influxdb3-core fails to start on Rocky Linux 9/10 - systemd InaccessiblePaths causes NAMESPACE error Labels: bug, systemd, rhel

Description The influxdb3-core service fails to start on Rocky Linux 9 and 10 (and likely AlmaLinux/RHEL) due to a systemd mount namespace permission error. The service crashes immediately with exit code 226/NAMESPACE. Environment Affected Systems: Rocky Linux 9.x (systemd 252) Rocky Linux 10.x (systemd 257) Likely affects: AlmaLinux, RHEL 9/10 Unaffected Systems: Debian 12, Debian 13 Ubuntu 24.04 Package: influxdb3-core (latest from InfluxData repository) Symptoms Service fails to start with repeated crash-loop attempts: ● influxdb3-core.service - InfluxDB 3 Core Active: failed (Result: exit-code)

influxdb3-core.service: Failed at step NAMESPACE spawning /usr/lib/influxdb3/python/bin/python3: Permission denied influxdb3-core.service: Main process exited, code=exited, status=226/NAMESPACE Full journal output: Apr 02 20:52:37 uut-vm (python3)[61188]: Failed to mount /run/systemd/inaccessible/sock to /run/systemd/mount-rootfs/run/dbus/system_bus_socket: Permission denied Apr 02 20:52:37 uut-vm (python3)[61188]: influxdb3-core.service: Failed to set up mount namespacing: /run/dbus/system_bus_socket: Permission denied Apr 02 20:52:37 uut-vm (python3)[61188]: influxdb3-core.service: Failed at step NAMESPACE spawning /usr/lib/influxdb3/python/bin/python3: Permission denied Root Cause The systemd unit file includes security hardening via InaccessiblePaths: InaccessiblePaths=-/run/avahi-daemon -/run/cups -/run/snapd.socket -/run/dbus/system_bus_socket InaccessiblePaths=-/tmp/.X11-unix -/tmp/.XIM-unix -/tmp/.ICE-unix -/tmp/.font-unix -/run/user The /run/dbus/system_bus_socket directive causes systemd on RHEL-based distributions to fail when attempting mount namespace isolation. This appears to be a systemd behavior difference between Debian/Ubuntu and RHEL-based distributions. Rocky 9 (systemd 252): Fails with any InaccessiblePaths entries Rocky 10 (systemd 257): Fails even when only removing the dbus socket SELinux is not the cause (confirmed via ausearch - no AVC denials) Workaround Create a systemd override to remove InaccessiblePaths: sudo mkdir -p /etc/systemd/system/influxdb3-core.service.d sudo tee /etc/systemd/system/influxdb3-core.service.d/rocky-fix.conf <<'EOF' [Service]

Completely override InaccessiblePaths to fix Rocky 9/10 mount namespace issue

Rocky 9 (systemd 252) and Rocky 10 (systemd 257) both fail with dbus socket

Removing ALL InaccessiblePaths to prevent "Permission denied" errors

InaccessiblePaths= EOF

sudo systemctl daemon-reload sudo systemctl restart influxdb3-core Security note: This removes filesystem socket isolation but preserves all other hardening (NoNewPrivileges, PrivateDevices, ProtectHome, ProtectSystem=strict, RestrictNamespaces, SystemCallFilter, etc.). Proposed Fix The influxdb3-core RPM package should ship with a RHEL-specific override that pre-emptively clears InaccessiblePaths on RHEL-based systems. Option 1: Include /usr/lib/systemd/system/influxdb3-core.service.d/rhel.conf in the RPM: [Service]

Clear InaccessiblePaths for RHEL/Rocky/AlmaLinux systemd compatibility

InaccessiblePaths= Option 2: Use conditional directives in the main unit file: [Service]

Only set InaccessiblePaths on Debian/Ubuntu

Comment out for RHEL variants or use ConditionPathExists

Reproduction Steps Install Rocky Linux 9 or 10 Add InfluxData repository and install influxdb3-core: sudo dnf install influxdb3-core Attempt to start the service: sudo systemctl start influxdb3-core Observe failure: sudo systemctl status influxdb3-core sudo journalctl -u influxdb3-core -n 20 Additional Context This issue completely blocks InfluxDB3 Core deployment on RHEL-based systems, which are common in enterprise environments. The workaround is straightforward but requires manual intervention on every installation. Full technical writeup available: influxdb3-rocky-namespace-issue.md