Compose up command fails with an error error setting rlimits for ready process

[monirul]

Description

nerdctl compose up command fails to run containers when memlock is set in yml file

   ulimits:
      memlock:
        soft: -1 # Set memlock to unlimited (no soft or hard limit)
        hard: -1

Original error msg:
The compose command showed following error msg.
FATA[0000] error while creating container opensearch-node2: exit status 1

Underlying error msg:
While debugging, I printed the underlying error msg and it shows following error:
FATA[0000] failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error setting rlimits for ready process: error setting rlimit type 8: operation not permitted: unknown.

If i remove the memlock from the yml file then compose command works.

      memlock:
        soft: -1 # Set memlock to unlimited (no soft or hard limit)
        hard: -1

Steps to reproduce the issue

1. curl -O https://raw.githubusercontent.com/opensearch-project/documentation-website/2.5/assets/examples/docker-compose.yml
2. limactl shell
3. nerdctl compose up

Describe the results you received and expected

Received output:

$ nerdctl compose up --debug-full
DEBU[0000] stateDir: /run/user/504/containerd-rootless
DEBU[0000] rootless parent main: executing "/usr/bin/nsenter" with [-r/ -w/Users/monirulu/washington-compose/git-issue-186 --preserve-credentials -m -n -U -t 1859 -F nerdctl compose up --debug-full]
DEBU[0000] printing project JSON
DEBU[0000] {
    "name": "git-issue-186",
    "services": {
        "opensearch-dashboards": {
            "command": null,
            "container_name": "opensearch-dashboards",
            "entrypoint": null,
            "environment": {
                "OPENSEARCH_HOSTS": "[\"https://opensearch-node1:9200\",\"https://opensearch-node2:9200\"]"
            },
            "expose": [
                "5601"
            ],
            "image": "opensearchproject/opensearch-dashboards:latest",
            "networks": {
                "opensearch-net": null
            },
            "ports": [
                {
                    "mode": "ingress",
                    "target": 5601,
                    "published": "5601",
                    "protocol": "tcp"
                }
            ]
        },
        "opensearch-node1": {
            "command": null,
            "container_name": "opensearch-node1",
            "entrypoint": null,
            "environment": {
                "OPENSEARCH_JAVA_OPTS": "-Xms512m -Xmx512m",
                "bootstrap.memory_lock": "true",
                "cluster.initial_cluster_manager_nodes": "opensearch-node1,opensearch-node2",
                "cluster.name": "opensearch-cluster",
                "discovery.seed_hosts": "opensearch-node1,opensearch-node2",
                "node.name": "opensearch-node1"
            },
            "image": "opensearchproject/opensearch:latest",
            "networks": {
                "opensearch-net": null
            },
            "ports": [
                {
                    "mode": "ingress",
                    "target": 9200,
                    "published": "9200",
                    "protocol": "tcp"
                },
                {
                    "mode": "ingress",
                    "target": 9600,
                    "published": "9600",
                    "protocol": "tcp"
                }
            ],
            "ulimits": {
                "memlock": {
                    "soft": -1,
                    "hard": -1
                },
                "nofile": {
                    "soft": 65536,
                    "hard": 65536
                }
            },
            "volumes": [
                {
                    "type": "volume",
                    "source": "opensearch-data1",
                    "target": "/usr/share/opensearch/data",
                    "volume": {}
                }
            ]
        },
        "opensearch-node2": {
            "command": null,
            "container_name": "opensearch-node2",
            "entrypoint": null,
            "environment": {
                "OPENSEARCH_JAVA_OPTS": "-Xms512m -Xmx512m",
                "bootstrap.memory_lock": "true",
                "cluster.initial_cluster_manager_nodes": "opensearch-node1,opensearch-node2",
                "cluster.name": "opensearch-cluster",
                "discovery.seed_hosts": "opensearch-node1,opensearch-node2",
                "node.name": "opensearch-node2"
            },
            "image": "opensearchproject/opensearch:latest",
            "networks": {
                "opensearch-net": null
            },
            "ulimits": {
                "memlock": {
                    "soft": -1,
                    "hard": -1
                },
                "nofile": {
                    "soft": 65536,
                    "hard": 65536
                }
            },
            "volumes": [
                {
                    "type": "volume",
                    "source": "opensearch-data2",
                    "target": "/usr/share/opensearch/data",
                    "volume": {}
                }
            ]
        }
    },
    "networks": {
        "default": {
            "name": "git-issue-186_default",
            "ipam": {},
            "external": false
        },
        "opensearch-net": {
            "name": "git-issue-186_opensearch-net",
            "ipam": {},
            "external": false
        }
    },
    "volumes": {
        "opensearch-data1": {
            "name": "git-issue-186_opensearch-data1",
            "external": false
        },
        "opensearch-data2": {
            "name": "git-issue-186_opensearch-data2",
            "external": false
        }
    }
}
INFO[0000] Creating network git-issue-186_opensearch-net
DEBU[0000] Creating network args: [--label=com.docker.compose.project=git-issue-186 --label=com.docker.compose.network=opensearch-net git-issue-186_opensearch-net]
DEBU[0000] Running [/usr/local/bin/nerdctl --debug-full=true network create --label=com.docker.compose.project=git-issue-186 --label=com.docker.compose.network=opensearch-net git-issue-186_opensearch-net]
INFO[0000] Creating network git-issue-186_default
DEBU[0000] Creating network args: [--label=com.docker.compose.project=git-issue-186 --label=com.docker.compose.network=default git-issue-186_default]
DEBU[0000] Running [/usr/local/bin/nerdctl --debug-full=true network create --label=com.docker.compose.project=git-issue-186 --label=com.docker.compose.network=default git-issue-186_default]
WARN[0000] Ignoring: service opensearch-dashboards: [Expose]
INFO[0000] Ensuring image opensearchproject/opensearch:latest
INFO[0000] Ensuring image opensearchproject/opensearch-dashboards:latest
INFO[0000] Ensuring image opensearchproject/opensearch:latest
DEBU[0000] filters: [labels."com.docker.compose.project"==git-issue-186,labels."com.docker.compose.service"==opensearch-node2]
INFO[0000] Creating container opensearch-node2
DEBU[0000] Running [/usr/local/bin/nerdctl --debug-full=true run --cidfile=/tmp/compose-1379803671/cid -l=com.docker.compose.project=git-issue-186 -l=com.docker.compose.service=opensearch-node2 -d --name=opensearch-node2 --pull=never -e=discovery.seed_hosts=opensearch-node1,opensearch-node2 -e=cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2 -e=bootstrap.memory_lock=true -e=OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m -e=cluster.name=opensearch-cluster -e=node.name=opensearch-node2 --net=git-issue-186_opensearch-net --hostname=opensearch-node2 --ulimit=memlock=-1:-1 --ulimit=nofile=65536:65536 --restart=no -v=git-issue-186_opensearch-data2:/usr/share/opensearch/data opensearchproject/opensearch:latest]
FATA[0000] error while creating container opensearch-node2: exit status 1

Expected output:
The compose command should run the containers without any error.

What version of nerdctl are you using?

nerdctl version
Client:
Version: v1.1.0-245-g4293ca4
OS/Arch: linux/amd64
Git commit: 4293ca4
buildctl:
Version: v0.10.6
GitCommit: 0c9b5aeb269c740650786ba77d882b0259415ec7

Server:
containerd:
Version: v1.6.12
GitCommit: a05d175400b1145e5e6a735a6710579d181e7fb0
runc:
Version: 1.1.4
GitCommit: v1.1.4-0-g5fd4c4d1

Are you using a variant of nerdctl? (e.g., Rancher Desktop)

Lima

Host information

nerdctl info
Client:
 Namespace:	default
 Debug Mode:	false

Server:
 Server Version: v1.6.12
 Storage Driver: overlayfs
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Log: fluentd journald json-file syslog
  Storage: native overlayfs fuse-overlayfs stargz
 Security Options:
  apparmor
  seccomp
   Profile: default
  cgroupns
  rootless
 Kernel Version: 5.19.0-29-generic
 Operating System: Ubuntu 22.10
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 3.825GiB
 Name: lima-nerd-env
 ID: cab833bd-4aae-46af-8392-dc211499b9db

WARNING: AppArmor profile "nerdctl-default" is not loaded.
         Use 'sudo nerdctl apparmor load' if you prefer to use AppArmor with rootless mode.
         This warning is negligible if you do not intend to use AppArmor.
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled

[AkihiroSuda]

Expected behavior for rootless mode.
Please use sudo nerdctl with sudo systemctl enable --now containerd.