Akihiro Suda 438b5bea26 hack: run rootless daemon in a systemd user session when systemd is present ...

Previously, the rootless-systemd CI mode failed with:

    open /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers: no such file or directory

on every container start. The daemon auto-selects the systemd cgroup
driver (cgroup v2 + systemd detected), but the test harness launched
dockerd-rootless.sh via plain "sudo" with a fabricated XDG_RUNTIME_DIR,
so there was no systemd user session at all: no user-${uid}.slice, no
user@${uid}.service, and no user D-Bus socket for runc to talk to.
withRootless() (daemon/oci_linux.go) then failed reading the controllers
file at every container start.

Set up the environment the way it is documented for production rootless
installations instead:

- hack/make/.integration-daemon-start: when systemd is running, enable
  lingering for unprivilegeduser (which starts user@${uid}.service),
  use /run/user/${uid} as XDG_RUNTIME_DIR, and export
  DBUS_SESSION_BUS_ADDRESS so that runc can find the systemd user
  manager. The variable also propagates to the daemons spawned by the
  test suite (sudo --preserve-env in internal/testutil/daemon), whose
  XDG_RUNTIME_DIR points to a non-standard location.

- hack/dind-systemd: delegate the cpu/cpuset/io/memory/pids cgroup
  controllers to unprivileged users, matching
  https://docs.docker.com/engine/security/rootless/#limiting-resources

Fixes the "test (amd64, *, rootless-systemd)" CI failures tracked in
issue 44084.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

2026-07-10 04:49:47 +09:00

5.2 KiB

Executable File

Raw Permalink Blame History

View Raw