"Signal 11: Segmentation fault" error after switching PostgreSQL Alpine image to Debian with upgrade from 12.3 to 12.6

Viewed 1081

I have a PostgreSQL database for some sensoric data on my Raspberry Pi. It runs on the postgres:12-alpine tag without automatic updates yet. Before the update, I got the following version string:

('PostgreSQL 12.3 on arm-unknown-linux-musleabihf, compiled by gcc (Alpine 9.3.0) 9.3.0, 32-bit',)

After I noticed that it was a bit out of date, I pulled the latest image with the following version string:

('PostgreSQL 12.6 on arm-unknown-linux-musleabihf, compiled by gcc (Alpine 10.2.1_pre1) 10.2.1 20201203, 32-bit',)

This worked, but I noticed that new inserted sensor data got a timestamp from 2038 when using NOW(). It seems complicated to solve with Alpine, maybe also an Alpine issue. I already had trouble with issues created by their musl usage. Since the normal image is not too much larger (109MB vs 62MB), I switched to the regular postgres:12 image.

Since the container was started with the normal Debian image, the startup failed:

postgres_1  | PostgreSQL Database directory appears to contain a database; Skipping initialization
postgres_1  |
postgres_1  | 2021-03-31 17:00:05.213 UTC [1] LOG:  starting PostgreSQL 12.3 on arm-unknown-linux-musleabihf, compiled by gcc (Alpine 9.3.0) 9.3.0, 32-bit
postgres_1  | 2021-03-31 17:00:05.214 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1  | 2021-03-31 17:00:05.214 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1  | 2021-03-31 17:00:05.226 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1  | 2021-03-31 17:00:11.083 UTC [1] LOG:  startup process (PID 20) was terminated by signal 11: Segmentation fault
postgres_1  | 2021-03-31 17:00:11.084 UTC [1] LOG:  aborting startup due to startup process failure
postgres_1  | 2021-03-31 17:00:14.480 UTC [1] LOG:  database system is shut down
pms_postgres_1 exited with code 1

Same issue with the Debian image:

postgres_1  | PostgreSQL Database directory appears to contain a database; Skipping initialization
postgres_1  |
postgres_1  | 2021-03-31 17:11:19.733 UTC [1] LOG:  starting PostgreSQL 12.3 (Debian 12.3-1.pgdg100+1) on arm-unknown-linux-gnueabihf, compiled by gcc (Debian 8.3.0-6) 8.3.0, 32-bit
postgres_1  | 2021-03-31 17:11:19.738 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1  | 2021-03-31 17:11:19.738 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1  | 2021-03-31 17:11:19.752 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1  | 2021-03-31 17:11:28.520 UTC [1] LOG:  startup process (PID 27) was terminated by signal 11: Segmentation fault
postgres_1  | 2021-03-31 17:11:28.520 UTC [1] LOG:  aborting startup due to startup process failure
postgres_1  | 2021-03-31 17:11:35.024 UTC [1] LOG:  database system is shut down
pms_postgres_1 exited with code 1

It's also not working with the latest 12.6 release. I'm assuming that the problem was, I switched from Alpine to Debian AND also updated the PostgreSQL version with the pull. So PSQL 12.3 on Alpine was upgraded to PSQL 12.6 on Debian.

Why does this Segmentation fault error occur and how can I fix it?

My docker-compose.yml:

version: '2.4'
volumes:
  #postgres-data_new:
  postgres-data:

services:
  postgres:
    image: postgres:12.6
    #image: postgres:12.3-alpine
    #image: postgres:12-alpine
    restart: always
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./create-tables.sql:/docker-entrypoint-initdb.d/create-tables.sql
    environment:
      POSTGRES_PASSWORD: xx
      POSTGRES_DB: xxx
    ports:
      - 5432:5432

create-tables.sql just creates a very basic measure data table:

create table if not exists sensors(
    id SERIAL PRIMARY KEY,
    soilMoisture NUMERIC NOT NULL,
    temp NUMERIC NOT NULL,
    dateTime timestamp NOT NULL
);
1 Answers

It seems that the problem is an outdated libseccomp version on the host: libseccomp 2.4.2 or newer and Docker to 19.03.9 or newer are required. But my RPI has just 2.3.3 from the repos:

# dpkg -l | grep libseccomp
ii  libseccomp2:armhf                   2.3.3-4                             armhf        high level interface to Linux seccomp filter

There are two ways to fix this, but only for new containers with fresh volumes. I still couldn't get my existing database from the volume working with that.

#1 Install a newer version manually and bypass the package manager

At least until the repos got updated. I guess this will happen after some time, then we can use the version provided by Raspbians repos again.

wget http://ftp.us.debian.org/debian/pool/main/libs/libseccomp/libseccomp2_2.5.1-1_armhf.deb
sudo dpkg -i libseccomp2_2.5.1-1_armhf.deb

#2 Disable it in docker-compose.yml as workaround

security_opt:
  - seccomp:unconfined

But this will reduce the security of the host against malicious code in the container, so updating the library seems to be a more secure solution.

Related