Application Hosting - Common Problems

Program inside application is getting "permission denied"

Applications are very restricted by default. Start by setting AppArmor and Seccomp profiles to relaxed. If that does not help, consider what capabilities may be required. Some common ones are:

• CAP_NET_BIND_SERVICE: allows binding to a TCP/UDP port < 1024.
• CAP_NET_RAW: allows opening raw sockets.
• CAP_NET_ADMIN: allows managing network interfaces.
• CAP_SETUID/CAP_SETGID: allows setting UID/GID.
• CAP_CHOWN: allows changing file ownership.
• CAP_DAC_OVERRIDE: allows bypassing file permission checks.

CAP_SYS_ADMIN is not recommended to use as it grants many permissions, but for debugging it can be useful. It is also possible to set all capabilities at once.

example:/config/app-hosting/app-testapp/#> capability privileged

Note that the strict AppArmor profile disallows many capabilities.

Program inside application is getting "Function not implemented"

Applications are restricted to a set of allowed syscalls defined in the relaxed and strict profiles. The default action for seccomp filtering is to set an errno when a process tries to do the syscall. The chosen errno is ENOSYS, which translates to "Function not implemented". This is an uncommon error to get and seccomp filtering may be the cause. Verify that this is the case by looking either in the audit log or in syslog. Seccomp denials are logged with information such as PID responsible, executable name as well as which syscall (number) was denied.

No network traffic on shared port/veth

A shared port should receive traffic as long as the cable is plugged in properly.

A veth port must either be added to a VLAN on the host for L2 forwarding to happen, or assigned an IP and routing rules for L3 forwarding.

example:/config/vlan-1#> untagged veth1

No IP address on shared port/veth

An IP address can be acquired through different means. WeOS provides two options as shown below.

example:/config/app-hosting/app-testapp/#> share veth veth1 as eth0 static 10.1.2.3/24
example:/config/app-hosting/app-testapp/#> share veth veth2 as eth1 dhcp

Static IP configures the application's port eth0 with the given IP. DHCP starts a DHCP client in the network namespace on eth1. For DHCP to work properly there must be a DHCP server somewhere on the network, and host veth2 should probably be part of the desired VLAN.

Static and DHCP also works for share port.

When AppArmor or Seccomp is set to strict, one of the methods above must be used. If both are relaxed, it is possible to assign CAP_NET_ADMIN, and possibly CAP_NET_RAW, and have the application itself set up an IP address or manage its own DHCP client.

Unable to assign an image

Application hosting uses labels on the images to assign and seamlessly swap images without reconfiguration. See Application Hosting HowTo.

Application Status: Unknown

The application failed during creation/start. Likely due to misconfiguration. A common cause is that the application startup command does not exist in the application. System logs can usually provide more details on what went wrong.

example:/#> show log

Application Status: Stopped

The application exited with exit code zero, indicating everything went as expected and gracefully shut down. Check app logs to verify. If an application exits with a non-zero exit code it is assumed to be a crash and the application is restarted.

example:/app-hosting/#> show log testapp

Application Status: Bad Signature

This indicates the application failed the signature check on startup. When importing an image in WeOS it will also warn you of this.

Products without Secure Boot can bypass this with the command below. This bypasses signature enforcement for both WeOS and application images. Do not use this in a production environment.

example:/boot/loader/#> allow-untrusted

Virtual products lack a boot loader. Instead, a setting specific for application hosting exists. This is not available on hardware.

example:/config/app-hosting/#> allow-untrusted