mirror of
https://github.com/moby/moby.git
synced 2026-08-09 17:39:58 +00:00
438b5bea26
Previously, the rootless-systemd CI mode failed with:
open /sys/fs/cgroup/user.slice/user-1000.slice/cgroup.controllers: no such file or directory
on every container start. The daemon auto-selects the systemd cgroup
driver (cgroup v2 + systemd detected), but the test harness launched
dockerd-rootless.sh via plain "sudo" with a fabricated XDG_RUNTIME_DIR,
so there was no systemd user session at all: no user-${uid}.slice, no
user@${uid}.service, and no user D-Bus socket for runc to talk to.
withRootless() (daemon/oci_linux.go) then failed reading the controllers
file at every container start.
Set up the environment the way it is documented for production rootless
installations instead:
- hack/make/.integration-daemon-start: when systemd is running, enable
lingering for unprivilegeduser (which starts user@${uid}.service),
use /run/user/${uid} as XDG_RUNTIME_DIR, and export
DBUS_SESSION_BUS_ADDRESS so that runc can find the systemd user
manager. The variable also propagates to the daemons spawned by the
test suite (sudo --preserve-env in internal/testutil/daemon), whose
XDG_RUNTIME_DIR points to a non-standard location.
- hack/dind-systemd: delegate the cpu/cpuset/io/memory/pids cgroup
controllers to unprivileged users, matching
https://docs.docker.com/engine/security/rootless/#limiting-resources
Fixes the "test (amd64, *, rootless-systemd)" CI failures tracked in
issue 44084.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This directory holds scripts called by make.sh in the parent directory.
Each script is named after the bundle it creates. They should not be called directly - instead, pass it as argument to make.sh, for example:
./hack/make.sh binary ubuntu
# Or to run all default bundles:
./hack/make.sh
To add a bundle:
- Create a shell-compatible file here
- Add it to $DEFAULT_BUNDLES in make.sh