moby: systemd v219 can't run in docker 1.9 due to readonly /sys/fs/cgroup
Running systemd in docker is a long-standing issue, some months ago I surprisedly found I can smoothly run “systemd-container-208” in docker 1.8 with “–cap-add SYS_ADMIN”(I feel this is a little safer than --privileged 😃, but in docker 1.9 this breaks, the cause is “/sys/fs/cgroup” is readonly by default now, I have to use this hack:
$ docker run -dt -e container=docker --cap-add SYS_ADMIN centos:latest bash -c 'mount -oremount,rw /sys/fs/cgroup; mkdir /sys/fs/cgroup/systemd; mount -oremount,ro /sys/fs/cgroup; exec /usr/sbin/init'
I’m not sure what the best solution is, maybe ask systemd developer to try to remount /sys/fs/cgroup before creating /sys/fs/cgroup/systemd? or docker just creates that directory anyway? I see there is systemd support in docker now, but don’t know what it is doing: https://github.com/opencontainers/runc/tree/master/libcontainer/cgroups/systemd
Docker 1.8 (boot2docker v1.8.0):
$ docker run --rm -it -e container=docker centos:latest bash -c 'mount | grep /sys/fs/cgroup'
tmpfs on /sys/fs/cgroup type tmpfs (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpu type cgroup (ro,nosuid,nodev,noexec,relatime,cpu)
cgroup on /sys/fs/cgroup/cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpuacct)
cgroup on /sys/fs/cgroup/blkio type cgroup (ro,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/memory type cgroup (ro,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/devices type cgroup (ro,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (ro,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/net_cls type cgroup (ro,nosuid,nodev,noexec,relatime,net_cls)
cgroup on /sys/fs/cgroup/perf_event type cgroup (ro,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/net_prio type cgroup (ro,nosuid,nodev,noexec,relatime,net_prio)
$ docker version
Client version: 1.7.1
Client API version: 1.19
Go version (client): go1.4.2
Git commit (client): 786b29d
OS/Arch (client): darwin/amd64
Server version: 1.8.1
Server API version: 1.20
Go version (server): go1.4.2
Git commit (server): d12ea79
OS/Arch (server): linux/amd64
$ docker info
Containers: 3
Images: 136
Storage Driver: aufs
Root Dir: /mnt/sda1/var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 142
Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 4.0.9-boot2docker
Operating System: Boot2Docker 1.8.1 (TCL 6.3); master : 7f12e95 - Thu Aug 13 03:24:56 UTC 2015
CPUs: 8
Total Memory: 1.955 GiB
Name: boot2docker
ID: 25AA:2PM7:VJDC:2YPU:QTKF:ODD5:HSAQ:EWGV:2XOU:3LHD:5FF4:6DMG
Debug mode (server): true
File Descriptors: 30
Goroutines: 38
System Time: 2015-12-20T02:03:36.73673363Z
EventsListeners: 0
Init SHA1:
Init Path: /usr/local/bin/docker
Docker Root Dir: /mnt/sda1/var/lib/docker
$ uname -a
Darwin localhost 15.0.0 Darwin Kernel Version 15.0.0: Sat Sep 19 15:53:46 PDT 2015; root:xnu-3247.10.11~1/RELEASE_X86_64 x86_64 i386 MacBookPro11,5 Darwin
$ boot2docker ssh uname -a
Linux boot2docker 4.0.9-boot2docker #1 SMP Thu Aug 13 03:05:44 UTC 2015 x86_64 GNU/Linux
Docker 1.9 (docker toolbox, docker-machine 0.5.0):
$ docker run --rm -it -e container=docker centos:latest bash -c 'mount | grep /sys/fs/cgroup'
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,relatime,mode=755)
cgroup on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpu type cgroup (ro,nosuid,nodev,noexec,relatime,cpu)
cgroup on /sys/fs/cgroup/cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpuacct)
cgroup on /sys/fs/cgroup/blkio type cgroup (ro,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/memory type cgroup (ro,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/devices type cgroup (ro,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (ro,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/net_cls type cgroup (ro,nosuid,nodev,noexec,relatime,net_cls)
cgroup on /sys/fs/cgroup/perf_event type cgroup (ro,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/net_prio type cgroup (ro,nosuid,nodev,noexec,relatime,net_prio)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (ro,nosuid,nodev,noexec,relatime,hugetlb)
$ docker version
Client:
Version: 1.9.0
API version: 1.21
Go version: go1.4.3
Git commit: 76d6bc9
Built: Tue Nov 3 19:20:09 UTC 2015
OS/Arch: darwin/amd64
Server:
Version: 1.9.0
API version: 1.21
Go version: go1.4.3
Git commit: 76d6bc9
Built: Tue Nov 3 19:20:09 UTC 2015
OS/Arch: linux/amd64
$ docker info
Containers: 3
Images: 10
Server Version: 1.9.0
Storage Driver: aufs
Root Dir: /mnt/sda1/var/lib/docker/aufs
Backing Filesystem: extfs
Dirs: 17
Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 4.1.12-boot2docker
Operating System: Boot2Docker 1.9.0 (TCL 6.4); master : 16e4a2a - Tue Nov 3 19:49:22 UTC 2015
CPUs: 1
Total Memory: 1.956 GiB
Name: default
ID: WDPS:UFA4:DWK6:54U4:JIPX:6K6U:HDMV:MXJU:L4DA:JL7N:4A3A:CFRF
Debug mode (server): true
File Descriptors: 17
Goroutines: 28
System Time: 2015-12-20T02:03:12.399240046Z
EventsListeners: 0
Init SHA1:
Init Path: /usr/local/bin/docker
Docker Root Dir: /mnt/sda1/var/lib/docker
Labels:
provider=virtualbox
$ uname -a
Darwin localhost 15.0.0 Darwin Kernel Version 15.0.0: Sat Sep 19 15:53:46 PDT 2015; root:xnu-3247.10.11~1/RELEASE_X86_64 x86_64 i386 MacBookPro11,5 Darwin
$ docker-machine ssh default uname -a
Linux default 4.1.12-boot2docker #1 SMP Tue Nov 3 06:03:36 UTC 2015 x86_64 GNU/Linux
About this issue
- Original URL
- State: closed
- Created 9 years ago
- Comments: 29 (12 by maintainers)
@rhatdan, that did the trick! Thank you.
Any idea, why systemd doesn’t print any start messages.
Gentlemen, thanks a lot for your valuable comments!
Finally I was able to start Debian 8
systemd
container on CentOS 7.2.1511 with active SELinux enforcement (no local modifications needed). I use Docker Engine 1.9.1 and followingDockerfile
:This and only this command works for me:
Success!
@zart, thanks. That’s what I wrote in my comment too.
Please note, that with the capability
SYS_ADMIN
you do not need to mount/run
and/tmp
.Hi, has there been any progress with integrating the patches?
Just a side – tested with Docker 1.10.3, for Debian 8.3 (jessie), systemd 215-17+deb8u4, the following options are needed.
Without
SYS_RESOURCE
D-Bus doesn’t seem to start.With Debian stretch/testing, systemd 229-3, the following works.
In #docker@irc.freenode.net I was told, that there is the environment variable
container
.The following is supposed to work with CentOS.
On Debian it fails with the error below.