For cgroupv2, by default Docker uses a private namespace for cgroups. This is controlled by the
--cgroupns flag for
docker run and the
default-cgroupns-mode daemon option. I need to create child cgroups within the container, but the problem is that the root cgroup within the container has an empty
cgroup.subtree_control! I can't populate this within the container, since by the time the container is running, this root cgroup already has processes in it. Attempting to do so results in a "device or resource busy" error.
--cgroupns host would be a workaround, but it's just that — a workaround; it doesn't use the private namespace, which I would like to keep if possible. A further problem is that there's currently no way to set this from a compose file.
I looked into
--cgroup-parent, which can be set via a compose file. However, I don't really understand this setting. I created a cgroup on the host, wrote to
subtree_control, and then tried to start a container using that cgroup as the parent. I received this error, which I didn't understand:
error response from daemon: cgroup-parent for systemd cgroup should be a valid slice named as "xxx.slice"
I thought what this setting would do is change the "current cgroups directories" in the context of the following quote from the
When a process creates a new cgroup namespace using clone(2) or unshare(2) with the CLONE_NEWCGROUP flag, its current cgroups directories become the cgroup root directories of the new namespace.
In any case, it is cumbersome to require a cgroup to be manually provisioned on the host before starting the container. What alternatives do I have to ensure
cgroup.subtree_control in the container has the controllers I need enabled?