How does one change the cgroup driver/manager to systemd?

[huyz]

From either docker info or nerdctl info I see that the Alpine VM has:

Server:
 Server Version: v1.6.8
 Storage Driver: overlayfs
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1

How dose one change that to systemd and cgroupv2?

[jandubois]

You cannot switch to systemd because Alpine uses openrc instead, but you can try enabling cgroup v2. What are you trying to achieve?

[huyz]

How would I enable cgroupv2? I'm a newbie.

I thought systemd was necessary to take advantage of cgroupv2. But maybe I'm mistaken?

I'm primarily trying to run an Ubuntu 22.04 container rootless, which starts systemd. https://rootlesscontaine.rs/getting-started/common/cgroup2/ says that I need cgroupv2 for that. It's not strictly necessary for me to have cgroupv2 resource limits, and maybe not even run rootless or even have systemd in the container. I'm just still learning and trying to see what's possible, what's hard, and what will be possible in the near future.

[jandubois]

I think running rootless requires systemd, so this is not going to work.

Rancher Desktop runs the container engines as root, and is not designed to run them at the user level.

What benefits do you expect from running the engine with user privileges?

[huyz]

I don't need the engine to run as a regular user. I just would like the containers to run unprivileged, for security.
Maybe that means I don't actually need "rootless containers" (now that I've re-read definition of "rootless containers" at https://rootlesscontaine.rs/)

My goal is to avoid the following errors when trying to run an unprivileged container with systemd (Btw, I just realized that I do have a hard requirement for systemd):

❯ docker run -it --rm huyz/ansible-molecule-ubuntu:22.04
Failed to mount cgroup at /sys/fs/cgroup/systemd: Operation not permitted
[!!!!!!] Failed to mount API filesystems.
Exiting PID 1...
❯ docker run -it --rm --cgroupns=private huyz/ansible-molecule-ubuntu:22.04
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "cgroup" to rootfs at "/sys/fs/cgroup": mount cgroup:/sys/fs/cgroup/openrc (via /proc/self/fd/7), flags: 0xf, data: openrc: invalid argument: unknown.
❯ docker run -it --rm --privileged huyz/ansible-molecule-ubuntu:22.04
Failed to look up module alias 'autofs4': Function not implemented
systemd 249.11-0ubuntu3.6 running in system mode (+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
Detected virtualization docker.
Detected architecture arm64.
Failed to create symlink /sys/fs/cgroup/net_cls: File exists
Failed to create symlink /sys/fs/cgroup/net_prio: File exists
Failed to create symlink /sys/fs/cgroup/cpu: File exists
Failed to create symlink /sys/fs/cgroup/cpuacct: File exists

Welcome to Ubuntu 22.04.1 LTS!
[…]

It seems I have to run with --cgroupns=host (which seems to be the default in this case) and --privileged. My understanding is that's less secure.

And even with these two settings, I still get a some File exists errors, but perhaps these don't matter.

Maybe I need to do the same as these folks: mviereck/x11docker#349 (comment)