd really love to see a fully functional docker engine in WSL. It looks like there is more work to do to fully implement iptables and cgroups. This tweet was a bit discouraging though, and It explains why sometimes the file system inside containers is erratic.

[WSLUser]

Yeah, I recently mentioned it on Twitter and got a major "we aren't supporting this, we highly advise against it" message from our former WSL PM. Still if enough of it lights up, it would only make logical sense to put on the final touches. I'm curious where the cgroup implementation is coming from though since Docker obviously isn't the use-case (that they want to admit to anyways).

As far as iptables go, yeah that would be great to have regardless of Docker. We can use it in a VM (even with Hyper-V) so WSL ought to be able to handle it but still have to wait for full-implementation.

@stevefan1999 good to know. Glad there's some people out there able to use Insiders to test this.

[stevefan1999-personal]

@DarthSpock Perhaps it is for the compliance to the Linux kernel, you know, cgroups is still in mainline after all, and that also means only a minimal viable set of functionalities are available.

Also, I didn't expect overlay(2) in WSL could be this slow, my Rock64 ARM docker host can be faster by tens of margin...

Is there something wrong in the implementation or was that the syscall was delayed in Windows kernel translation level?

But I'm more hyped to see /dev/kvm someday🙃

[therealkenc]

I'm curious where the cgroup implementation is coming from though since Docker obviously isn't the use-case (that they want to admit to anyways).

Control groups are used extensively by a very large, popular, and highly requested package that doesn't run (well) in WSL right now. You could... almost... call it the number 1 application.

[bmayen]

What is "chrome"?

[WSLUser]

What is "chrome"?

I don't think that's it. Would that be snap by any chance? Otherwise, not entirely sure.

[Rondom]

Systemd is PID1. Right now WSL uses a closed-source custom init due to that.

[marco6]

wget https://download.docker.com/linux/ubuntu/dists/xenial/pool/stable/amd64/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb -P /tmp/
sudo dpkg -i /tmp/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb
sudo apt -y -f install

doesn't work anymore the -f install will overwrite everything with 18.09 and you will get to the same broken state

I've been able to make it work by changing the sequence to:

wget https://download.docker.com/linux/ubuntu/dists/xenial/pool/stable/amd64/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb -P /tmp/
sudo dpkg -i /tmp/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb
sudo usermod -aG docker $USER
sudo apt -y install aufs-tools cgroupfs-mount libltdl7
sudo cgroupfs-mount
sudo service docker start

In my own installation, it works everything, including commands without "--network host" option.

Hope this helps.

[astorath]

In my own installation, it works everything, including commands without "--network host" option.

@marco6 can it run docker run --rm postgres ?
On my machine any docker version installed on WSL fails to execute this container.

[marco6]

@astorath No, it doesn't. I've not been using postgres on WSL, but if I try I get:

[26] FATAL: could not map shared memory segment "/PostgreSQL.814799216": Operation not permitted

Is this maybe related to #658 ?

[mhagnumdw]

@Knedox , this works... but...

But I have problems apparently with memory allocation.

[pershoot]

Windows Insider Fast Ring build (>=18917) via WSL2, latest docker/docker-compose is running native in WSL Linux.

wsl -l -v
NAME STATE VERSION

• Ubuntu Running 2

$ docker --version
Docker version 19.03.1, build 74b1e89

$ service docker status

• Docker is running

$ docker run --network host hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
1b930d010525: Pull complete Digest: sha256:6540fc08ee6e6b7b63468dc3317e3303aae178cb8a45ed3123180328bcc1d20f
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

...

$ docker-compose up (ip address ---'d out)
Creating network "myweb_default" with the default driver
Pulling myweb-nginx (nginx:1.17.2-alpine)...
1.17.2-alpine: Pulling from library/nginx
050382585609: Pull complete aa1504bc12ac: Pull complete Digest: sha256:482ead44b2203fa32b3390abdaf97cbdc8ad15c07fb03a3e68d7c35a19ad7595
Status: Downloaded newer image for nginx:1.17.2-alpine
Creating myweb_myweb-nginx_1 ... done Attaching to myweb_myweb-nginx_1
myweb-nginx_1 | ---.--.-.- - - [04/Aug/2019:21:14:51 +0000] "GET / HTTP/1.1" 200 108 "-" "curl/7.58.0" "-"
^CGracefully stopping... (press Ctrl+C again to force)
Stopping myweb_myweb-nginx_1 ... done

$ docker-compose images
Container Repository Tag Image Id Size

myweb_myweb-nginx_1 nginx 1.17.2-alpine 55ceb2abad47 20.2 MB

...

Errors printed (excluding snapshotter):
$ grep -i error /var/log/docker.log | grep -v snapshot
time="2019-08-04T17:00:53.036690000-04:00" level=warning msg="Running modprobe nf_nat failed with message: modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.57-microsoft-standard/modules.dep.bin'\nmodprobe: WARNING: Module nf_nat not found in directory /lib/modules/4.19.57-microsoft-standard, error: exit status 1"
time="2019-08-04T17:00:53.037697900-04:00" level=warning msg="Running modprobe xt_conntrack failed with message: modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.57-microsoft-standard/modules.dep.bin'\nmodprobe: WARNING: Module xt_conntrack not found in directory /lib/modules/4.19.57-microsoft-standard, error: exit status 1"
time="2019-08-04T17:14:34-04:00" level=warning msg="Running modprobe nf_nat failed with message: modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.57-microsoft-standard/modules.dep.bin'\nmodprobe: WARNING: Module nf_nat not found in directory /lib/modules/4.19.57-microsoft-standard, error: exit status 1"
time="2019-08-04T17:14:34-04:00" level=warning msg="Running modprobe xt_conntrack failed with message: modprobe: ERROR: ../libkmod/libkmod.c:586 kmod_search_moddep() could not open moddep file '/lib/modules/4.19.57-microsoft-standard/modules.dep.bin'\nmodprobe: WARNING: Module xt_conntrack not found in directory /lib/modules/4.19.57-microsoft-standard, error: exit status 1"

[FireGhost]

@six7 you can try to run Docker daemon with parameter --iptables=false.

Even better, you should set this parameter in the configuration file /etc/docker/daemon.json like this:

{
  "iptables":false
}

No more docker-compose networking problem :)

[gongbaojid]

@six7 you can try to run Docker daemon with parameter --iptables=false.

Even better, you should set this parameter in the configuration file /etc/docker/daemon.json like this:

{
  "iptables":false
}

No more docker-compose networking problem :)

perfect，it has sovled the problem that starting docker service with error bellow:

Error starting daemon: Error initializing network controller: error obtaining controller instance: failed to create NAT chain DOCKER: iptables failed: iptables -t nat -N DOCKER: iptables v1.6.1: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
 (exit status 3)

[duke-cliff]

on clean ubuntu 18.04 just run these commands within a privileged bash:

wget https://download.docker.com/linux/ubuntu/dists/xenial/pool/stable/amd64/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb -P /tmp/
sudo dpkg -i /tmp/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb
sudo apt -y -f install
sudo usermod -aG docker $USER
sudo apt -y install cgroupfs-mount
sudo cgroupfs-mount
sudo service docker start

docker run --network host hello-world

Thanks, I have been searching solutions even in 2019. The above steps are really helping!

[nirvdrum]

@duke-cliff Were you able to get this working with Windows 10 1909? I followed the same steps + disabling iptables, but I end up with:

Error starting daemon: Error initializing network controller: Error creating default "bridge" network: permission denied

[adamsar]

@nirvdrum Ditto on this - I'm getting the same error with these steps.

[MikeWilcoxMicrosoft]

We installed Docker Desktop for Windows on my Windows 10 w/ WSL Ubuntu 1804.2019 and still receive the error:

$ docker run --network host hello-world
docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.
See 'docker run --help'.

[WSLUser]

You probably need npiperelay unless you're running an Insiders build. In that case, you'd need to enable WSL2 if you're trying to run the preview version of Docker Desktop. You can also try Pengwin if not on Insiders. It will automatically try to create a AF Unix socket for connection first before attempting to install npiprelay. If that works, then I'd check the pengwin-setup script under the docker section and see if how you're trying to get ubuntu to run with sockets is the same as how pengwin does it. Alternatively you could run pengwin-setup directly on Ubuntu as it's debian based and the commands should all work out of box.

[nelak]

@MikeWilcoxMicrosoft See this thread for help: docker/for-win#5096
running sudo /mnt/wsl/docker-desktop/docker-desktop-proxy --distro-name Ubuntu --docker-desktop-root /mnt/wsl/docker-desktop
You may also need to remove all unused folders here also: /mnt/wsl/docker-desktop-bind-mounts/Ubuntu

[eddie1788]

strace.zip

C:\WINDOWS\system32>ver
Microsoft Windows [Version 10.0.17763.1039]

root@:~/.kube# docker ps
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

strace -o strace.txt -ff docker ps
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

[numbworks]

Hey guys,

thank you for this thread! I'm glad I'm not alone in this!
Below my experience so far.

I'm running Windows 10 Pro Version 1903 Build 18362:

PS C:\> (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ReleaseId).ReleaseId
1903

C:\>ver
Microsoft Windows [Version 10.0.18362.720]

I perfomed a reset of Ubuntu WLS with the following steps:

Right-click on Ubuntu 18.04 LTS (WLS) icon > More > App Settings > Reset

Then I launched Ubuntu WLS and typed these commands as suggested:

sudo apt-get update
wget https://download.docker.com/linux/ubuntu/dists/xenial/pool/stable/amd64/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb -P /tmp/
sudo dpkg -i /tmp/docker-ce_17.09.0~ce-0~ubuntu_amd64.deb
sudo apt -y -f install
sudo usermod -aG docker $USER
sudo apt -y install cgroupfs-mount
sudo cgroupfs-mount
sudo service docker start

When I type the last one, I get the following "OK" output:

nw@nw:~$ sudo service docker start
 * Starting Docker: docker                                                                                       [ OK ]

But then running "docker ps" returns the following error:

nw@nw:~$ docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.32/containers/json: dial unix /var/run/docker.sock: connect: permission denied

Running Ubuntu WLS as Administrator doesn't change anything.

If I close Ubuntu WLS and open it again, the error is the one we are discussing in this thread:

nw@nw:~$ docker ps
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Any other suggestion to make docker running in Ubuntu WLS for Windows 10, and get rid of Docker Desktop (which it's a pain when handling data volumes due of permission issues etc)?

[ixalsera]

Found this thread funnily enough because I was having issues starting Docker on a native Linux VM and I think the cgroupfs-mount command should sort it (until now, only a VM reboot has helped), thanks @onomatopellan.

@numbworks , to try help you out here, I don't think you actually have an issue with what you've done/are doing except from one thing: Docker runs as the root user in Linux. It's a little bit of an issue but beyond the scope of this thread. You're starting the Docker daemon with:

sudo systemctl start docker

which is correct and how it should be done (note, I used systemctl here as service is just the older way of doing it; the two do the same thing).

Docker then starts as root, preventing any other user from accessing the daemon. From the excerpt you shared above, you're trying to issue docker ps as your regular nw user, not as root. If you try sudo docker ps you should not have the error:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

or similar about permissions.

This is the same behaviour that occurs on a native Ubuntu install; Docker runs as root and can only be accessed via sudo. From native Ubuntu when issuing just docker ps:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.39/containers/json: dial unix /var/run/docker.sock: connect: permission denied

You did mention that you tried running Ubuntu WLS as Administrator. Since I'm not familiar with WLS, does that drop you in to the terminal as root or still as your regular user? If the former, then what I've said above probably won't apply, but if it drops you in as nw, then Ubuntu still sees you as non-root and won't let you access the Docker daemon.

EDIT 2: Just realised that you're issuing sudo usermod -aG docker $USER to add yourself to the docker group and avoid having to sudo for Docker commands. My bad, missed that for the first read. This should work perfectly, but you may find that it won't help for your current terminal session and will only be effective once you open a new Ubuntu terminal window. Similar behaviour on native Ubuntu (just tested) whereby the group permissions for docker are only loaded in the next terminal session. See below for my attempt at help for the re-opening issue. :)

EDIT: The second issue you mentioned, you said you closed then reopened Ubuntu WSL and got the following:

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Again, I'm not familiar with WSL but I would imagine that this (closing and reopening) is like a reboot of the system? Annoyingly, when Docker is installed, despite installing init scripts, it doesn't enable them for boot. So you'll find that after you run sudo service docker start (or sudo systemctl start docker) Docker seems to run fine. Try issuing sudo systemctl enable docker after that to enable the init scripts. I've been caught by this on native Linux too where Docker wouldn't run after a system reboot.

In either case, try to check if Docker is still running after re-opening Ubuntu WLS by issuing sudo systemctl status docker.

Hope that helps!

[jbcpollak]

I just installed Docker For Windows using the WSL2 on Windows 10 Home - would this issue explain why my app in a Docker container barfs with this error:

what():  PThread::start FATAL: Cannot spawn thread. Error code: 11 (Resource temporarily unavailable)

as far as I can tell without cgroups and systemd all the typical tools to raise the thread limits don't exist.

[kishoregv]

The most important part is dockerd will only run on an elevated console (run as Admin) and cgroup should be always mounted before running the docker daemon.

Just highlighting this note. I have missed it initially. Ensure your WSL terminal is running on elevated console

[zolotarev]

For now I can run sudo dockerd in elevated console. No service started properly. ((

[multiplemonomials]

If you are getting "Error creating default "bridge" network: permission denied", this helped: https://stackoverflow.com/a/59671572/7083698

Basically, I needed /etc/docker/daemon.json to have:

{
  "iptables": false,
  "bridge": "none"
}

[microsoft-github-policy-service]

This issue has been automatically closed since it has not had any activity for the past year. If you're still experiencing this issue please re-file this as a new issue or feature request.

Thank you!