systemd, cgroupsv2: not bind mount /sys/fs/cgroup/systemd
when running on a cgroups v2 system, do not bind mount
the named hierarchy /sys/fs/cgroup/systemd as it doesn't exist
anymore.  Instead bind mount the entire /sys/fs/cgroup.
@@ -466,6 +466,23 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(tmpfsMnt)
}
+ unified, err := cgroups.IsCgroup2UnifiedMode()
+ if err != nil {
+ return err
+ }
+
+ g.RemoveMount("/sys/fs/cgroup")
+
+ if unified {
+ sourcePath := filepath.Join("/sys/fs/cgroup")
+ systemdMnt := spec.Mount{
+ Destination: "/sys/fs/cgroup",
+ Type: "bind",
+ Source: sourcePath,
+ Options: []string{"bind", "private", "rw"},
+ }
+ g.AddMount(systemdMnt)
+ } else {
// rootless containers have no write access to /sys/fs/cgroup, so don't
// add any mount into the container.
if !rootless.IsRootless() {
@@ -473,10 +490,10 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
if err != nil {
return err
}
- sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
+ sourcePath := filepath.Join("/sys/fs/cgroup", cgroupPath)
systemdMnt := spec.Mount{
- Destination: "/sys/fs/cgroup/systemd",
+ Destination: "/sys/fs/cgroup",
Type: "bind",
Source: sourcePath,
Options: []string{"bind", "private"},
@@ -484,13 +501,14 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
g.AddMount(systemdMnt)
} else {
systemdMnt := spec.Mount{
- Destination: "/sys/fs/cgroup/systemd",
+ Destination: "/sys/fs/cgroup",
Type: "bind",
- Source: "/sys/fs/cgroup/systemd",
+ Source: "/sys/fs/cgroup",
Options: []string{"bind", "nodev", "noexec", "nosuid"},
}
g.AddMount(systemdMnt)
}
+ }
return nil
}
