3 ms·

Maybe slightly off topic, but I'd love to hear about people's experiences using systemd as process manager inside a container, specifically for the unprivileged

Maybe slightly off topic, but I'd love to hear about people's experiences using systemd as process manager inside a container, specifically for the unprivileged container case, where systemd would be launched in user mode, so only doing process management, without all the other kernel-hook stuff going on. I really like systemd, and I really don't like supervisor. So I'd love to figure out how to make this work. I know the easiest thing would be to ignore the user mode business and just use podman, where the work has already been done [1], but at least in the short term that doesn't help for more restricted environments like cloud kubernetes. [1]: https://www.redhat.com/sysadmin/improved-systemd-podman https://www.redhat.com/sysadmin/improved-systemd-podman

mrweasel 5y ago
May I ask why you'd want to use a process manager inside a container? I just consider Docker my process manager. If my application crashed, Docker will deal with it.
- mikepurvis 5y ago
  A valid question— certainly there's a school of thought that says one process per container, end of story. However, there are lots of applications out there (especially legacy ones, think stuff like Zoneminder) which are made up of multiple small daemon-type processes sharing state across ports and maybe even the filesystem, and have a strong reliance on system services like cron or log rotation. Yes, with effort an application like this could be be fully "ported" to a container-native setup, but the path of least resistance is often to just make the container environment present as being more like a full VM.
  - eternityforest 5y ago
    I get the impression a lot of the entire point of containers in those things is to deal with those awful zoneminder style designs, PHP junk that needs specific Apache configs, etc. I prefer to just avoid any application that requires a service to in any way be configured to account for the app. It's bad enough that Zigbee2MQTT is a separate process, but it's acceptable because it is a pure layering model and as long as you are local only and not needing passwords, there's no manual config. Things like ZM that need an actual database are just insane. Multi-page configuration instructions for something that the(Sadly closed source) AgentDVR does with one process, no containers, no major configuration to conflict with anything else. But modular apps exist, so we need containers to make them act like monoliths.
tifadg1 5y ago
I've reverted from podman to docker as the podman ecosystem isn't there - docker-compose, cadvisor, some networking - all require tinkering to run. My interim solution is running docker containers as user, using a simple USER directive. Straightforward and still added security benefits.
drran 5y ago
Systemd can be used in a docker container only when lot of system services are masked. See my old CentOS 6 with systemd in docker container project as example: https://github.com/vlisivka/docker-centos7-systemd-unpriv https://github.com/vlisivka/docker-centos7-systemd-unpriv
- mikepurvis 5y ago
  That's fascinating— thanks for pointing it out. I definitely assumed the issue was with the daemon itself, and not with the services it was trying to start.
EnigmaCurry 5y ago
https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container#the_quest https://developers.redhat.com/blog/2016/09/13/running-system... This article led me to believe that I could run systemd in an unprivileged docker (not podman) container, but I did not find that to be the case. It was not happy until I added `--cap-add=SYS_ADMIN` capability, and then it started working.
folmar 5y ago
Centos docker images have a copypastable example in their docker hub description.

mrweasel 5y ago

May I ask why you'd want to use a process manager inside a container? I just consider Docker my process manager. If my application crashed, Docker will deal with it.

mikepurvis 5y ago
A valid question— certainly there's a school of thought that says one process per container, end of story. However, there are lots of applications out there (especially legacy ones, think stuff like Zoneminder) which are made up of multiple small daemon-type processes sharing state across ports and maybe even the filesystem, and have a strong reliance on system services like cron or log rotation. Yes, with effort an application like this could be be fully "ported" to a container-native setup, but the path of least resistance is often to just make the container environment present as being more like a full VM.
- eternityforest 5y ago
  I get the impression a lot of the entire point of containers in those things is to deal with those awful zoneminder style designs, PHP junk that needs specific Apache configs, etc. I prefer to just avoid any application that requires a service to in any way be configured to account for the app. It's bad enough that Zigbee2MQTT is a separate process, but it's acceptable because it is a pure layering model and as long as you are local only and not needing passwords, there's no manual config. Things like ZM that need an actual database are just insane. Multi-page configuration instructions for something that the(Sadly closed source) AgentDVR does with one process, no containers, no major configuration to conflict with anything else. But modular apps exist, so we need containers to make them act like monoliths.

tifadg1 5y ago

I've reverted from podman to docker as the podman ecosystem isn't there - docker-compose, cadvisor, some networking - all require tinkering to run. My interim solution is running docker containers as user, using a simple USER directive. Straightforward and still added security benefits.

drran 5y ago

Systemd can be used in a docker container only when lot of system services are masked. See my old CentOS 6 with systemd in docker container project as example: https://github.com/vlisivka/docker-centos7-systemd-unpriv https://github.com/vlisivka/docker-centos7-systemd-unpriv

mikepurvis 5y ago
That's fascinating— thanks for pointing it out. I definitely assumed the issue was with the daemon itself, and not with the services it was trying to start.

EnigmaCurry 5y ago

https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container#the_quest https://developers.redhat.com/blog/2016/09/13/running-system... This article led me to believe that I could run systemd in an unprivileged docker (not podman) container, but I did not find that to be the case. It was not happy until I added `--cap-add=SYS_ADMIN` capability, and then it started working.

folmar 5y ago

Centos docker images have a copypastable example in their docker hub description.