creator-ee v0.5.0+ fail to extract layer on containerd

[Ladicle]

When running v0.5.0 or later container images in a containerd based Kubernetes environment, the runtime fail to extract the image layer.

NOTE: the layer sha256:140b571c2 is https://github.com/ansible/creator-ee/blob/main/Containerfile#L29.

Events:
  Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Normal   Scheduled  30m                   default-scheduler  Successfully assigned default/ee50 to demo-ladicle-w-default-a9d89c28-htgqp
  Normal   Pulling    27m (x4 over 30m)     kubelet            Pulling image "quay.io/ansible/creator-ee:v0.5.0"
  Warning  Failed     27m (x4 over 29m)     kubelet            Error: ErrImagePull
  Warning  Failed     27m (x6 over 29m)     kubelet            Error: ImagePullBackOff
  Normal   BackOff    5m17s (x94 over 29m)  kubelet            Back-off pulling image "quay.io/ansible/creator-ee:v0.5.0"
  Warning  Failed     19s (x10 over 29m)    kubelet            Failed to pull image "quay.io/ansible/creator-ee:v0.5.0": rpc error: code = Unknown desc = failed to pull and unpack image "quay.io/ansible/creator-ee:v0.5.0": failed to extract layer sha256:140b571c235813a8eb5ba7f5f474f8852eef0218d4e5efe99801351d4c76aa6b: operation not permitted: unknown

The same error occurred when executing ctr image pull. The same error occurs in both versions of containerd v1.4.4 and 1.6.4.

$ sudo ctr image pull quay.io/ansible/creator-ee:v0.5.0
...
layer-sha256:1cb646aa85f30788a51b53eda39160008325a7ae05b03050ba8b2726aee91549:    done           |++++++++++++++++++++++++++++++++++++++|
layer-sha256:764ac4e7ad9bfa3a618b07693be79a7fd44b6a2fd35d497a7256458925219d33:    done           |++++++++++++++++++++++++++++++++++++++|
elapsed: 56.0s                                                                    total:  540.1  (9.6 MiB/s)
unpacking linux/amd64 sha256:4d21770ba05e0373ef6506df50eaebcf1586c4dbfffb728f52dfba08eb0dc222...
INFO[0064] apply failure, attempting cleanup             error="failed to extract layer sha256:140b571c235813a8eb5ba7f5f474f8852eef0218d4e5efe99801351d4c76aa6b: operation not permitted: unknown" key="extract-661548272-faQw sha256:f5544d59a150fa51ce83f2fce9214393ff91001ccaaac6405d892a6dbb3ac4c7"
ctr: failed to extract layer sha256:140b571c235813a8eb5ba7f5f474f8852eef0218d4e5efe99801351d4c76aa6b: operation not permitted: unknown

# docker pull works fine.
> sudo docker pull quay.io/ansible/creator-ee:v0.5.0
...
ff3ce4e37203: Pull complete 
be34f4f093fc: Pull complete 
Digest: sha256:4d21770ba05e0373ef6506df50eaebcf1586c4dbfffb728f52dfba08eb0dc222
Status: Downloaded newer image for quay.io/ansible/creator-ee:v0.5.0
quay.io/ansible/creator-ee:v0.5.0
> echo $?
0

[ssbarnea]

Sorry but that is clearly not our bug, docker/podman works fine. I will transfer it to discussions.

[Ladicle]

fixed: containerd/containerd#7094