I'm running Docker as root inside an Alpine Linux LXC container on Proxmox. The container hosts NPMPlus and has 4 GiB of RAM, 8 CPUs, and Docker 29.5.3 using the containerd overlayfs snapshotter. When I try to pull the Anubis image, either directly with `docker pull ghcr.io/techarohq/anubis:latest` or through Compose, the image fails while extracting a layer with an error saying the overlayfs mount callback returned `operation not permitted`.
The relevant part is:
`failed to extract layer ... to overlayfs ... mount callback failed ... operation not permitted`
The Docker daemon is running as root. Reboots have not helped, and other images appear to work. What could cause this, and what should I check?
3 Answers
That error is happening while containerd is trying to mount a temporary overlayfs filesystem, so it points more toward the host/LXC storage setup than the Anubis image itself. Since Docker is running inside an LXC, check whether the container has the required nesting and mount permissions, and whether the Proxmox host allows the overlayfs operations Docker needs. The storage backend and security profile can also affect this.
Also check available disk space and inodes on the filesystem containing `/var/lib/docker`. Docker needs room for both the downloaded layer and its temporary extraction mount. A full filesystem can produce confusing layer-extraction failures, so verify the space, inode count, and filesystem type on the Proxmox host and inside the LXC.
The fact that the same image works on another device makes a corrupted or incompatible local Docker environment more likely than a bad image. Inspect the Docker and kernel logs around the failed pull, then check the LXC configuration, AppArmor or seccomp restrictions, and whether overlayfs is supported and permitted by the host kernel. If the setup is using an unusual nested-container configuration, testing Docker in a VM or a properly configured privileged/nesting-enabled LXC can help confirm that diagnosis.
I rebooted several times because I initially suspected a temporary system issue, but the same extraction error remains. I’ve temporarily deployed Anubis on another machine, where the image pulls successfully.