cgroups v2: cgroup controllers not delegated to non-privileged users on CentOS Stream (8)

Question

I am currently trying to configure my more or less fresh installation of CentOS Stream (8) to delegate cgroup controllers to non-privileged users. However, I fail at this and I've searched the web for two days now but I can't find someone with the same or similar problem.

I want to run rootless containers with podman. Yet, I fail at this because a non-privileged user needs to have cgroup controller pids. Yet, the following command yields no result, indicating that there is no cgroup controller available:

$ cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers

As far as I understand, this command should yield in the default configuration something like this (see docker.com):

$ cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers
memory pids

Of course, I already enabled cgroups v2 with systemd.unified_cgroup_hierarchy=1 in /etc/default/grub and rebuilt with grub2-mkconfig.

So, I tried the following command described at docker.com:

# mkdir -p /etc/systemd/system/user@.service.d
# cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF
[Service]
Delegate=cpu cpuset io memory pids
EOF
# systemctl daemon-reload

Finally, I rebooted, but to no avail. There are still no cgroup controllers at all for the non-privileged user.

configuration: CentOS Stream (8) up-to-date, Systemd v239

Answer 1

So, I finally managed to solve the issue. For me, this seems somewhat related to the issue and bug described here, but the solution there did not work for me without additional modifications.

In the following you can find the steps I took to get the delegation of cgroup controllers working. Thanks to Ryutaroh Matsumoto for his work and effort in the question mentioned above and his dive into systemd issues on GitHub.

1. Create the file /etc/systemd/system/user-0.slice as root user with the following contents:

[Unit]
Before=systemd-logind.service
[Slice]
Slice=user.slice
[Install]
WantedBy=multi-user.target

2. Create the file /etc/systemd/system/user@.service.d/delegate.conf as root user with the following contents:

[Service]
Delegate=cpu cpuset io memory pids
EOF

3. Create the file /etc/systemd/system/user-.slice.d/override.conf as root user with the following contents:

[Slice]
Slice=user.slice

CPUAccounting=yes
MemoryAccounting=yes
IOAccounting=yes
TasksAccounting=yes

4. Run sudo systemctl daemon-reload and reboot the machine.

5. Check the delegated controllers for the non-privileged user by running the command cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers.