On Fri, 17.10.14 23:35, Richard Weinberger (richard.weinberger@xxxxxxxxx) wrote: > Dear systemd and container folks, > > at Plumbers the question raised how to provide cgroups to a systemd that lives > in a container (with user namespaces). > Due to the GDL train strikes I had to leave very soon and had no chance to > talk to you in person. > > Was a solution proposed? > All I want to know is how to provide cgroups in a sane and secure way > to systemd. :-) The cgroups setup systemd requires to be able to run cleanly without changes in a container is documented here: http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/ You have to mount the full cgroupfs hierarchies into the containers, so that /proc/$PID/cgroup makes sense inside the containers (that file lists absolute paths...). They can be mounted read-only up to the container's root, but further down they need to be writable to the container, so that systemd inside the container can do its job. If a container manager does not mount them systemd will mount them on its own. Lennart -- Lennart Poettering, Red Hat _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
