"502 Bad Gateway" if I switch to the krun runtime

[user451421541757324]

I'm trying to get this simple setup to work with krun. It works fine with crun, but as soon as I switch runtime (setting /etc/containers/containers.conf), I get a 502 Bad Gateway error.

podman pull docker.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
podman pull ghcr.io/silvenga/redlib:0
systemctl --user daemon-reload
systemctl --user start redlib
systemctl --user start nginx

The containers start up correctly but are effectively unusable. I've tried this on two different operating systems (Manjaro and Arch Linux).

demo.nework:

[Network]
Driver=bridge

redlib.container:

[Unit]
After=network-online.target demo.network
Wants=network-online.target

[Container]
ContainerName=redlib
Image=ghcr.io/silvenga/redlib:0
Network=demo.network

[Install]
WantedBy=default.target

nginx.container:

[Unit]
After=network-online.target redlib.service demo.network
Wants=network-online.target

[Container]
ContainerName=nginx
Image=docker.io/nginxinc/nginx-unprivileged:mainline-alpine-slim
Network=demo.network
PublishPort=8081:8081

Volume=%h/Contenitori/Nginx/proxy.conf:/etc/nginx/nginx.conf:ro,Z

[Install]
WantedBy=default.target

nginx.conf:

pid /tmp/nginx.pid;

events {
    worker_connections 2048;
    use epoll;
    multi_accept on;
}

http {
    proxy_temp_path /tmp/proxy_temp;
    client_body_temp_path /tmp/client_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;

    server {
        listen 8081;
        server_name _;

        client_body_timeout 8s;
        client_header_timeout 8s;
        send_timeout 8s;

        location / {
            proxy_pass http://redlib:8080;
        }
    }
}

I tried a few other things, like switching between pasta and slirp4netns, but it still didn't work.

As I said, it must be krun's fault, because everything works fine without it.

[slp]

@user451421541757324 Please give containers/libkrunfw#126 a try if you have the opportunity.

[user451421541757324]

Hello.

Unfortunately, I'm not very familiar with compiling libkrun/libkrunfw. I grabbed the AUR package and pointed it to your fork with the new patches. That's how I got it "working" on Manjaro.

I'm explaining how I installed it because I ran into a problem: the Redlib container couldn't connect to the internet triggering the health check and stopping shortly after.

Again, I don’t know if it’s because of the new patches or the ugly way I installed it.

[jakecorrenti]

Hi @user451421541757324,

If you follow the directions to build libkrunfw: https://github.com/containers/libkrunfw#building it's fairly simple.

Then you can build libkrun from source following the directions in the README.md file.

From there, to verify everything works you can run a quick example:

cd libkrun/examples
make rootfs
make chroot_vm
LD_LIBRARY_PATH=/usr/local/lib64 ./chroot_vm ./rootfs_fedora cat /etc/os-release

Once you're able to verify that works, you should be able to get krun to use the libkrun you built from source using the LD_LIBRARY_PATH.

If you need help feel free to ask questions.

[user451421541757324]

the Redlib container couldn't connect to the internet triggering the health check and stopping shortly after

Turns out that the installation was correct and that the error was likely caused by the patch.

This time I performed a proper installation following @jakecorrenti's advice, but the error persists.

I tried switching containers to docker.io/quintuple4417/rimgo, and the behavior changed slightly: the proxy works, no longer returns a 502 error, but the connection from the container (rimgo) to the internet is extremely slow. It took a full minute to load a page.

If I start the same container separately as usual, without a proxy, it works fine, and the internet connection is fast.

To be sure, I ran another test with docker.io/nesaku/biblioreads, and the problem persists: the proxy now works, but the internet is slow.

Tested on Manjaro XFCE live (with fuse-overlayfs, I don't know if this is important, but I'm mentioning it for the sake of completeness.)

[user451421541757324]

I also tested it on Garuda XFCE Live, and the problem occurs there as well.