u/Grand_Bet_2472

I have an Alpine LXC running NPMPlus which I use Anubis with. Upon attempting to pull Anubis' container (regardless of if done via the compose file or direct docker pull ghcr.io/techarohq/anubis:latest, I get a very odd error.

That being:

failed to extract layer (application/vnd.oci.image.layer.v1.tar+gzip sha256:dae2790b70f9eb15de85a179b3978ee8a915f0bcac270d09074f3cb283106d9d) to overlayfs as "extract-279380455--MFm sha256:458136df58646e7146e8240b685e4e6bfffa019ba10d3c221
ff59b3928f54d8c": mount callback failed on /var/lib/docker/containerd/daemon/tmpmounts/containerd-mount3164233251: operation not permitted

Anyone know what this means?

Here's the docker info, it is running as root:

Client:
Version:    29.5.3
Context:    default
Debug Mode: false
Plugins:
 buildx: Docker Buildx (Docker Inc.)
   Version:  v0.34.1
   Path:     /usr/libexec/docker/cli-plugins/docker-buildx
 compose: Docker Compose (Docker Inc.)
   Version:  v5.1.4
   Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
Containers: 2
 Running: 2
 Paused: 0
 Stopped: 0
Images: 4
Server Version: 29.5.3
Storage Driver: overlayfs
 driver-type: io.containerd.snapshotter.v1
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
 /etc/cdi
 /var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: fff62f14765df376e5fc36f5a8f8e795b5670f61
runc version: bb14dabeb7185bb72c8c86735d090dcb20f36587
init version:  
Security Options:
 seccomp
  Profile: builtin
 cgroupns
Kernel Version: 7.0.0-3-pve
Operating System: Alpine Linux v3.24
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 4GiB
Name: npmplus
ID: d2cc3a15-5fdc-41d3-a6cb-c6b45d018259
Docker Root Dir: /var/lib/docker
Debug Mode: false
Experimental: false
Insecure Registries:
 ::1/128
 127.0.0.0/8
Live Restore Enabled: true
Firewall Backend: iptables
 EnableUserlandProxy: true
 UserlandProxyPath: /usr/bin/docker-proxy

WARNING: No swap limit support