For cgroupv2, by default Docker uses a private namespace for cgroups. This is controlled by the --cgroupns flag for docker run and the default-cgroupns-mode daemon option. I need to create child cgroups within the container, but the problem is that the root cgroup within the container has an empty cgroup.subtree_control! I can't populate this within the container, since by the time the container is running, this root cgroup already has processes in it. Attempting to do so results in a "device or resource busy" error.
--cgroupns host would be a workaround, but it's just that — a workaround; it doesn't use the private namespace, which I would like to keep if possible. A further problem is that there's currently no way to set this from a compose file.
I looked into --cgroup-parent, which can be set via a compose file. However, I don't really understand this setting. I created a cgroup on the host, wrote to subtree_control, and then tried to start a container using that cgroup as the parent. I received this error, which I didn't understand:
error response from daemon: cgroup-parent for systemd cgroup should be a valid slice named as "xxx.slice"
I thought what this setting would do is change the "current cgroups directories" in the context of the following quote from the cgroup_namespaces manpage:
When a process creates a new cgroup namespace using clone(2) or unshare(2) with the CLONE_NEWCGROUP flag, its current cgroups directories become the cgroup root directories of the new namespace.
In any case, it is cumbersome to require a cgroup to be manually provisioned on the host before starting the container. What alternatives do I have to ensure cgroup.subtree_control in the container has the controllers I need enabled?
cgroup-parentI just had to append.sliceto the cgroup's name. This solves the immediate error but not the main problem. The container's cgroup does get created within the parent I configured, but that child cgroup still has an emptysubtree_controlrather than inheriting it from its parent.