cAdvisor docker conatainer: privileged mode

[kavyakul]

Hi,

cAdvisor version: v0.25.0
Docker host: Red Hat Enterprise Linux Server release 7.7 (Maipo)
Kernel: Linux 3.10.0-1062.12.1.el7.x86_64
container-selinux package: container-selinux-2.107-3.el7.noarch

I was trying to start cAdvisor docker container v0.25.0 on RHEL7(SELinux enabled) with privileged mode. Upon checking the container I found that:
Privileged = --security-opt label:disable + capabilities + access to devices + may be something else too

So, I tried restarting my container with just --security-opt label:disable, and the result was same as it was with privileged mode.

Please help me to understand the need of using privileged mode, it could be that the current version of my kernel supports just turning off the labels.

Regards,
Kavya K

[dashpole]

Can you paste the full command you used to start cAsvisor?

[kavyakul]

docker run -dit -v /sys:/sys:ro -v /var/run:/var/run:ro -v /var/lib/docker/:/var/lib/docker:ro -v /cgroup:/cgroup:ro -p 9094:8080 --security-opt label=disable --name "cad_label_disable" cadvisor:0.25.0

[kavyakul]

docker run -dit -v /sys:/sys:ro -v /var/run:/var/run:ro -v /var/lib/docker/:/var/lib/docker:ro -v /cgroup:/cgroup:ro -p 9094:8080 --security-opt label=disable --name "cad_label_disable" cadvisor:0.25.0

I tried with version v0.35.0 as well, but there was error starting the container:
F0415 09:36:27.394559 755 cadvisor.go:186] Failed to start container manager: inotify_add_watch /sys/fs/cgroup/cpuacct,cpu: no such file or directory

[iwankgb]

Looking at:

-v /cgroup:/cgroup:ro

and:

/sys/fs/cgroup/cpuacct,cpu: no such file or directory

makes me think that cgroup filesystem is not mounted where cAdvisor expects it to be.

[kavyakul]

Looking at:

-v /cgroup:/cgroup:ro

and:

/sys/fs/cgroup/cpuacct,cpu: no such file or directory

makes me think that cgroup filesystem is not mounted where cAdvisor expects it to be.

it looks similar to #1890.

But this issue is not there in cadvisor v0.25.0, with disabled labels it works as expected.