should systemd-udev-trigger be masked in container?

Question

I asked this question I think systemd-udev-trigger should not be execute in docker container , whatever it is --privileged or not .

Is there some scenes must need excute systemd-udev-trigger in docker container?

Answer 1

The first, least specific answer to this is that systemd-udev is not designed to run inside containers. And that Docker is not quite intended to run systemd inside it, only a single daemon.

The container image you mentioned does have instructions for running systemd. They involve removing the udev services that would run inside an unprivileged container. This is valid inside a Docker container because you're never supposed to use the package manager after the build process.

In a privileged container, I think these instructions should also be sufficient to disable udev. On my Fedora 26 system, it's a static want of sysinit.target. Notice how the code removes all static wants of sysinit.target, except for systemd-tmpfiles-setup.service.

Systemd integration

Systemd is now included in both the centos:7 and centos:latest base containers, but it is not active by default. In order to use systemd, you will need to include text similar to the example Dockerfile below:

Dockerfile for systemd base image

dockerfile FROM centos:7 ENV container docker RUN (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == \ systemd-tmpfiles-setup.service ] || rm -f $i; done); \ rm -f /lib/systemd/system/multi-user.target.wants/*;\ rm -f /etc/systemd/system/*.wants/*;\ rm -f /lib/systemd/system/local-fs.target.wants/*; \ rm -f /lib/systemd/system/sockets.target.wants/*udev*; \ rm -f /lib/systemd/system/sockets.target.wants/*initctl*; \ rm -f /lib/systemd/system/basic.target.wants/*;\ rm -f /lib/systemd/system/anaconda.target.wants/*; VOLUME [ "/sys/fs/cgroup" ] CMD ["/usr/sbin/init"]

This Dockerfile deletes a number of unit files which might cause issues. From here, you are ready to build your base image.

console $ docker build --rm -t local/c7-systemd .

Example systemd enabled app container

In order to use the systemd enabled base container created above, you will need to create your Dockerfile similar to the one below.

dockerfile FROM local/c7-systemd RUN yum -y install httpd; yum clean all; systemctl enable httpd.service EXPOSE 80 CMD ["/usr/sbin/init"]

Build this image:

console $ docker build --rm -t local/c7-systemd-httpd .

Running a systemd enabled app container

In order to run a container with systemd, you will need to mount the cgroups volumes from the host. Below is an example command that will run the systemd enabled httpd container created earlier.

console $ docker run -ti -v /sys/fs/cgroup:/sys/fs/cgroup:ro -p 80:80 local/c7-systemd-httpd

This container is running with systemd in a limited context, with the cgroups filesystem mounted. There have been reports that if you're using an Ubuntu host, you will need to add -v /tmp/$(mktemp -d):/run in addition to the cgroups mount.