does it work on hosts without systemd?

[lonestaritaly]

hello,
I run docker on Slackware with sysvinit and on Alpine Linux with openrc. Does the container use systemd only internally or it also needs it to be present in the docker host?

[jmrplens]

systemd only runs inside the container, as its PID 1; the host does not need it. What the host has to provide is a cgroup layout that systemd inside can use, and that depends on how your init mounts /sys/fs/cgroup, not on the init itself.

I checked it on a Docker host without systemd: a docker:dind container in its own cgroup namespace, whose PID 1 is docker-init, with dockerd on the cgroupfs driver and cgroup v2. I ran the image with the settings from this repo's docker-compose.yaml (cgroup: host, /sys/fs/cgroup:/sys/fs/cgroup:rw, the tmpfs mounts, NET_RAW and NET_ADMIN). The systemd inside is 247 (the image is Debian 11), it reached running with 19 services up and none failed, and the web UI answered 200 on 11443.

For your two hosts, check what is mounted at /sys/fs/cgroup:

grep cgroup /proc/mounts

A single cgroup2 /sys/fs/cgroup line is cgroup v2, the case I tested. A tmpfs on /sys/fs/cgroup with cgroup lines under it is v1.

Alpine with OpenRC mounts cgroup v2 unless you changed it, from Alpine 3.19 on: rc_cgroup_mode defaults to unified there (3.18 still defaulted to hybrid). That is the same cgroup layout I tested, although not on Alpine itself, so the compose file should work as it is.

Slackware is the one to watch. The stock rc.S in 15.0 mounts a tmpfs on /sys/fs/cgroup and one cgroup v1 hierarchy per controller under it, and nothing else. On cgroup v1, systemd 247 also needs its own named hierarchy at /sys/fs/cgroup/systemd, which a systemd host creates at boot and Slackware never does. The container cannot mount it itself without CAP_SYS_ADMIN, and systemd exits with code 255 in a container when that mount fails. The closest I could get to it here (a tmpfs at /sys/fs/cgroup with per-controller directories and no systemd one, passed to the container instead of the real one) exited at once with exactly 255, and docker logs only showed the entrypoint's own lines, so do not expect an error message there.

Two ways around it. On Slackware -current, rc.S can mount cgroup v2 instead: set CGROUPS_VERSION=2 in /etc/default/cgroups and reboot, which gives you the layout I tested. On 15.0 there is no such switch, so create the named hierarchy on the host before Docker starts, for example at the top of /etc/rc.d/rc.local ahead of rc.docker start, since a manual mount is gone after a reboot:

mkdir -p /sys/fs/cgroup/systemd
mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd

I could not test that last part end to end, because my lab would not let me mount a cgroup v1 hierarchy.

[lonestaritaly]

Thank you very much for your time and detailed reply!

I've just enabled cgroups v2 on my Slackware current and the container started and worked regularly. I've also imported backed up setup from legacy UniFi Network Controller and it seems to be working as expected. Great job!