From mboxrd@z Thu Jan 1 00:00:00 1970 From: Richard Weinberger Subject: Re: [systemd-devel] How to use cgroups within containers? Date: Mon, 20 Oct 2014 18:55:11 +0200 Message-ID: <54453E6F.6000202@nod.at> References: <20141020162445.GA4008@gardel-login> <54453D06.9020101@nod.at> <20141020165129.GA4179@gardel-login> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <20141020165129.GA4179@gardel-login> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Errors-To: containers-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org To: Lennart Poettering Cc: Linux Containers , "systemd-devel-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org" , LXC development mailing-list List-Id: containers.vger.kernel.org Am 20.10.2014 um 18:51 schrieb Lennart Poettering: > On Mon, 20.10.14 18:49, Richard Weinberger (richard-/L3Ra7n9ekc@public.gmane.org) wrote: > >> Am 20.10.2014 um 18:24 schrieb Lennart Poettering: >>> On Fri, 17.10.14 23:35, Richard Weinberger (richard.weinberger-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org) wrote: >>> >>>> Dear systemd and container folks, >>>> >>>> at Plumbers the question raised how to provide cgroups to a systemd that lives >>>> in a container (with user namespaces). >>>> Due to the GDL train strikes I had to leave very soon and had no chance to >>>> talk to you in person. >>>> >>>> Was a solution proposed? >>>> All I want to know is how to provide cgroups in a sane and secure way >>>> to systemd. :-) >>> >>> The cgroups setup systemd requires to be able to run cleanly without >>> changes in a container is documented here: >>> >>> http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ >>> >>> You have to mount the full cgroupfs hierarchies into the containers, >>> so that /proc/$PID/cgroup makes sense inside the containers (that file >>> lists absolute paths...). They can be mounted read-only up to the >>> container's root, but further down they need to be writable to the >>> container, so that systemd inside the container can do its job. >> >> And what solution do you propose? > > Solution? For what problem precisely? Running systemd inside Linux container (including user namespaces). :-) >> Will cgroup namespaces make systemd finally happy? > > I have no idea about cgroup namespaces and what they entail. > > systemd is quite happy already, if you follow the guidelines for > container managers we put together... Have you ever used systemd inside a container? Say, LXC or libvirt-lxc... Thanks, //richard