Is there a way to execute docker without '--init-' option?

[ldevulder]

I'm trying to test K3s in a privileged container (kvm is needed to run a VM that will be added in the K3s cluster) but I run into an issue with cgroups v2.

After moving PID 1 to another cgroup like this (which worked as expected):

# mkdir /sys/fs/cgroup/init
# echo 1 > /sys/fs/cgroup/init/cgroup.procs

I tried to enable controllers and I had an error:

# echo "+cpuset +cpu +io +memory +pids +rdma" > /sys/fs/cgroup/cgroup.subtree_control
bash: echo: write error: Device or resource busy

After some tests on my lab I was able to reproduce this issue when I run docker like this:

docker run -it --init --privileged --rm ubuntu:latest

But no issue when I run docker like this:

docker run -it --privileged --rm ubuntu:latest

This seems clearly related to this --init option, and I saw that cirrus-ci run my container with this option.
So, is there a way to run a container without this option? I tried with another image (opensuse/leap:latest) and I had the same issue.

Thanks for your answer ;-)

[edigaryev]

Hello Loic!

Perhaps replacing:

echo 1 > /sys/fs/cgroup/init/cgroup.procs

...with:

xargs -rn1 < /sys/fs/cgroup/cgroup.procs > /sys/fs/cgroup/init/cgroup.procs

...would work? As the latter doesn't make an assumption regarding the current process ID and just adds all processes.

However, it's not clear as to why you need this in the first place 🤔 Are all of these controllers missing in your environment?

[fkorotkov]

Side note: details about why the --init option was added can be found in #564

[ldevulder]

Perhaps replacing:

Thanks it works! In fact I first tried this xargs version but I hjad the same issue. In fact it's because during my first tests I tried AFTER K3s installation and in that case cgroups are kindof "freeze". I did new tests this morning and all is working well.

However, it's not clear as to why you need this in the first place Are all of these controllers missing in your environment?

It's needed for K3s installation, otherwise I have an error, see here for more information: k3s-io/k3s#4085. It should be implemented in K3s alreadyt, but either it's not working well (I will check if this is a bug on our side) or maybe in my test as I'm using something a little bit different ;-)

Thanks for your useful help!