Allowing memlock unlimited in rootless podman.

[GamePlayer-8]

Hello,

How to make rootless podman containers have a privilege to utilize memlock / IPC_LOCK? I'm trying to run Hashicorp Vault inside such environment but I'm getting:

Error initializing core: Failed to lock memory: cannot allocate memory

This usually means that the mlock syscall is not available.
Vault uses mlock to prevent memory from being swapped to
disk. This requires root privileges as well as a machine
that supports mlock. Please enable mlock on your system or
disable Vault from using it. To disable Vault from using it,
set the `disable_mlock` configuration option in your configuration
file.

My current ulimit values on host user are as follows:

~ > ulimit -a
real-time non-blocking time  (microseconds, -R) unlimited
core file size              (blocks, -c) 0
data seg size               (kbytes, -d) unlimited
scheduling priority                 (-e) 0
file size                   (blocks, -f) unlimited
pending signals                     (-i) 60074
max locked memory           (kbytes, -l) 8192
max memory size             (kbytes, -m) unlimited
open files                          (-n) 1024
pipe size                (512 bytes, -p) 8
POSIX message queues         (bytes, -q) 819200
real-time priority                  (-r) 0
stack size                  (kbytes, -s) 8192
cpu time                   (seconds, -t) unlimited
max user processes                  (-u) 60074
virtual memory              (kbytes, -v) unlimited
file locks                          (-x) unlimited

Can memlock work under podman rootless?

[giuseppe]

you can try raising the limit with --ulimit memlock=SOFT:HARD but it can't go higher than the hard limit for your user on the host.

Are you using a custom seccomp profile? If so, you may need to add mlock to the list of allowed syscalls, it is allowed in the default configuration though

[GamePlayer-8]

how do I raise limit on the user host?

[giuseppe]

in /etc/systemd/system.conf

[GamePlayer-8]

how it is on openrc?

[giuseppe]

look under /etc/security/limits.d

[GamePlayer-8]

I've added:

vault soft memlock unlimited
vault hard memlock unlimited

in /etc/security/limits.d/99-vault.conf but whenever I login using su -l vault or sudo -u vault -i, ulimit -l still shows 8192 value instead of unlimited.