1

I am running docker in isolate mode with daemon.json having:

"group": "devgp",
"userns-remap": "default",

and 'devgp' being a group defined in LDAP via sssd. Meaning it is not known on the system at boot till networking is working and sssd is running.

Docker fails to start at boot but starts fine manually afterward. In the syslog we find

Nov 29 18:30:18 dotter systemd: Failed to chown socket at step GROUP: No such process
Nov 29 18:30:18 dotter systemd: docker.socket control process exited, code=exited status=216
Nov 29 18:30:18 dotter systemd: Failed to listen on Docker Socket for the API.
Nov 29 18:30:18 dotter systemd: Dependency failed for Docker Application Container Engine.
Nov 29 18:30:18 dotter systemd: Job docker.service/start failed with result 'dependency'.
Nov 29 18:30:18 dotter systemd: Unit docker.socket entered failed state.

Okay, so I need to make the docker tasks depend on network and sssd. So I create /etc/systemd/system/docker.socket.d/override.conf with:

[Unit]
After=network-online.target firewalld.service containerd.service sssd.service
Wants=network-online.target sssd.service

[Socket]
SocketGroup=qtim

and create /etc/systemd/system/docker.service.d/override.conf with:

[Unit]
After=sssd.service

but it still does not work and syslog has these messages:

Nov 30 08:02:37 dotter systemd: Found ordering cycle on sockets.target/start
Nov 30 08:02:37 dotter systemd: Found dependency on docker.socket/start
Nov 30 08:02:37 dotter systemd: Found dependency on firewalld.service/start
Nov 30 08:02:37 dotter systemd: Found dependency on basic.target/start
Nov 30 08:02:37 dotter systemd: Found dependency on sockets.target/start
Nov 30 08:02:37 dotter systemd: Breaking ordering cycle by deleting job docker.socket/start
Nov 30 08:02:37 dotter systemd: Job docker.socket/start deleted to break ordering cycle starting with sockets.target/start

and therefore doesn't even try to start Docker.

Any idea the magic to get systemd to start Docker socket and service only after network and sssd have started?

0

I had the same problem in a FreeIPA environment. Firstly, I tried something similar but modifying the docker.socket you get an error about the ordering cycle. Finnaly I just added this line to the docker.service and it worked to me:

Wants=network-online.target sssd.service

/lib/systemd/system/docker.service

[Unit]
Description=Docker Application Container Engine
Documentation=https://docs.docker.com
After=network-online.target firewalld.service containerd.service
Wants=network-online.target sssd.service
Requires=docker.socket containerd.service

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.