moby: Ubuntu 16.04 host: cannot run systemd inside unprivileged container

I decided to create a new issue instead of commenting on an existing one because:

  1. Other issues are closed
  2. This issue is specific to Ubuntu 16.04 hosts (apologies if that was the wrong call)

Here’s a reduced test case that shows I cannot start systemd inside a container on Ubuntu 16.04 hosts:

================================================================================
Bad run: not privileged (Ubuntu 16.04 host)(Ubuntu 16.04 container)
================================================================================

docker rm -f tmp; docker run --cap-add SYS_ADMIN --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init ubuntu:16.04 && sleep 1 &&\
 docker exec tmp systemctl | wc -l
Error response from daemon: No such container: tmp
03f9d8cabd006c2e60d2a3d23562b0d7b04f8b701b5446f6d31a5b2a169064e9
Failed to connect to bus: No such file or directory
0

================================================================================
Bad run: not privileged (Ubuntu 16.04 host)(CentOS container)
================================================================================

root@wasosa-docker:~# docker rm -f tmp ; docker run --cap-add SYS_ADMIN --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init cen\
tos && sleep 1 && docker exec tmp systemctl | wc -l
Error response from daemon: No such container: tmp
585a070e022447291124d6cd2158cc0676699038b6b4af49e4190c008bf8f431
Failed to get D-Bus connection: Operation not permitted
0

As you can see systemctl is not putting anything on stdout (line count is 0), but it is putting one error message on stderr: Failed to get D-Bus connection: Operation not permitted If instead I run with --privileged then I get:

================================================================================
Good run: privileged (Ubuntu 16.04 host)(Ubuntu 16.04 container)
================================================================================

rm -f tmp ; docker run --privileged --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init ubuntu:16.04 && sleep 1 && docker exec \
tmp systemctl | wc -l
tmp
91621fcb200ac06fef503871add7bc79ab8b67d33ebec3507f187edaa26f7040
67

================================================================================
Good run: privileged (Ubuntu 16.04 host)(CentOS container)
================================================================================

root@wasosa-docker:~# docker rm -f tmp ; docker run --privileged --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init centos && \
sleep 1 && docker exec tmp systemctl | wc -l
tmp
3fca11156b252a5fe53271882b290b27278b978e8dd4e62fe2563a281e6e336b
62

In this case systemctl does give lots of output (hidden here because it is not relevant, but line counts are around 60).

If instead I run on a CentOS host, all cases above succeed:

================================================================================
Good run: not privileged (CentOS 7 host)(Ubuntu 16.04 container)
================================================================================

[root@wasosa-centos ~]# docker rm -f tmp; docker run --cap-add SYS_ADMIN --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init ub\
untu:16.04 && sleep 1 && docker exec tmp systemctl | wc -l
fdca61d37b996d3b9dab92ba00a31e06b31e38bdf4c32d2db37a6788a015852f
58

================================================================================
Good run: not privileged (CentOS 7 host)(CentOS container)
================================================================================

[root@wasosa-centos ~]# docker rm -f tmp; docker run --cap-add SYS_ADMIN --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init ce\
ntos && sleep 1 && docker exec tmp systemctl | wc -l
tmp
efe33d103256fc3680c5098084649f72b6561dbe05092e1b399cdd3643105461
58

================================================================================
Good run: privileged (CentOS 7 host)(CentOS container)
================================================================================

[root@wasosa-centos ~]# docker rm -f tmp; docker run --privileged --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init centos &&\
 sleep 1 && docker exec tmp systemctl | wc -l
tmp
ee9437e595bb221674aefb805c420443367b83847013e3501533729ac88c9f67
62

================================================================================
Good run: privileged (CentOS 7 host)(Ubuntu 16.04 container)
================================================================================

[root@wasosa-centos ~]# docker rm -f tmp; docker run --privileged --volume /sys/fs/cgroup:/sys/fs/cgroup --name=tmp --detach --entrypoint=/sbin/init ubuntu:16\
.04 && sleep 1 && docker exec tmp systemctl | wc -l
tmp
c2c484d222c4b96f0353cc1cec4a50568e22b99da5bacd2a11547bba66038f4e
66

Here are the details for the two hosts:

================================================================================
Host machine details: Ubuntu 16.04
================================================================================

DigitalOcean One-click apps: Docker 1.12.3 on 16.04

root@wasosa-docker:~# uname -a
Linux wasosa-docker 4.4.0-47-generic #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
root@wasosa-docker:~# cat /etc/issue
Ubuntu 16.04.1 LTS \n \l

root@wasosa-docker:~# docker version
Client:
 Version:      1.12.3
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   6b644ec
 Built:        Wed Oct 26 22:01:48 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.3
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   6b644ec
 Built:        Wed Oct 26 22:01:48 2016
 OS/Arch:      linux/amd64

root@wasosa-docker:~# docker info
Containers: 1
 Running: 1
 Paused: 0
 Stopped: 0
Images: 4
Server Version: 1.12.3
Storage Driver: devicemapper
 Pool Name: docker-253:1-1183379-pool
 Pool Blocksize: 65.54 kB
 Base Device Size: 10.74 GB
 Backing Filesystem: xfs
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 660.9 MB
 Data Space Total: 107.4 GB
 Data Space Available: 40.18 GB
 Metadata Space Used: 1.229 MB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.146 GB
 Thin Pool Minimum Free Space: 10.74 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Deferred Deletion Enabled: false
 Deferred Deleted Device Count: 0
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 WARNING: Usage of loopback devices is strongly discouraged for production use. Use `--storage-opt dm.thinpooldev` to specify a custom block storage device.
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.110 (2015-10-30)
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: null host bridge overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: apparmor seccomp
Kernel Version: 4.4.0-47-generic
Operating System: Ubuntu 16.04.1 LTS
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.953 GiB
Name: wasosa-docker
ID: 33GB:G7KS:ZXJ7:UY4T:3467:SDL2:AHQN:CPRO:STIA:MOF5:ANUC:MPKW
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Insecure Registries:
 127.0.0.0/8

================================================================================
Host machine details: CentOS 7.2
================================================================================

DigitalOcean: CentOS 7.2 x64

[root@wasosa-centos ~]# uname -a
Linux wasosa-centos 3.10.0-327.36.3.el7.x86_64 #1 SMP Mon Oct 24 16:09:20 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[root@wasosa-centos ~]# cat /etc/redhat-release
CentOS Linux release 7.2.1511 (Core)

[root@wasosa-centos ~]# docker version
Client:
 Version:      1.12.3
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   6b644ec
 Built:        
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.3
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   6b644ec
 Built:        
 OS/Arch:      linux/amd64

[root@wasosa-centos ~]# docker info
Containers: 1
 Running: 1
 Paused: 0
 Stopped: 0
Images: 2
Server Version: 1.12.3
Storage Driver: devicemapper
 Pool Name: docker-253:1-391976-pool
 Pool Blocksize: 65.54 kB
 Base Device Size: 10.74 GB
 Backing Filesystem: xfs
 Data file: /dev/loop0
 Metadata file: /dev/loop1
 Data Space Used: 415.6 MB
 Data Space Total: 107.4 GB
 Data Space Available: 40.38 GB
 Metadata Space Used: 966.7 kB
 Metadata Space Total: 2.147 GB
 Metadata Space Available: 2.147 GB
 Thin Pool Minimum Free Space: 10.74 GB
 Udev Sync Supported: true
 Deferred Removal Enabled: false
 Deferred Deletion Enabled: false
 Deferred Deleted Device Count: 0
 Data loop file: /var/lib/docker/devicemapper/devicemapper/data
 WARNING: Usage of loopback devices is strongly discouraged for production use. Use `--storage-opt dm.thinpooldev` to specify a custom block storage device.
 Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata
 Library Version: 1.02.107-RHEL7 (2016-06-09)
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: null host bridge overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: seccomp
Kernel Version: 3.10.0-327.36.3.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 1.797 GiB
Name: wasosa-centos
ID: 4NWZ:KTNY:OMAZ:D333:VS64:Z4DE:TYMH:4TCM:5545:KJE7:IBOI:IJHU
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
WARNING: bridge-nf-call-iptables is disabled
WARNING: bridge-nf-call-ip6tables is disabled
Insecure Registries:
 127.0.0.0/8

================================================================================
Same behavior on my Ubuntu 16.04 workstation:
================================================================================

[wasosa][wasosa-desktop][~/workspace/privileged][148]: uname -a
Linux wasosa-desktop 4.4.0-42-generic #62-Ubuntu SMP Fri Oct 7 23:11:45 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
[wasosa][wasosa-desktop][~/workspace/privileged][0]: cat /etc/issue
Ubuntu 16.04 LTS \n \l

[wasosa][wasosa-desktop][~/workspace/privileged][148]: docker info
Containers: 1
 Running: 1
 Paused: 0
 Stopped: 0
Images: 158
Server Version: 1.12.3
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 138
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: null host bridge overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Security Options: apparmor seccomp
Kernel Version: 4.4.0-42-generic
Operating System: Ubuntu 16.04 LTS
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 23.54 GiB
Name: wasosa-desktop
ID: OYA2:CECT:5QXK:KAZE:BRRG:FQUI:XPXJ:FQPG:5433:4P5X:2N6J:HLTB
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Insecure Registries:
 carrot.mezztest.oblong.com:5000
 127.0.0.0/8

[wasosa][wasosa-desktop][~/workspace/privileged][0]: docker version
Client:
 Version:      1.12.3
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   6b644ec
 Built:        Wed Oct 26 22:01:48 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.3
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   6b644ec
 Built:        Wed Oct 26 22:01:48 2016
 OS/Arch:      linux/amd64

About this issue

  • Original URL
  • State: closed
  • Created 8 years ago
  • Reactions: 2
  • Comments: 20 (8 by maintainers)

Commits related to this issue

Most upvoted comments

I tried building my own container and running various incantations without any luck. However, I did end up finding this project:

https://github.com/solita/docker-systemd

and I was able to get a systemd container running on Ubuntu 14.04 by following the instructions on that project.

+3
rsyring on Feb 23, 2017

I was able to start a centos container with this;

docker run -it \
  --name=tmp \
  --cap-add=SYS_ADMIN \
  -e "container=docker" \
  -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
  --tmpfs /run \
  centos:7 /usr/sbin/init

I had to specify the --tmpfs otherwise container start failed;

Failed to mount tmpfs at /run: Permission denied
[!!!!!!] Failed to mount API filesystems, freezing.

Ubuntu 16.04 indeed fails to start; it also required /run to be specified as tmpfs, but then failed at trying to mount a tmpfs at /run/lock.

docker run -it \
>   --name=tmp \
>   --cap-add=SYS_ADMIN \
>   -e "container=docker" \
>   -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
>   --tmpfs /run \
>   ubuntu:16.04 /sbin/init
Failed to mount tmpfs at /run/lock: Permission denied
[!!!!!!] Failed to mount API filesystems, freezing.
Freezing execution.

Setting both /run and /run/lock as tmpfs seems to do more;

docker run -it \
>   --name=tmp \
>   --cap-add=SYS_ADMIN \
>   -e "container=docker" \
>   -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
>   --tmpfs /run \
>   --tmpfs /run/lock \
>   ubuntu:16.04 /sbin/init
systemd 229 running in system mode. (+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN)
Detected virtualization docker.
Detected architecture x86-64.

Welcome to Ubuntu 16.04.1 LTS!

Set hostname to <835a1fc5a655>.
Initializing machine ID from random generator.
[  OK  ] Reached target Remote File Systems (Pre).
[  OK  ] Reached target Encrypted Volumes.
[  OK  ] Listening on /dev/initctl Compatibility Named Pipe.
[  OK  ] Reached target Remote File Systems.
[  OK  ] Created slice System Slice.
[  OK  ] Created slice system-getty.slice.
[  OK  ] Reached target Slices.
[  OK  ] Listening on Journal Socket.
         Starting Remount Root and Kernel File Systems...
[  OK  ] Started Forward Password Requests to Wall Directory Watch.
         Mounting Huge Pages File System...
[  OK  ] Reached target Swap.
[  OK  ] Listening on Journal Socket (/dev/log).
         Starting Journal Service...
[  OK  ] Reached target Sockets.
[  OK  ] Started Dispatch Password Requests to Console Directory Watch.
[  OK  ] Reached target Paths.
         Mounting FUSE Control File System...
[  OK  ] Started Journal Service.

(note: without -e "container=docker" I got Failed to set up the root directory for shared mount propagation: Permission denied)

@justincormack any idea on the mount issue?

+3
thaJeztah on Nov 19, 2016

Could you open an issue in the https://github.com/docker/compose/issues issue tracker?

+1
thaJeztah on Mar 18, 2017
Read more comments on GitHub
← moby: Ubuntu 16.04 clean install of docker-engine fails to initialize network bridge
moby: Ubuntu 16.04 http_proxy not work →