RHEL8上的ubi8容器中的systemd无根Podman无法正常工作

问题描述

我们正在尝试使用podman在RHEL8下以非root用户身份从ubi8-init映像运行Container。通过添加内核参数并检查versioins，我们全局启用了cgroups 2：

cgroup_no_v1=all systemd.unified_cgroup_hierarchy=1

$ podman -v
podman version 2.0.5

$ podman info --debug
host:
  arch: amd64
  buildahVersion: 1.15.1
  cgroupVersion: v2

设置了Subuid和subguid：

bob:100000:65536

由于权限问题，丑陋的解决方法：

Failed to create /user.slice/user-992.slice/session-371.scope/init.scope control group: Permission denied

$ chown -R 992 /sys/fs/cgroup/user.slice/user-992.slice/session-371.scope

现在，我们可以运行容器并通过exec / bin / bash跳入该容器。问题是，如果我们想使用podman cp将某些内容复制到容器中，则会出现以下错误：

opening file `/sys/fs/cgroup/cgroup.freeze` for writing: Permission denied

在没有chown解决方法的情况下对命令的输出进行采样：

# Trying with --cgroup-manager=systemd
$ podman run --name=ubi-init-test --cgroup-manager=systemd -it --rm --systemd=true ubi8-init
Error: writing file `/sys/fs/cgroup/user.slice/user-992.slice/[e-mail]/cgroup.subtree_control`: No such file or directory: OCI runtime command not found error


# Trying with --cgroup-manager=cgroupfs
$ podman run --name=ubi-init-test --cgroup-manager=cgroupfs -it --rm --systemd=true ubi8-init
systemd 239 (239-41.el8_3) running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy)
Detected virtualization container-other.
Detected architecture x86-64.

Welcome to Red Hat Enterprise Linux 8.3 (Ootpa)!

Set hostname to <b64ed4493a24>.
Initializing machine ID from random generator.
Failed to read AF_UNIX datagram queue length,ignoring: No such file or directory
Failed to create /init.scope control group: Permission denied
Failed to allocate manager object: Permission denied
[!!!!!!] Failed to allocate manager object,freezing.
Freezing execution.

必须完全错误，配置错误或有故障。有没有人对我们遇到的问题做了此事或提供任何建议？

解决方法

试图解决类似的问题。 我在为 cgroups v2 添加内核参数的基础上做了 setsebool -P container_manage_cgroup true。但它没有帮助。然后我找到了这条评论 https://bbs.archlinux.org/viewtopic.php?pid=1895705#p1895705 并进一步使用 --cgroup-manager=cgroupfs（使用 podman unshare 然后取消设置 DBUS_SESSION_BUS_ADDRESS）：

$ echo $DBUS_SESSION_BUS_ADDRESS
unix:path=/run/user/1000/bus
$ podman unshare
$ export DBUS_SESSION_BUS_ADDRESS=
$ podman run --name=ubi-init-test --cgroup-manager=cgroupfs -it --rm --systemd=true ubi8-init
systemd 239 (239-41.el8_3.1) running in system mode. (+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=legacy)
Detected virtualization container-other.
Detected architecture x86-64.

Welcome to Red Hat Enterprise Linux 8.3 (Ootpa)!

Set hostname to <3caae9f73645>.
Initializing machine ID from random generator.
Failed to read AF_UNIX datagram queue length,ignoring: No such file or directory
Couldn't move remaining userspace processes,ignoring: Input/output error
[  OK  ] Reached target Local File Systems.
[  OK  ] Listening on Journal Socket.
[  OK  ] Reached target Network is Online.
[  OK  ] Started Dispatch Password Requests to Console Directory Watch.
[  OK  ] Reached target Remote File Systems.
[  OK  ] Reached target Slices.
         Starting Rebuild Journal Catalog...
[  OK  ] Started Forward Password Requests to Wall Directory Watch.
[  OK  ] Reached target Paths.
[  OK  ] Listening on initctl Compatibility Named Pipe.
[  OK  ] Reached target Swap.
[  OK  ] Listening on Process Core Dump Socket.
[  OK  ] Listening on Journal Socket (/dev/log).
         Starting Journal Service...
         Starting Rebuild Dynamic Linker Cache...
         Starting Create System Users...
[  OK  ] Started Rebuild Journal Catalog.
[  OK  ] Started Create System Users.
[  OK  ] Started Rebuild Dynamic Linker Cache.
         Starting Update is Completed...
[  OK  ] Started Update is Completed.
[  OK  ] Started Journal Service.
         Starting Flush Journal to Persistent Storage...
[  OK  ] Started Flush Journal to Persistent Storage.
         Starting Create Volatile Files and Directories...
[  OK  ] Started Create Volatile Files and Directories.
         Starting Update UTMP about System Boot/Shutdown...
[  OK  ] Started Update UTMP about System Boot/Shutdown.
[  OK  ] Reached target System Initialization.
[  OK  ] Started dnf makecache --timer.
[  OK  ] Listening on D-Bus System Message Bus Socket.
[  OK  ] Reached target Sockets.
[  OK  ] Started Daily Cleanup of Temporary Directories.
[  OK  ] Reached target Timers.
[  OK  ] Reached target Basic System.
         Starting Permit User Sessions...
[  OK  ] Started D-Bus System Message Bus.
[  OK  ] Started Permit User Sessions.
[  OK  ] Reached target Multi-User System.
         Starting Update UTMP about System Runlevel Changes...
[  OK  ] Started Update UTMP about System Runlevel Changes.