5

I am currently trying to configure my more or less fresh installation of CentOS Stream (8) to delegate cgroup controllers to non-privileged users. However, I fail at this and I've searched the web for two days now but I can't find someone with the same or similar problem.

I want to run rootless containers with podman. Yet, I fail at this because a non-privileged user needs to have cgroup controller pids. Yet, the following command yields no result, indicating that there is no cgroup controller available:

$ cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers

As far as I understand, this command should yield in the default configuration something like this (see docker.com):

$ cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers
memory pids

Of course, I already enabled cgroups v2 with systemd.unified_cgroup_hierarchy=1 in /etc/default/grub and rebuilt with grub2-mkconfig.

So, I tried the following command described at docker.com:

# mkdir -p /etc/systemd/system/user@.service.d
# cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF
[Service]
Delegate=cpu cpuset io memory pids
EOF
# systemctl daemon-reload

Finally, I rebooted, but to no avail. There are still no cgroup controllers at all for the non-privileged user.

configuration: CentOS Stream (8) up-to-date, Systemd v239

1 Answer 1

3

So, I finally managed to solve the issue. For me, this seems somewhat related to the issue and bug described here, but the solution there did not work for me without additional modifications.

In the following you can find the steps I took to get the delegation of cgroup controllers working. Thanks to Ryutaroh Matsumoto for his work and effort in the question mentioned above and his dive into systemd issues on GitHub.

  1. Create the file /etc/systemd/system/user-0.slice as root user with the following contents:
[Unit]
Before=systemd-logind.service
[Slice]
Slice=user.slice
[Install]
WantedBy=multi-user.target
  1. Create the file /etc/systemd/system/user@.service.d/delegate.conf as root user with the following contents:
[Service]
Delegate=cpu cpuset io memory pids
EOF
  1. Create the file /etc/systemd/system/user-.slice.d/override.conf as root user with the following contents:
[Slice]
Slice=user.slice

CPUAccounting=yes
MemoryAccounting=yes
IOAccounting=yes
TasksAccounting=yes
  1. Run sudo systemctl daemon-reload and reboot the machine.

  2. Check the delegated controllers for the non-privileged user by running the command cat /sys/fs/cgroup/user.slice/user-$(id -u).slice/user@$(id -u).service/cgroup.controllers.

4
  • So, while I appreciate this isn't a hugely constructive comment, thought it's worth noting that these steps aren't working for me. I'm still only seeing "memory pids" in cgroup.controllers - running Ubuntu 20.04, with cgroups v2 enabled. The documentation around systemd is really quite poor... I can see why so many despise it. Jul 6, 2021 at 22:38
  • This worked for me (minikube 1.23.2, Ubuntu 20.04.3) Nov 3, 2021 at 12:30
  • It works on CentOS 8.5, CentOS Stream 8 and Rocky 8.5. Mar 21, 2022 at 20:32
  • FWIW, didn't seem to work on Ubuntu 22.04. I tried different methods as well, but something seems to be blocking everything but the memory and pids controllers for unprivileged processes/slices - the user service has them all (but owned by root) but then the app slice falls back to just the two.
    – cdegroot
    Jun 2, 2022 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.