Image run exits with the error : unable to install syscall filter: java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed

[bsurnida]

The latest image label (latest, 512: Elasticsearch 5.1.2, Logstash 5.1.2, and Kibana 5.1.2.) exits with the following error.
Is there a workaround or a fix.

waiting for Elasticsearch to be up (27/30)
waiting for Elasticsearch to be up (28/30)
waiting for Elasticsearch to be up (29/30)
waiting for Elasticsearch to be up (30/30)
Couln't start Elasticsearch. Exiting.
Elasticsearch log follows below.
[2017-01-20T16:17:00,336][WARN ][o.e.b.JNANatives ] unable to install syscall filter:
java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:361) ~[elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.JNANatives.trySeccomp(JNANatives.java:215) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Natives.trySeccomp(Natives.java:99) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:176) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:306) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.cli.Command.main(Command.java:88) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:89) [elasticsearch-5.1.2.jar:5.1.2]
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:82) [elasticsearch-5.1.2.jar:5.1.2]
[2017-01-20T16:17:05,212][INFO ][o.e.n.Node ] [] initializing ...
[2017-01-20T16:17:06,662][INFO ][o.e.e.NodeEnvironment ] [W-tGlcj] using [1] data paths, mounts [[/var/lib/elasticsearch (/dev/mapper/vg_centos66x64min-lv_root)]], net usable_space [14.5gb], net total_space [34.9gb], spins? [possibly], types [ext4]
[2017-01-20T16:17:06,662][INFO ][o.e.e.NodeEnvironment ] [W-tGlcj] heap size [1.9gb], compressed ordinary object pointers [true]
[2017-01-20T16:17:06,722][INFO ][o.e.n.Node ] node name [W-tGlcj] derived from node ID [W-tGlcjuRMie2O_gAbt5fg]; set [node.name] to override
[2017-01-20T16:17:06,894][INFO ][o.e.n.Node ] version[5.1.2], pid[64], build[c8c4c16/2017-01-11T20:18:39.146Z], OS[Linux/2.6.32-642.1.1.el6.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/1.8.0_111/25.111-b14]

[spujadas]

This is another of those bootstrap checks that enforces something in version 5 that was previously optional.
Two ways around this:

• Use the image on a Linux kernel/distribution that has CONFIG_SECCOMP* compiled in the kernel.
• Accept the risk of not doing this by setting bootstrap.system_call_filter to false in elasticsearch.yml (see https://www.elastic.co/guide/en/elasticsearch/reference/master/_system_call_filter_check.html).

[jasontedor]

I'm sorry, but this is not correct. Version 5.1.2 of Elasticsearch does not enforce this check and the setting that you referenced does not exist in 5.1.2. There's something else going on here but the logs are incomplete so it's impossible to say what it is.

[spujadas]

@jasontedor Indeed, mix-up on my part between pre-/post-5.2 bootstrap checks.

@bsurnida As per Jason's comment you can ignore my initial comment, which only applies to Elasticsearch from 5.2 onwards (see elastic/elasticsearch#22899 for a more comprehensive discussion).
Could you please post the complete logs for clues as to what's actually causing the error?

[bsurnida]

@spujadas I was getting the error with the 512 label (512: Elasticsearch 5.1.2, Logstash 5.1.2, and Kibana 5.1.2.) on CentOS 6.8 with docker 1.7.1

Please find below the complete logs I have

[bsurnida@dh201 ~]$ cat /etc/redhat-release
CentOS release 6.8 (Final)
[bsurnida@dh201 ~]$ docker --version
Docker version 1.7.1, build 786b29d/1.7.1
[bsurnida@dh201 ~]$ docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS NAMES
6b1aa5b3c453 sebp/elk "/usr/local/bin/star 3 weeks ago Exited (1) 3 weeks ago elk1
[bsurnida@dh201 ~]$ docker logs elk1

• Starting periodic command scheduler cron [ OK ]
• Starting Elasticsearch Server /etc/init.d/elasticsearch: line 129: ulimit: open files: cannot modify limit: Operation not permitted
  sysctl: setting key "vm.max_map_count": Read-only file system
  [fail]
  waiting for Elasticsearch to be up (1/30)
  waiting for Elasticsearch to be up (2/30)
  waiting for Elasticsearch to be up (3/30)
  waiting for Elasticsearch to be up (4/30)
  waiting for Elasticsearch to be up (5/30)
  waiting for Elasticsearch to be up (6/30)
  waiting for Elasticsearch to be up (7/30)
  waiting for Elasticsearch to be up (8/30)
  waiting for Elasticsearch to be up (9/30)
  waiting for Elasticsearch to be up (10/30)
  waiting for Elasticsearch to be up (11/30)
  waiting for Elasticsearch to be up (12/30)
  waiting for Elasticsearch to be up (13/30)
  waiting for Elasticsearch to be up (14/30)
  waiting for Elasticsearch to be up (15/30)
  waiting for Elasticsearch to be up (16/30)
  waiting for Elasticsearch to be up (17/30)
  waiting for Elasticsearch to be up (18/30)
  waiting for Elasticsearch to be up (19/30)
  waiting for Elasticsearch to be up (20/30)
  waiting for Elasticsearch to be up (21/30)
  waiting for Elasticsearch to be up (22/30)
  waiting for Elasticsearch to be up (23/30)
  waiting for Elasticsearch to be up (24/30)
  waiting for Elasticsearch to be up (25/30)
  waiting for Elasticsearch to be up (26/30)
  waiting for Elasticsearch to be up (27/30)
  waiting for Elasticsearch to be up (28/30)
  waiting for Elasticsearch to be up (29/30)
  waiting for Elasticsearch to be up (30/30)
  Couln't start Elasticsearch. Exiting.
  Elasticsearch log follows below.
  [2017-01-19T22:09:38,472][WARN ][o.e.b.JNANatives ] unable to install syscall filter:
  java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
  at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:361) ~[elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.JNANatives.trySeccomp(JNANatives.java:215) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Natives.trySeccomp(Natives.java:99) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:176) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:306) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.cli.Command.main(Command.java:88) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:89) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:82) [elasticsearch-5.1.2.jar:5.1.2]
  [2017-01-19T22:09:41,624][INFO ][o.e.n.Node ] [] initializing ...
  [2017-01-19T22:09:43,656][INFO ][o.e.e.NodeEnvironment ] [W-tGlcj] using [1] data paths, mounts [[/var/lib/elasticsearch (/dev/mapper/vg_centos66x64min-lv_root)]], net usable_space [14.5gb], net total_space [34.9gb], spins? [possibly], types [ext4]
  [2017-01-19T22:09:43,659][INFO ][o.e.e.NodeEnvironment ] [W-tGlcj] heap size [1.9gb], compressed ordinary object pointers [true]
  [2017-01-19T22:09:43,665][INFO ][o.e.n.Node ] node name [W-tGlcj] derived from node ID [W-tGlcjuRMie2O_gAbt5fg]; set [node.name] to override
  [2017-01-19T22:09:43,798][INFO ][o.e.n.Node ] version[5.1.2], pid[66], build[c8c4c16/2017-01-11T20:18:39.146Z], OS[Linux/2.6.32-642.1.1.el6.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/1.8.0_111/25.111-b14]
• Starting periodic command scheduler cron [ OK ]
• Starting Elasticsearch Server /etc/init.d/elasticsearch: line 129: ulimit: open files: cannot modify limit: Operation not permitted
  sysctl: setting key "vm.max_map_count": Read-only file system
  [fail]
  waiting for Elasticsearch to be up (1/30)
  waiting for Elasticsearch to be up (2/30)
  waiting for Elasticsearch to be up (3/30)
  waiting for Elasticsearch to be up (4/30)
  waiting for Elasticsearch to be up (5/30)
  waiting for Elasticsearch to be up (6/30)
  waiting for Elasticsearch to be up (7/30)
  waiting for Elasticsearch to be up (8/30)
  waiting for Elasticsearch to be up (9/30)
  waiting for Elasticsearch to be up (10/30)
  waiting for Elasticsearch to be up (11/30)
  waiting for Elasticsearch to be up (12/30)
  waiting for Elasticsearch to be up (13/30)
  waiting for Elasticsearch to be up (14/30)
  waiting for Elasticsearch to be up (15/30)
  waiting for Elasticsearch to be up (16/30)
  waiting for Elasticsearch to be up (17/30)
  waiting for Elasticsearch to be up (18/30)
  waiting for Elasticsearch to be up (19/30)
  waiting for Elasticsearch to be up (20/30)
  waiting for Elasticsearch to be up (21/30)
  waiting for Elasticsearch to be up (22/30)
  waiting for Elasticsearch to be up (23/30)
  waiting for Elasticsearch to be up (24/30)
  waiting for Elasticsearch to be up (25/30)
  waiting for Elasticsearch to be up (26/30)
  waiting for Elasticsearch to be up (27/30)
  waiting for Elasticsearch to be up (28/30)
  waiting for Elasticsearch to be up (29/30)
  waiting for Elasticsearch to be up (30/30)
  Couln't start Elasticsearch. Exiting.
  Elasticsearch log follows below.
  [2017-01-20T16:17:00,336][WARN ][o.e.b.JNANatives ] unable to install syscall filter:
  java.lang.UnsupportedOperationException: seccomp unavailable: CONFIG_SECCOMP not compiled into kernel, CONFIG_SECCOMP and CONFIG_SECCOMP_FILTER are needed
  at org.elasticsearch.bootstrap.Seccomp.linuxImpl(Seccomp.java:361) ~[elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Seccomp.init(Seccomp.java:630) ~[elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.JNANatives.trySeccomp(JNANatives.java:215) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Natives.trySeccomp(Natives.java:99) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:176) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:306) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:121) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:112) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.cli.SettingCommand.execute(SettingCommand.java:54) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:122) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.cli.Command.main(Command.java:88) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:89) [elasticsearch-5.1.2.jar:5.1.2]
  at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:82) [elasticsearch-5.1.2.jar:5.1.2]
  [2017-01-20T16:17:05,212][INFO ][o.e.n.Node ] [] initializing ...
  [2017-01-20T16:17:06,662][INFO ][o.e.e.NodeEnvironment ] [W-tGlcj] using [1] data paths, mounts [[/var/lib/elasticsearch (/dev/mapper/vg_centos66x64min-lv_root)]], net usable_space [14.5gb], net total_space [34.9gb], spins? [possibly], types [ext4]
  [2017-01-20T16:17:06,662][INFO ][o.e.e.NodeEnvironment ] [W-tGlcj] heap size [1.9gb], compressed ordinary object pointers [true]
  [2017-01-20T16:17:06,722][INFO ][o.e.n.Node ] node name [W-tGlcj] derived from node ID [W-tGlcjuRMie2O_gAbt5fg]; set [node.name] to override
  [2017-01-20T16:17:06,894][INFO ][o.e.n.Node ] version[5.1.2], pid[64], build[c8c4c16/2017-01-11T20:18:39.146Z], OS[Linux/2.6.32-642.1.1.el6.x86_64/amd64], JVM[Oracle Corporation/OpenJDK 64-Bit Server VM/1.8.0_111/25.111-b14]

[spujadas]

sysctl: setting key "vm.max_map_count": Read-only file system
[fail]

Provided that your vm.max_map_count is correctly set (see #92, #99, #113), I believe that this specific issue was corrected by PR #106, which is only available from image 520 onwards.

[andig]

Same SECCOMP problem here trying to run container on Synology DSM.

[spujadas]

@andig (Looking at autopilotpattern/elasticsearch#8) I understand (from https://www.elastic.co/guide/en/elasticsearch/reference/6.0/_system_call_filter_check.html) that the corresponding bootstrap test can be disabled.

[andig]

@spujadas thank you, that's working. I've re-published your image with this setting applied for elasticsearch.yml at https://hub.docker.com/r/andig/syno-elk/. I hope this will make it easier for users without docker experience. If this is not a good idea please let me know.

[spujadas]

@andig Thanks for the update (and I'm fine with the re-published image).

[andig]

For sake of reference I've added a repo with the minimal changes here https://github.com/andig/syno-elk-docker. Thanks @spujadas for providing this image!

[Pietjepuck132]

Thank you for your update, after docker run on synology with the --ulimit nofile=65536:65536 parameter it wll run once, after i stoped it and restart it i get the nofiles error when eleasticsearch is starting. How did you solve this issue ?

[wildone]

just run container with -e bootstrap.system_call_filter=false

don't forget to chown your volumes

sudo chown 1000:1000 /volume1/docker/elasticsearch/logs/
sudo chown 1000:1000 /volume1/docker/elasticsearch/data/