Missing composer specification equivalent for --cgroupns=[host|private]/API1.41

[thediveo]

On hosts with "only" a unified cgroup v2 controller hierarchy (that is, a "pure" cgroups v2 hierarchy) Docker now defaults (unless configured otherwise) to automatically creating private cgroup namespaces for created containers. The rationale here is to reduce leakage of potentially sensitive information about the cgroup hierarchy and configuration of the host, and thus other containers. Still, there are valid usecases to allow only specific containers to use the initial (host) cgroup namespace, especially for system diagnosis containers. For instance, the well-known cAdvisor ("provides container users an understanding of the resource usage and performance characteristics of their running containers").

For such usecases, docker run introduced the CLI flag --cgroupns=[host|private] as of Docker-CE 20.0.0 and API 1.41.

Unfortunately, the current compose specification doesn't provide any means to controlling cgroup namespace creation or sharing. This makes it impossible to use system diagnosis containers, such as cAdvisor, ... on cgroup v2 unified hierarchy-only systems anymore with compose-based deployment tools.

This situation would be solved by adding a cgroup field to service objects that would allow to specify the values of either "private" or "host", mirroring today's CLI flag functionality for handling the cgroup namespace creation for new containers.

services:
  foo:
    pid: host
    cgroup: host # might be "cgroupns" instead if parity with CLI flag is sought after, but breaks symmetry with pid namespaces.

Nota bene: mirror docker/compose issue #8167

[EricHripko]

Thank for you for suggesting this @thediveo 👍 For the benefit of the readers, here's the CLI argument (Docker docs don't seem to have it yet):

docker run --help | grep cgroup
      --cgroupns string                Cgroup namespace to use (host|private)
                                       'host':    Run the container in the Docker host's cgroup namespace
                                       'private': Run the container in its own private cgroup namespace
                                       '':        Use the cgroup namespace as configured by the
                                                  default-cgroupns-mode option on the daemon (default)

[guard43ru]

Docker Desktop 4.3.0 now uses cgroupv2 (https://docs.docker.com/desktop/mac/release-notes/#docker-desktop-430)
I can run container (with systemd) from docker run (with --cgroupns=host), but can't start from docker-compose

[rijnhard]

This is seriously madness-inducing.
One of the benefits of docker being able to align local env's with production, and in cases where PaaS solutions use centos 7 systemd-based containers, there really is no hope for me to make a compose file to simplify the local envs for developers.

[ndeloof]

so much votes on this issue, and nobody took a few minutes to propose a PR ? 😅
so, here it is: #292 🎅