Description
While trying to create a kubernetes pod that mounts the host root as the container root, gives the following error.
FATA[0000] starting the container "1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b": rpc error: code = Unknown desc = failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/" to rootfs at "/": create mountpoint for / mount: mountpoint "/home/akhil/Work/dev-config.d/containerd/run/containerd/io.containerd.runtime.v2.task/k8s.io/1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b/rootfs" is on the top of rootfs "/home/akhil/Work/dev-config.d/containerd/run/containerd/io.containerd.runtime.v2.task/k8s.io/1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b/rootfs"
Steps to reproduce the issue
pod.json
{
"metadata": {
"name": "host-mount-pod-root",
"namespace": "default",
"uid": "host-mount-pod-uid",
"attempt": 1
},
"log_directory": "/tmp",
"linux": {
"security_context": {
"privileged": true,
"namespace_options": {
"network": 2
}
},
"cgroup_parent": "/test.slice/sleep-pod.slice"
}
}container.json
{
"metadata": {
"name": "debug-shell"
},
"image": {
"image": "ubuntu:24.04"
},
"command": [
"/bin/bash",
"-c",
"sleep 3600"
],
"mounts": [
{
"container_path": "/",
"host_path": "/",
"readonly": false
}
],
"linux": {
"security_context": {
"privileged": true
}
}
}
}
- Create the pod sandbox
sudo crictl -r /home/akhil/Work/dev-config.d/containerd/run/containerd/containerd.sock runp pod.json
- create the container
sudo crictl -r /home/akhil/Work/dev-config.d/containerd/run/containerd/containerd.sock create <POD_ID from previous step> container.json pod.json
- Start the container
sudo crictl -r /home/akhil/Work/dev-config.d/containerd/run/containerd/containerd.sock start <CONTAINER ID>
FATA[0000] starting the container "1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b": rpc error: code = Unknown desc = failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/" to rootfs at "/": create mountpoint for / mount: mountpoint "/home/akhil/Work/dev-config.d/containerd/run/containerd/io.containerd.runtime.v2.task/k8s.io/1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b/rootfs" is on the top of rootfs "/home/akhil/Work/dev-config.d/containerd/run/containerd/io.containerd.runtime.v2.task/k8s.io/1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b/rootfs"
Describe the results you received and expected
The container was not started with the following error
OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/" to rootfs at "/": create mountpoint for / mount: mountpoint "/home/akhil/Work/dev-config.d/containerd/run/containerd/io.containerd.runtime.v2.task/k8s.io/1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b/rootfs" is on the top of rootfs "/home/akhil/Work/dev-config.d/containerd/run/containerd/io.containerd.runtime.v2.task/k8s.io/1492434d8c56adfa15cbb2a4a861aefe559c1d4c29445961ca5152a8efafd26b/rootfs"
The regression started from d40b343 which fixed CVE-2025-52881
What version of runc are you using?
runc version 1.4.0-rc.1+dev
commit: v1.4.0-rc.1-198-gf29c4df1
spec: 1.3.0
go: go1.24.0
libseccomp: 2.5.3
containerd version
containerd github.com/containerd/containerd/v2 v2.2.0 1c4457e00facac03ce1d75f7b6777a7a851e5c41
Host OS information
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
Host kernel information
Linux am021636 5.15.0-161-generic #171-Ubuntu SMP Sat Oct 11 08:17:01 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
Description
While trying to create a kubernetes pod that mounts the host root as the container root, gives the following error.
Steps to reproduce the issue
pod.json
{ "metadata": { "name": "host-mount-pod-root", "namespace": "default", "uid": "host-mount-pod-uid", "attempt": 1 }, "log_directory": "/tmp", "linux": { "security_context": { "privileged": true, "namespace_options": { "network": 2 } }, "cgroup_parent": "/test.slice/sleep-pod.slice" } }container.json
Describe the results you received and expected
The container was not started with the following error
The regression started from d40b343 which fixed CVE-2025-52881
What version of runc are you using?
runc version 1.4.0-rc.1+dev
commit: v1.4.0-rc.1-198-gf29c4df1
spec: 1.3.0
go: go1.24.0
libseccomp: 2.5.3
containerd version
containerd github.com/containerd/containerd/v2 v2.2.0 1c4457e00facac03ce1d75f7b6777a7a851e5c41
Host OS information
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
Host kernel information
Linux am021636 5.15.0-161-generic #171-Ubuntu SMP Sat Oct 11 08:17:01 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux