docker desktop 4.16.0 fails to run sudo in non-root containers

[liayn]

• I have tried with the latest version of Docker Desktop
• I have tried disabling enabled experimental features
• I have uploaded Diagnostics
• Diagnostics ID: A076DA47-F50C-48FC-80E0-1AA7BB837A27/20230112234856

Actual behavior

docker run -it --rm -u 33:33 drud/ddev-webserver:v1.21.4 sudo ls

sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?

See also ddev/ddev#4551

Expected behavior

docker run -it --rm -u 33:33 drud/ddev-webserver:v1.21.4 sudo ls
should output the same as
docker run -it --rm -u 33:33 drud/ddev-webserver:v1.21.4 ls

which is:

bin dev healthcheck.sh lib media opt root sbin start.sh tmp var
boot etc home lib64 mnt proc run srv sys usr

Information

• Windows Version: 10 (also Mac)
• Docker Desktop Version: 4.16.0
• WSL2 or Hyper-V backend? WSL2 (but also Hyper-V)
• Are you running inside a virtualized Windows e.g. on a cloud server or a VM: no

Output of & "C:\Program Files\Docker\Docker\resources\com.docker.diagnose.exe" check

Only a warning about overlapping IPs. No fatal errors.

[rfay]

Docker for Mac report:

• Docker Desktop 4.16.0 can't use sudo inside container (nosuid base filesystem?) for-mac#6675

[mat007]

Thank you for reporting this issue.
We are investigating it, and will very likely release a 4.16.1 version of Docker Desktop when we have a fix.

[alexey-kuznetsov]

I spent half a day trying to figure out why my containers permanently fail. Downgrading Docker desktop to 4.15.0 solved problem. I have to uninstall Docker Desktop and then install older version.

[thaJeztah]

The team performed a git bisect, and found the commit that introduced it; fully reverting that commit likely isn't an option, but they're working on a fix.

[mat007]

Closing this issue because a fix has been released in Docker Desktop 4.16.1. See the release notes for more details.

[docker-robott]

Closed issues are locked after 30 days of inactivity.
This helps our team focus on active issues.

If you have found a problem that seems similar to this, please open a new issue.

/lifecycle locked