systemctl daemon-reload interferes with docker's access to /dev/pts/0

[ion1]

Describe the bug
The version of runc in Fedora CoreOS 36.20220918.3.0 seems to suffer from the bug fixed in [1.1] Fix failed exec after systemctl daemon-reload (regression in 1.1.3) which was released in runc 1.1.4.

Reproduction steps

$ docker run -d --rm --name test alpine sleep 1m
615a522f28ad6751139f4ff757378605d136c582b6368cefa860ffccfd4f9b7a
$ docker exec -it test echo hello
hello
$ sudo systemctl daemon-reload
$ docker exec -it test echo hello
OCI runtime exec failed: exec failed: unable to start container process: open /dev/pts/0: operation not permitted: unknown

Expected behavior
I expect both docker exec invocations to work identically.

Actual behavior
Docker fails to access /dev/pts/0 after systemctl daemon-reload has been run.

System details

• Bare metal
• Fedora CoreOS 36.20220918.3.0

Ignition config

Butane file

variant: fcos
version: 1.4.0
passwd:
  users:
    - name: core
      password_hash: x
      ssh_authorized_keys:
        - x
storage:
  files:
    - path: /etc/hostname
      mode: 0644
      contents:
        inline: x

Additional information
N/A

[dustymabe]

Yep, The current version in Fedora is 1.1.3 (see https://src.fedoraproject.org/rpms/runc). Looks like 1.1.4 came out a few months ago.

[copperii]

Made a PR on update.

[dustymabe]

Thanks so much @copperii!

[tkarls]

Whats the status of this. Still the 1.1.3 version is present in all release streams (stable/testing/next).
When can we expect 1.1.4 to be availible?

[dustymabe]

The answer is slightly complicated because of the likely Fedora 37 major release coming up next week. It will almost certainly be in the next stream release next week. Whether or not it's in the testing stream release depends on if the 37 major rebase happens at that time or not. See the design doc for more info on that.

Either way. This issue will be updated when it lands in a release.

If you want to try it out today you can grab the latest testing-devel build from https://builds.coreos.fedoraproject.org/browser?stream=testing-devel&arch=x86_64

[dustymabe]

Sorry I had lost track of this one. This landed in the F36 RPM runc-1.1.4-1.fc36.x86_64 and the F37 RPM runc-1.1.4-1.fc37.x86_64.

[dustymabe]

The fix for this went into next stream release 37.20221031.1.0. Please try out the new release and report issues.

[dustymabe]

The fix for this went into testing stream release 36.20221030.2.1. Please try out the new release and report issues.

[dustymabe]

The fix for this went into stable stream release 36.20221030.3.0.