Docker with centos7 systemd container

Build Environment
1

Hello,

I’m running in issues on circle ci when trying to use subj.
I’m using a systemd container which requires cgroup volume passthrough. This works awesome on ordinary host or vps docker run --rm -it -v /sys/fs/cgroup:/sys/fs/cgroup quay.io/dennybaa/droneunit:centos7-systemd.
However circleci docker setup is quite different.
Container starts but systemd is not operational(

Namely, I get the following error:

ubuntu@box4051:~/st2-packages$ sudo lxc-attach -n “$(docker inspect --format ‘{{.Id}}’ st2packages_centos7test_1)” – bash -c "systemctl start sshd"
Failed to get D-Bus connection: Failed to connect to socket /run/systemd/private: Connection refused

Does anybody have some clues?

Best,
Denis

1 Like
2

We currently disallow cgroup volume passthrough for security reasons. Sorry about that. The only way around this would currently be to not to mount cgroups inside the container.

3

Hello, Alexey!

What’s is the solution then? So it’s not possible to run a systemd-enabled container…

4

Any updates?

5

Yes, I’m afraid running any container with systemd inside it would not be possible at the moment. Would it be an option for you to use a different init system?

6

Unfortunately no, Alexey

This is a part of our package build/test environment. We test packages on different OSes among them there are wheezy, jessie, centos7, centos6… So with the current limitation we are unable to test packages for centos7 (new fedoras) and the upcoming ubuntu 16.04.

This security feature is unfortunate limitation for us(

7

Seems like, it is impossible to run docker with systemd under Windows and MacOS X at all:

-v /sys/fs/cgroup:/sys/fs/cgroup

Is it right?

8

This pass-through doesn’t work in circle ci. About windows and macos x can’t tell.

9

It’s now been over a year, and there still isn’t support for this as far as I can tell? Unless there is a workaround? This lack of support will pretty much cease our CircleCI pilot.

1 Like
10

I’d say systemd is pretty critical, because it’s default init system for CentOS/RHEL 7 and new Ubuntu Xenial LTS (16.04). I believe more and more people migrating to these 2 systems with time.

Will it be possible with upcoming CircleCI 2.0 infrastructure?

BTW TravisCI has systemd containers support.

11

Some related discussion/resources:

12

Same issue here, can’t use Molecule (for Ansible role testing over multiple OSes via containers)

13

Use CircleCI 2.0.
The limitation is gone away in new infra.

14

I’m currently trying to use Circle 2.0 with the CentOS7 container and also getting the Failed to get D-Bus connection: Operation not permitted error when trying to use systemctl start.

@armab - What configuration is needed for Systemd to work on Circle 2.0?

15

@jaredledvina It worked with no issues on 2.0.

Just don’t forget to run docker in --privileged mode and cgroup volume passthrough -v /sys/fs/cgroup:/sys/fs/cgroup as suggested in the first message.

1 Like