[systemd-devel] How to use cgroups within containers?

[Lennart Poettering]

On Fri, 17.10.14 23:35, Richard Weinberger (richard.weinberger at gmail.com) wrote:

> Dear systemd and container folks,
> 
> at Plumbers the question raised how to provide cgroups to a systemd that lives
> in a container (with user namespaces).
> Due to the GDL train strikes I had to leave very soon and had no chance to
> talk to you in person.
> 
> Was a solution proposed?
> All I want to know is how to provide cgroups in a sane and secure way
> to systemd. :-)

The cgroups setup systemd requires to be able to run cleanly without
changes in a container is documented here:

http://www.freedesktop.org/wiki/Software/systemd/ContainerInterface/

You have to mount the full cgroupfs hierarchies into the containers,
so that /proc/$PID/cgroup makes sense inside the containers (that file
lists absolute paths...). They can be mounted read-only up to the
container's root, but further down they need to be writable to the
container, so that systemd inside the container can do its job.

If a container manager does not mount them systemd will mount them on
its own.

Lennart

-- 
Lennart Poettering, Red Hat