[arch-general] cgroups_v2 and rootless podman

Fri Mar 19 10:40:56 UTC 2021

Hello,

I am trying to make rootless podman work based off of: 
https://wiki.archlinux.org/index.php/Podman#Rootless_Podman and I am 
wondering if I am missing something or if there might be old information 
in the wiki pages: https://wiki.archlinux.org/index.php/Podman and 
https://wiki.archlinux.org/index.php/Cgroups

https://wiki.archlinux.org/index.php/Podman#Rootless_Podman says: 
Rootless Podman requires using cgroups v2. See cgroups on how to check 
whether v1 (default) or v2 is used and how to switch to cgroups v2. So I 
use the instructions at: 
https://wiki.archlinux.org/index.php/Cgroups#Switching_to_cgroups_v2

So here is what I did:

from /etc/default/grub:
GRUB_CMDLINE_LINUX_DEFAULT="consoleblank=0 nomodeseti 
systemd.unified_cgroup_hierarchy=1"

$ ls -al /sys/fs/cgroup
total 0
dr-xr-xr-x 11 root root 0 Mar 19 10:56 .
drwxr-xr-x  7 root root 0 Mar 19 10:56 ..
-r--r--r--  1 root root 0 Mar 19 10:56 cgroup.controllers
-rw-r--r--  1 root root 0 Mar 19 10:57 cgroup.max.depth
-rw-r--r--  1 root root 0 Mar 19 10:57 cgroup.max.descendants
-rw-r--r--  1 root root 0 Mar 19 10:56 cgroup.procs
-r--r--r--  1 root root 0 Mar 19 10:57 cgroup.stat
-rw-r--r--  1 root root 0 Mar 19 10:56 cgroup.subtree_control
-rw-r--r--  1 root root 0 Mar 19 10:57 cgroup.threads
-rw-r--r--  1 root root 0 Mar 19 10:57 cpu.pressure
-r--r--r--  1 root root 0 Mar 19 10:57 cpuset.cpus.effective
-r--r--r--  1 root root 0 Mar 19 10:57 cpuset.mems.effective
...

I also set up /etc/subuid and /etc/subgid :

$ cat /etc/subuid
administrator:100000:65536
$ cat /etc/subgid
administrator:100000:65536

Trying to get podman to work :

$ podman info
Error: cannot setup namespace using newuidmap: exit status 1

$ podman system migrate
Error: cannot setup namespace using newuidmap: exit status 1

When I remove /etc/subuid and /etc/subgid , I get:

$ podman info --debug
ERRO[0000] cannot find UID/GID for user administrator: open /etc/subuid: 
no such file or directory - check rootless mode in man pages.
WARN[0000] using rootless single mapping into the namespace. This might 
break some images. Check /etc/subuid and /etc/subgid for adding sub*ids
...

Then I created empty /etc/subuid and /etc/subgid , and I got:

$ podman info --debug
host:
   arch: amd64
   buildahVersion: 1.19.4
   cgroupManager: systemd
   cgroupVersion: v2
   conmon:
     package: /usr/bin/conmon is owned by conmon 1:2.0.27-1
     path: /usr/bin/conmon
     version: 'conmon version 2.0.27, commit: 
65fad4bfcb250df0435ea668017e643e7f462155'
   cpus: 1
   distribution:
     distribution: arch
     version: unknown
   eventLogger: journald
   hostname: archlinux-minimal
   idMappings:
     gidmap:
     - container_id: 0
       host_id: 60338
       size: 1
     uidmap:
     - container_id: 0
       host_id: 60338
       size: 1
   kernel: 5.11.7-arch1-1
   linkmode: dynamic
   memFree: 1745731584
   memTotal: 2026967040
   ociRuntime:
     name: crun
     package: /usr/bin/crun is owned by crun 0.18-1
     path: /usr/bin/crun
     version: |-
       crun version 0.18
       commit: 808420efe3dc2b44d6db9f1a3fac8361dde42a95
       spec: 1.0.0
       +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
   os: linux
   remoteSocket:
     path: /run/user/60338/podman/podman.sock
   security:
     apparmorEnabled: false
     capabilities: 
CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
     rootless: true
     seccompEnabled: true
     selinuxEnabled: false
   slirp4netns:
     executable: /usr/bin/slirp4netns
     package: /usr/bin/slirp4netns is owned by slirp4netns 1.1.9-1
     version: |-
       slirp4netns version 1.1.9
       commit: 4e37ea557562e0d7a64dc636eff156f64927335e
       libslirp: 4.4.0
       SLIRP_CONFIG_VERSION_MAX: 3
       libseccomp: 2.5.1
   swapFree: 0
   swapTotal: 0
   uptime: 37m 10.76s
registries: {}
store:
   configFile: /home/administrator/.config/containers/storage.conf
   containerStore:
     number: 5
     paused: 0
     running: 0
     stopped: 5
   graphDriverName: overlay
   graphOptions:
     overlay.mount_program:
       Executable: /usr/bin/fuse-overlayfs
       Package: /usr/bin/fuse-overlayfs is owned by fuse-overlayfs 
1.4.0-1
       Version: |-
         fusermount3 version: 3.10.2
         fuse-overlayfs: version 1.4
         FUSE library version 3.10.2
         using FUSE kernel interface version 7.31
   graphRoot: /home/administrator/.local/share/containers/storage
   graphStatus:
     Backing Filesystem: btrfs
     Native Overlay Diff: "false"
     Supports d_type: "true"
     Using metacopy: "false"
   imageStore:
     number: 1
   runRoot: /run/user/60338/containers
   volumePath: 
/home/administrator/.local/share/containers/storage/volumes
version:
   APIVersion: 3.0.0
   Built: 1613921386
   BuiltTime: Sun Feb 21 16:29:46 2021
   GitCommit: c640670e85c4aaaff92741691d6a854a90229d8d
   GoVersion: go1.16
   OsArch: linux/amd64
   Version: 3.0.1

$ pacman -Qs podman
local/podman 3.0.1-2
     Tool and library for running OCI-based containers in pods
$ pacman -Qs crun
local/crun 0.18-1
     A fast and lightweight fully featured OCI runtime and C library for 
running containers

$ uname -a
Linux archlinux-minimal 5.11.7-arch1-1 #1 SMP PREEMPT Wed, 17 Mar 2021 
16:59:58 +0000 x86_64 GNU/Linux

If you have any insights or ideas I would be happy if you shared them.

Regards,
Samir Nassar