GHC 8.10.7: internal error: Itimer: Failed to spawn thread: Operation not permitted (Ubuntu 20.04 LTS Host)

Summary

On Ubuntu 20.04 LTS, a nixpkgs GHC-built executable for 8.10.7, as well as 9.0.2, fails on startup with the error message:

project-name: internal error: Itimer: Failed to spawn thread: Operation not permitted
(GHC version 8.10.7 for x86_64_unknown_linux)
Please report this as a GHC bug: https://www.haskell.org/ghc/reportabug

Steps to reproduce

Write this file, name it repro.nix:

{ pkgs ? import (builtins.fetchTarball {
    url = "https://github.com/NixOS/nixpkgs/archive/1d7db1b9e4cf1ee075a9f52e5c36f7b9f4207502.tar.gz";
  }) {}
}:

pkgs.dockerTools.buildLayeredImage {
  name = "repro";
  tag = "latest";
  
  contents = [
    pkgs.coreutils
  ];

  config.Cmd = "${
    (pkgs.haskell.lib.enableCabalFlag pkgs.haskellPackages.hello "threaded")
  }/bin/hello";
}

Then, on an

$ lsb_release -a
Distributor ID:	Ubuntu
Description:	Ubuntu 20.04.2 LTS
Release:	20.04
Codename:	focal

run the following:

$ nix-build repro.nix
$ docker load -i ./result
$ docker run repro:latest

and it should print

hello: internal error: Itimer: Failed to spawn thread: Operation not permitted
    (GHC version 9.0.2 for x86_64_unknown_linux)
    Please report this as a GHC bug:  https://www.haskell.org/ghc/reportabug

What is done here: The exact nixpkgs commit is used that we use in our project. Then a simple docker image is built, which will run the https://hackage.haskell.org/package/hello binary (graciously provided by Simon Marlow). Note that we enable the threaded cabal flag for that package, because without the threaded runtime the bug is not triggered!

The docker image can also be nix-build’ on a nix-enabled machine and the file pointed to by ./result can be copied to the test machine, and docker load -ided there. The effect of running it is the same. I will attach the repro docker image to this issue if possible (update: it’s not possible, I can push it to dockerhub on request).

Expected behavior

The runtime should not crash.

Environment

• GHC version used: 9.0.2

The exact version of every dependency can be extracted on demand. It is equal to the status of nixpkgs at https://github.com/NixOS/nixpkgs/tree/1d7db1b9e4cf1ee075a9f52e5c36f7b9f4207502