https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Bug ID: 1192081 Summary: Modify base image Dockerfile to enable systemd to run smoothly Product: Fedora Version: rawhide Component: docker-io Assignee: lsm5@redhat.com Reporter: vpavlin@redhat.com QA Contact: extras-qa@fedoraproject.org CC: adimania@gmail.com, admiller@redhat.com, golang@lists.fedoraproject.org, hushan.jia@gmail.com, jchaloup@redhat.com, jperrin@centos.org, lsm5@redhat.com, mattdm@redhat.com, mgoldman@redhat.com, miminar@redhat.com, s@shk.io, thrcka@redhat.com, vbatts@redhat.com
Description of problem: systemd requires container=docker set in env and /run, /tmp to be mountpoints start successfully. In my opinion, we should add
ENV container=docker VOLUME ['/run', '/tmp']
to the base image Dockerfile.
Command
docker run --it --rm -v /sys/fs/cgroup:/sys/fs/cgroup:ro fedora:rawhide /usr/sbin/init
would then be all an user would need to "boot" systemd in a container.
I've already made some changes in KS file - remove fstab and machine-id, mask mount units... which make the boot sequence smooth.
More changes to boot sequence will probably come later (f.e. switch from graphical.target to multi-user target)
I'd also like to suggest new Rawhide build to be pushed to registry. This one works for me quite well: http://koji.fedoraproject.org/koji/taskinfo?taskID=8883309
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Lokesh Mandvekar lsm5@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED
--- Comment #1 from Lokesh Mandvekar lsm5@redhat.com --- ack, will build and send a new image over to hub
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Daniel Walsh dwalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |dwalsh@redhat.com
--- Comment #2 from Daniel Walsh dwalsh@redhat.com --- Is this complete?
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #3 from Lokesh Mandvekar lsm5@redhat.com --- This pull request wasn't merged, https://github.com/docker-library/official-images/pull/497.
I'll be sending updated images without the systemd fixes though once I check with dgilmore.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Fedora Admin XMLRPC Client fedora-admin-xmlrpc@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|lsm5@redhat.com |extras-orphan@fedoraproject | |.org
--- Comment #4 from Fedora Admin XMLRPC Client fedora-admin-xmlrpc@redhat.com --- This package has changed ownership in the Fedora Package Database. Reassigning to the new owner of this component.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Lokesh Mandvekar lsm5@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Component|docker-io |docker Assignee|extras-orphan@fedoraproject |lsm5@redhat.com |.org |
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Daniel Walsh dwalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED
--- Comment #5 from Daniel Walsh dwalsh@redhat.com --- Lokesh lets get the patches into Fedora for docker-1.6 and then most of this is taken care of via docker itself.
Fixed in docker-1.6
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Lokesh Mandvekar lsm5@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|lsm5@redhat.com |admiller@redhat.com
--- Comment #7 from Lokesh Mandvekar lsm5@redhat.com --- Adam, could you take a look at this one? I've been out of the 'base images' loop for a while.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Daniel Walsh dwalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|MODIFIED |ASSIGNED Assignee|admiller@redhat.com |dwalsh@redhat.com
--- Comment #8 from Daniel Walsh dwalsh@redhat.com --- We are working this out separately. Do not change the base image for this. We are introducing oci-systemd and oci-register-machine packages which will make this possible without modification of the base image.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #9 from Daniel Walsh dwalsh@redhat.com --- oci-register-machine has made its way into rawhide. Next up oci-systemd-hook
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #10 from Daniel Walsh dwalsh@redhat.com --- https://github.com/projectatomic/oci-systemd-hook
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
Daniel Walsh dwalsh@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |MODIFIED Version|23 |24
--- Comment #11 from Daniel Walsh dwalsh@redhat.com --- Fixed in current release.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #12 from Jan Pazdziora jpazdziora@redhat.com --- Dan,
what is the minimal execution environment for systemd? The ENV container=docker that the comment 0 asks for does not seem to be present in current fedora:rawhide, for example:
# docker run -ti --rm fedora:rawhide bash -c 'set | grep container' BASH_EXECUTION_STRING='set | grep container'
Also the /run and /tmp VOLUMEs do not seem to be defined:
# docker run -ti --rm fedora:rawhide mount | egrep '/run|/tmp' /dev/mapper/fedora_cloud--qe--14-root on /run/secrets type xfs (rw,relatime,seclabel,attr2,inode64,noquota)
The net effect is that
# docker run -it --rm -v /sys/fs/cgroup:/sys/fs/cgroup:ro fedora:rawhide /usr/sbin/init
hangs with no output produced.
Adding -e container=docker to the command line shows
# docker run -it --rm -e container=docker -v /sys/fs/cgroup:/sys/fs/cgroup:ro fedora:rawhide /usr/sbin/init Failed to mount tmpfs at /run: Operation not permitted [!!!!!!] Failed to mount API filesystems, freezing. Freezing execution.
Only another --tmpfs /run or -v /run makes systemd actually start, and adding --tmpfs /tmp makes the error
tmp.mount: Mount process exited, code=exited status=32 [FAILED] Failed to mount Temporary Directory. See 'systemctl status tmp.mount' for details. tmp.mount: Unit entered failed state.
go away.
From this point of view, the current fedora:rawhide does not seem to have made running systemd easier.
This is with
docker.io/fedora rawhide d93e998fad14 3 months ago 250.7 MB
-- if there is some newer image somewhere, having a way to test it (name/tag) would be nice.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #13 from Jim Perrin jperrin@centos.org --- The docker library folks weren't receptive to CentOS (or anyone else) defining volumes for /tmp and /run. They felt (at the time, dunno if it's changed) that this should be for users to do, and didn't belong in the base containers.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #14 from Daniel Walsh dwalsh@redhat.com --- Jan were you testing with oci-sytemd-hook and oci-register-machine installed?
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #15 from Jan Pazdziora jpazdziora@redhat.com --- (In reply to Jim Perrin from comment #13)
The docker library folks weren't receptive to CentOS (or anyone else) defining volumes for /tmp and /run. They felt (at the time, dunno if it's changed) that this should be for users to do, and didn't belong in the base containers.
The content of the images really should be up to the image authors.
On the other hand, bug 1283891 and bug 1331781 show that having the VOLUMEs defined can cause issues as well.
https://bugzilla.redhat.com/show_bug.cgi?id=1192081
--- Comment #16 from Jan Pazdziora jpazdziora@redhat.com --- (In reply to Daniel Walsh from comment #14)
Jan were you testing with oci-sytemd-hook and oci-register-machine installed?
This is on Fedora (23) where they are not available.
golang@lists.fedoraproject.org