Remove docker.socket from rpm based systems

[crosbymichael]

Fixes #23981

The selinux issue we are seeing in the report is related to the socket
file for docker and nothing else. By removing the socket docker starts
up correctly.

However, there is another motivation for removing socket activation from
docker's systemd files and that is because when you have daemons running
with --restart always whenever you have a host reboot those daemons
will not be started again because the docker daemon is not started by
systemd until a request comes into the docker API.

Leave it for deb based systems because everything is working correctly
for both socket activation and starting normally at boot.

Signed-off-by: Michael Crosby crosbymichael@gmail.com

[crosbymichael]

Packages tested with both ubuntu 16.04 and fedora 24

[runcom]

LGTM

[vdemeester]

LGTM 🐸
/cc @tiborvass

[thaJeztah]

are we only changing this for RPM installs?

[crosbymichael]

because debs works and rpm does not

[tiborvass]

For the record the only change for the service file is:

@@ -1,7 +1,7 @@
 [Unit]
 Description=Docker Application Container Engine
 Documentation=https://docs.docker.com
-After=network.target docker.socket
+After=network.target
 Requires=docker.socket

 [Service]
@@ -9,7 +9,7 @@
 # the default is not to use systemd for cgroups because the delegate issues still
 # exists and systemd currently does not support the cgroup feature set required
 # for containers run by docker
-ExecStart=/usr/bin/dockerd -H fd://
+ExecStart=/usr/bin/dockerd
 ExecReload=/bin/kill -s HUP $MAINPID
 # Having non-zero Limit*s causes performance problems due to accounting overhead
 # in the kernel. We recommend using cgroups to do container-local accounting.

LGTM

[crosbymichael]

@tiborvass yes, that is the diff for the rpm version

[rhatdan]

@crosbymichael How does Debian handle the Restart problem differently then RPM based systems?

[crosbymichael]

@rhatdan the systemctl enable and start are run in post stop hooks for the install. The user is not expected to do this manually and when we created the RPMs we were told that on RPM based systems that was the opposite . When we created the RPMs we were told that on RPM based systems that the user knows and is expected to run these commands manually after the install.

[rhatdan]

Right no service should be enabled by default. Just installing a package should not imply that you want to run it.

I am questioning the use of docker.socket at all, since this blocks docker restart.

[crosbymichael]

The socket is fine on ubuntu because we enable both the socket and the service. Because the service has the multi-user.target it is started at boot as well as having the socket activation if someone tries to access the socket before the daemon is started.