docker warnings on a self-hosted linux runner

Question

When I look at the pipeline running on a self-hosted bitbucket runner I see this log on the Docker tab:

cat: can't open '/proc/net/arp_tables_names': No such file or directory iptables v1.8.10 (nf_tables) time="2025-02-17T15:53:44.002851089Z" level=warning msg="Binding to IP address without --tlsverify is insecure and gives root access on this machine to everyone who has access to your network." host="tcp://0.0.0.0:2375" time="2025-02-17T15:53:44.002913139Z" level=warning msg="Binding to an IP address, even on localhost, can also give access to scripts run in a browser. Be safe out there!" host="tcp://0.0.0.0:2375" time="2025-02-17T15:53:45.064758635Z" level=warning msg="failed to load plugin io.containerd.snapshotter.v1.devmapper" error="devmapper not configured" time="2025-02-17T15:53:45.074749490Z" level=warning msg="could not use snapshotter devmapper in metadata plugin" error="devmapper not configured" time="2025-02-17T15:53:46.105151632Z" level=warning msg="Running modprobe bridge br_netfilter failed with message: ip: can't find device 'bridge'
bridge 172032 1 br_netfilter
stp 16384 1 bridge
llc 16384 2 bridge,stp
ip: can't find device 'br_netfilter'
br_netfilter 24576 0 
bridge 172032 1 br_netfilter
modprobe: can't change directory to '/lib/modules': No such file or directory
, error: exit status 1" time="2025-02-17T15:53:47.654207153Z" level=warning msg="WARNING: API is accessible on http://0.0.0.0:2375 without encryption.
 Access to the remote API is equivalent to root access on the host. Refer
 to the 'Docker daemon attack surface' section in the documentation for
 more information: https://docs.docker.com/go/attack-surface/" time="2025-02-17T15:53:47.654257691Z" level=warning msg="WARNING: bridge-nf-call-iptables is disabled" time="2025-02-17T15:53:47.654266133Z" level=warning msg="WARNING: bridge-nf-call-ip6tables is disabled"

Should I worry, or is it safe to ignore these warnings?

이제혁 · Answer

Hi~ @Pavel Ponomaryov 
Thank yoy for your reply!

We are trying to run the
runner on an Advantech Orin DevKit machine with Nvidia Jetson 6.0.
The machine is an arm64 architecture machine, and both docker client/server and runner versions are up to date.

When we run the runner,
Service 'docker' exited with exit code: 1.
If we go to the docker tab, we get this error
failed to start daemon: Error initializing network controller: error obtaining controller instance: failed to register "bridge" driver: invalid argument

To analyze this error, I traced the bitbucket runner's execution and found myself digging through the I had left behind thread.
After leaving the question open, I ran the runner on an AWS EC2 arm64 machine and found that the runner worked fine.

However, the nvidia container toolkit integration build is still failing, so we need the runner to run successfully on the Orin DevKit machine.
My guess is that there is some issue between the Jetson 6.0 custom Kernel (provided by Nvidia) environment installed in Orin DevKit and running the bitbucket runner.

Patrik S · Answer

Hey @이제혁 ,

I wasn't able to reproduce the issue using a linux docker arm64 runner version 3.16.

In this case, I'd like to ask you a couple of questions:

* Where are you executing the runner ? Are you using the default provided command or making any change to it? 
* Does the host machine meets the requirements below ? * Linux with ARM architecture and a Linux kernel v4.0.0+

* Docker v19.03 and above - Install Docker

* Is your runner using the most recent version (3.16 by the time I write this message ? If not, can you try updating your runner and trying again ?

이제혁 · Answer

@Patrik S Hi~
We are experiencing a similar issue,
In our case, we are getting this error,
The build step is not running at all.

Service 'docker' exited with exit code: 1.

We are running the runner self hosted on linux arm64 and found that the bitbucket runner is running the bitbucket-pipelines-docker-daemon:v25.0.5-tlsfalse-prod-stable image.

When I looked inside bitbucket-pipelines-docker-daemon:v25.0.5-tlsfalse-prod-stable, I found that it is running as root, and it is supposed to try to mount (inside the runit.sh -> dockerd-entrypoint.sh -> dind script), but  the runner is not running in privileged mode when it runs that container, so the mount command fails and this causes the exit.
The mount command fails and because of this, the pipeline is not running properly due to the exit 1 error code.

How do I get it to run normally?