Today I installed membrane on a new macOS machine and ran into issues during the install process. The "basic startup" smoke test failed in a way I hadn't seen before. Used Claude to dig in and was able to fix it. Summary below.
Docker 29.5.0 changed the default OCI container spec to include a private time namespace on kernels that support it (moby/moby#52326). Sysbox-runc doesn't support the time namespace type, so any container run with --runtime=sysbox-runc fails at creation:
docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: namespace {"time" ""} does not exist
Hit this on a fresh Colima VM (Ubuntu 24.04, kernel 6.8.0-117-generic) after install-linux.sh installed and registered Sysbox — smoke Test 1 (basic startup) fails every time.
Also tracked upstream: nestybox/sysbox#1011 (same error, no fix from Nestybox side as of this writing).
To fix: Docker 29.5.0 added a feature flag to disable time namespaces and restore the pre-29.5.0 default (moby/moby#52577). Setting it in /etc/docker/daemon.json and restarting Docker resolves it:
{
"features": {
"time-namespaces": false
}
}sudo systemctl restart docker
After that, docker run --rm --runtime=sysbox-runc alpine:3.21 uname -r succeeds.
As a to-do, perhaps have install-linux.sh merge "features": {"time-namespaces": false} into daemon.json automatically, the same way it already merges the sysbox-runc runtime entry, so this doesn't bite new installs on Docker ≥29.5.0.
Today I installed membrane on a new macOS machine and ran into issues during the install process. The "basic startup" smoke test failed in a way I hadn't seen before. Used Claude to dig in and was able to fix it. Summary below.
Docker 29.5.0 changed the default OCI container spec to include a private
timenamespace on kernels that support it (moby/moby#52326). Sysbox-runc doesn't support thetimenamespace type, so any container run with--runtime=sysbox-runcfails at creation:Hit this on a fresh Colima VM (Ubuntu 24.04, kernel 6.8.0-117-generic) after
install-linux.shinstalled and registered Sysbox — smoke Test 1 (basic startup) fails every time.Also tracked upstream: nestybox/sysbox#1011 (same error, no fix from Nestybox side as of this writing).
To fix: Docker 29.5.0 added a feature flag to disable time namespaces and restore the pre-29.5.0 default (moby/moby#52577). Setting it in
/etc/docker/daemon.jsonand restarting Docker resolves it:{ "features": { "time-namespaces": false } }After that,
docker run --rm --runtime=sysbox-runc alpine:3.21 uname -rsucceeds.As a to-do, perhaps have
install-linux.shmerge"features": {"time-namespaces": false}intodaemon.jsonautomatically, the same way it already merges thesysbox-runcruntime entry, so this doesn't bite new installs on Docker ≥29.5.0.