podman: Podman in systemd mode fails on non-systemd hosts

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

On Alpine 3.15, trying to run systemd containers leads to an error from trying to stat the host’s /sys/fs/cgroup/systemd/, which does not exist.

I realise Alpine may not be an officially supported distro, but this may be an issue worth fixing anyway?

Steps to reproduce the issue:

Run container on cgroups v1 host that does not have /sys/fs/cgroup/systemd/ in systemd mode (either with --systemd=always or with /sbin/init as the entrypoint).

Describe the results you received:

localhost:~# podman run --rm --systemd=always fedora
Error: error stat'ing file `/sys/fs/cgroup/systemd`: No such file or directory: OCI runtime attempted to invoke a command that was not found

Describe the results you expected:

No error.

Additional information you deem important (e.g. issue happens only occasionally):

Example above uses --systemd=always, but the default is for podman to detect whether the container is running systemd, so this issue can be seen even without the --systemd arg (and --systemd=false is a workaround).

Output of podman version:

Version:      3.4.4
API Version:  3.4.4
Go Version:   go1.17.4
Git Commit:   72df58eb05290e506c96069e0c5c8d0afab3041f
Built:        Sat Dec 11 13:04:57 2021
OS/Arch:      linux/amd64

Output of podman info:

host:
  arch: amd64
  buildahVersion: 1.23.1
  cgroupControllers:
  - cpuset
  - cpu
  - cpuacct
  - blkio
  - memory
  - devices
  - freezer
  - net_cls
  - perf_event
  - net_prio
  - hugetlb
  - pids
  cgroupManager: cgroupfs
  cgroupVersion: v1
  conmon:
    package: Unknown
    path: /usr/bin/conmon
    version: 'conmon version 2.0.30, commit: 6ef8a4d4d76656172a4b7a9d406bfc6c629c20db'
  cpus: 6
  distribution:
    distribution: alpine
    version: 3.15.0
  eventLogger: file
  hostname: localhost
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.15.5-0-lts
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 5813215232
  memTotal: 6227705856
  ociRuntime:
    name: crun
    package: Unknown
    path: /usr/bin/crun
    version: |-
      crun version 1.3
      commit: 4f6c8e0583c679bfee6a899c05ac6b916022561b
      spec: 1.0.0
      +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  remoteSocket:
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: Unknown
    version: |-
      slirp4netns version 1.1.12
      commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
      libslirp: 4.6.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.2
  swapFree: 199225344
  swapTotal: 199225344
  uptime: 61h 19m 12.5s (Approximately 2.54 days)
plugins:
  log:
  - k8s-file
  - none
  network:
  - bridge
  - macvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev
  graphRoot: /var/lib/containers/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 1
  runRoot: /run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 3.4.4
  Built: 1639227897
  BuiltTime: Sat Dec 11 13:04:57 2021
  GitCommit: 72df58eb05290e506c96069e0c5c8d0afab3041f
  GoVersion: go1.17.4
  OsArch: linux/amd64
  Version: 3.4.4

Package info (output of apk info podman):

podman-3.4.4-r0 description:
Simple management tool for pods, containers and images

podman-3.4.4-r0 webpage:
https://podman.io/

podman-3.4.4-r0 installed size:
35 MiB

Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)

No

Additional environment details (AWS, VirtualBox, physical, etc.):

QEMU VM running Alpine 3.15 cloud image.

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 17 (11 by maintainers)

Commits related to this issue

Most upvoted comments

Podman aims at the use case described later in that document: Fully Unprivileged Container Payload where CAP_SYS_ADMIN is missing. Your use case is even simpler to address as we have to just ignore the /sys/fs/cgroup/systemd mount, it won’t work from a user namespace.

Given that adding this change won’t regress other use cases, I’ve opened a PR: https://github.com/containers/podman/pull/15668