-
Notifications
You must be signed in to change notification settings - Fork 124
VScode dev containers seg fault on Intel-based Macs on Docker Desktop 4.41 #7667
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
I have the exact same issue. Also on Intel Mac. Reverting to 4.40.0 and VSCode devcontainers start working again for me. |
I've just hit the same issue with VSCode devcontainers following the Docker Desktop update to 4.41.1 - Intel Mac as well. Can also confirm that downgrading to 4.40.0 (engine 28.0.4) helped me. Linked issues: |
ok thanks guys! can confirm that it works for me again after reverting to 4.40.0. |
I'm the author of the linked issue above. Great to know that there is a workaround, though sadly not an option for me as I am using a corporate laptop and therefore do not have the ability to downgrade Docker. |
It appears a change in how memory protection keys are utilised might have something to do with this. Out of curiosity, I dug into this a bit further using On Docker Desktop 4.41.0, the segmentation fault
The following difference was noticed when the following call was made on 4.40.0:
On 4.40.0, by my understanding, as the functionality is not present, no My intuition would be this has been triggered as a result of the following item listed in the Docker Desktop 4.41.0 release notes under the Bug fixes and enhancements / For all platforms section
Where the actual issue is, I don't know! Some (maybe) useful reading on surrounding topics: |
Looks like this usage of protection keys is in the V8 implementation that Node.js uses. |
Hi folks, Cesar from Docker here. Thanks for filing this issue and the investigation.
Yes that must be the case; in Docker Desktop 4.41, we enabled the Linux mem protection keys mechanism in the Linux VM that Docker Deskop runs. Some container images (e.g., Oracle database images) require that mechanism to be present in the kernel. Nothing wrong with that per-se, since we are only enabling a new functionality in the VM's Linux kernel, which applications can choose to use or not. However the fact that it triggers a segmentation fault in the @krishanjmistry: would it be possible for you to attach a larger portion of the |
Update: Unable to repro with Docker Desktop 4.41 + VScode dev containers on Linux, Mac (ARM CPU), and Windows hosts. For Linux, the strace shows vscode-server using mem protection keys without problem:
For Mac (ARM), the For Windows (Intel CPU, DD with Hyper-V), the strace shows vscode-server failing to allocate a mem protection key, but the error is ignored as the VS code dev container works properly:
Thus the problem appears to be specific to Mac + Intel chip. |
As requested @ctalledo very long log here
Alternatively, here's a log file |
I have swapped VMM to HyperKit from Apple Virtualization framework and I am now up and running (more slowly) on the latest release v4.41.2 on Intel Mac. |
Thanks @krishanjmistry for the vscode-server logs. I looked at them and it's clear the segmentation fault occurs as soon as the mem protection key is enabled:
Since the second statement enabled read/write/execute on the mem page at
That's a key observation: it means the problem is in the VMM virtualization layer, on Intel Macs only. We will investigate more. @krishanjmistry, @drob0362, @wh807: can you please check if configuring Docker Desktop with "Apple Virtualization" via Settings -> General -> Virtual Machine Options makes the problem go away? Thanks all for the help! |
Just to clarify... For me with v4.41.2 on Mac Intel. VMM set to 'Apple Virtualization framework' is not working. (segmentation fault) |
I've just updated to 4.41.2. No issues (so far) with |
Docker desktop v4.41.2 on Mac Intel. |
Hi folks, based on the feedback above, it's clear this is a problem with the Apple Virtualization framework, on Intel Macs, when using the Linux kernel mem protection keys mechanism (enabled in Docker Desktop 4.41). We will follow-up with Apple on this. In the meantime, Docker Desktop 4.42 (upcoming release) will revert the change that triggered this problem in Docker Desktop 4.41. For folks on Docker Desktop 4.41, on Intel-based Macs, that are hitting this problem: Please either downgrade to v4.40 or disable Apple Virtualization framework (use HyperKit). Docker Desktop 4.42 will not have this issue. |
Description
After updating to Docker Desktop 4.41.0, I was unable to connect via vscode. I'm on Intel Mac. The VSCode server says "an error occurred attaching to the container".
Things I have tried:
reinstall the vscode server and re-attach, does not work
rm -rf /home/.vscode-server
Please take a look and let me know if you need more info. It was working the day before yesterday before I installed the new docker desktop update. Are there files or bugs that are incompatible with VSCode server after the update?
Reproduce
Run the container and try to connect from VSCode "attach to running container"
Expected behavior
should have connected vscode to container
docker version
Client: Version: 28.1.1 API version: 1.49 Go version: go1.23.8 Git commit: 4eba377 Built: Fri Apr 18 09:49:45 2025 OS/Arch: darwin/amd64 Context: desktop-linux Server: Docker Desktop 4.41.0 (190950) Engine: Version: 28.1.1 API version: 1.49 (minimum version 1.24) Go version: go1.23.8 Git commit: 01f442b Built: Fri Apr 18 09:52:57 2025 OS/Arch: linux/amd64 Experimental: false containerd: Version: 1.7.27 GitCommit: 05044ec0a9a75232cad458027ca83437aae3f4da runc: Version: 1.2.5 GitCommit: v1.2.5-0-g59923ef docker-init: Version: 0.19.0 GitCommit: de40ad0
docker info
Diagnostics ID
5F4BCBFA-FF30-4767-BFDE-5F98047BC754/20250430194123
Additional Info
...
[2605 ms] Start: Run in container: mkdir -p '/tmp/devcontainers-a20e0c5c-8f8a-4556-9073-14da83e78bb61746040830209' && cat > '/tmp/devcontainers-a20e0c5c-8f8a-4556-9073-14da83e78bb61746040830209/env-loginInteractiveShell.json' << 'envJSON'
[2613 ms]
[2613 ms]
[2748 ms] Segmentation fault
[2771 ms] Command failed: /home/user/.vscode-server/bin/17baf841131aa23349f217ca7c570c76ee87b957/bin/code-server --log debug --force-disable-user-env --server-data-dir /home/user/.vscode-server --use-host-proxy --telemetry-level all --accept-server-license-terms --host 127.0.0.1 --port 0 --connection-token-file /home/user/.vscode-server/data/Machine/.connection-token-17baf841131aa23349f217ca7c570c76ee87b957 --extensions-download-dir /home/user/.vscode-server/extensionsCache --start-server --disable-websocket-compression --skip-requirements-check
[2771 ms] Segmentation fault
[2771 ms] Exit code 139
[12306 ms] Extensions cache, remote removals: None
[72313 ms] Extensions cache, remote removals: None
[132325 ms] Extensions cache, remote removals: None
...
The text was updated successfully, but these errors were encountered: