stage1: common: join a subcgroup if we're in the root one

systemd-nspawn doesn't allow the caller process to be in the root
cgroup. If that is the case, we create and add ourselves to a new "rkt"
subcgroup.

Distributions like Void Linux put every process in the root cgroup by
default so this allows rkt to work on them.

common/cgroup/cgroup.go

@@ -210,6 +210,21 @@ func GetOwnCgroupPath(controller string) (string, error) {
 	return parts[2], nil
 }
 
+// JoinCgroup makes the calling process join the subcgroup hierarchy on a
+// particular controller
+func JoinSubcgroup(controller string, subcgroup string) error {
+	subcgroupPath := filepath.Join("/sys/fs/cgroup", controller, subcgroup)
+	if err := os.MkdirAll(subcgroupPath, 0600); err != nil {
+		return fmt.Errorf("error creating rkt subcgroup: %v", err)
+	}
+	pidBytes := []byte(strconv.Itoa(os.Getpid()))
+	if err := ioutil.WriteFile(filepath.Join(subcgroupPath, "cgroup.procs"), pidBytes, 0600); err != nil {
+		return fmt.Errorf("error adding ourselves to the rkt subcgroup: %v", err)
+	}
+
+	return nil
+}
+
 // If /system.slice does not exist in the cpuset controller, create it and
 // configure it.
 // Since this is a workaround, we ignore errors

stage1/init/init.go

@@ -718,6 +718,15 @@ func getContainerSubCgroup(machineID string) (string, error) {
 			if err != nil {
 				return "", fmt.Errorf("could not get own cgroup path: %v", err)
 			}
+			// systemd-nspawn won't work unless we're in a subcgroup. If we're
+			// in the root cgroup, we create a "rkt" subcgroup and we add
+			// ourselves to it
+			if ownCgroupPath == "/" {
+				ownCgroupPath = "/rkt"
+				if err := cgroup.JoinSubcgroup("systemd", ownCgroupPath); err != nil {
+					return "", fmt.Errorf("error joining %s subcgroup: %v", ownCgroupPath, err)
+				}
+			}
 			subcgroup = filepath.Join(ownCgroupPath, "system.slice")
 		}
 	}