0

I'm encountering what seems like a bug with the socket activation mechanism for podman, though I'm not sure if the issue is podman or systemd.

I created an alternative managed socket unit for the podman service in order to expose the standard /run/docker.socket path expected by default by docker tooling:

# systemctl cat docker.socket
# /etc/systemd/system/docker.socket
[Unit]
Description=Docker API Socket
Documentation=man:podman-system-service(1)

[Socket]
ListenStream=%t/docker.sock
SocketMode=0660
Service=podman.service

[Install]
WantedBy=sockets.target

[Socket]
SocketGroup=wheel

Basically the same thing as the default podman.socket unit.

Now I'm not sure if having multiple socket activating the same service is problematic, didn't seem to be the case up until now, but assuming the default podman.socket unit is properly disabled.

Now if I try and connect to the socket(e.g. nc -D -U /run/docker.sock), thus activating the podman service, podman gets thrown into a failure loop:

Mar 10 14:38:17 drpyser-workstation podman[266938]: time="2023-03-10T14:38:17-05:00" level=info msg="/usr/bin/podman filtering at log level info"
Mar 10 14:38:17 drpyser-workstation podman[266938]: time="2023-03-10T14:38:17-05:00" level=info msg="Setting parallel job count to 49"
Mar 10 14:38:17 drpyser-workstation podman[266938]: time="2023-03-10T14:38:17-05:00" level=info msg="Using systemd socket activation to determine API endpoint"
Mar 10 14:38:17 drpyser-workstation podman[266938]: Error: wrong number of file descriptors for socket activation protocol (2 != 1)
Mar 10 14:38:17 drpyser-workstation systemd[1]: podman.service: Main process exited, code=exited, status=125/n/a
Mar 10 14:38:17 drpyser-workstation systemd[1]: podman.service: Failed with result 'exit-code'

(this repeats for a while until it tires out)

I believe I can observe the condition podman is complaining about by looking at listeners on /run/docker.sock when I activate it. Before I activate the socket, lsof /run/docker.sock shows

COMMAND PID USER   FD   TYPE             DEVICE SIZE/OFF   NODE
 NAME
systemd   1 root   47u  unix 0x00000000bad2c1a8      0t0 776246
 /run/docker.sock type=STREAM (LISTEN)

So far so good, systemd is doing its job of listening on the socket waiting for incoming connections to pass on to podman.

When I activate the socket:

COMMAND PID USER   FD   TYPE             DEVICE SIZE/OFF   NODE
 NAME
systemd   1 root   47u  unix 0x00000000bad2c1a8      0t0 776246
 /run/docker.sock type=STREAM (LISTEN)
systemd   1 root   49u  unix 0x00000000dec938bb      0t0 802883
 /run/docker.sock type=STREAM (LISTEN)

Now is this behavior normal? Is this systemd spawning a new file descriptor on the socket to pass on to podman, while still listening to incoming connections, in which case podman has no business complaining, and I should file a bug report to the podman team?

Thanks.

EDIT: actually, there seems to be some weird circular dependency going on because of my two socket units. docker.socket won't work if I mask podman.socket:

Mar 10 16:03:49 drpyser-workstation systemd[1]: docker.socket: Failed to queue service startup job (Maybe the service file is missing or not a non-template unit?): Unit podman.socket is masked.
Mar 10 16:03:49 drpyser-workstation systemd[1]: docker.socket: Failed with result 'resources'.

I'm failing to find a way to cut the dependency between podman.service and podman.socket:

podman.service
× ├─docker.socket
○ ├─podman.socket
● ├─system.slice
● └─sysinit.target
●   [...]

Despite playing around with overrides:

# /usr/lib/systemd/system/podman.service
[Unit]
Description=Podman API Service
Requires=podman.socket
After=podman.socket
Documentation=man:podman-system-service(1)
StartLimitIntervalSec=0

[Service]
Delegate=true
Type=exec
KillMode=process
Environment=LOGGING="--log-level=info"
ExecStart=/usr/bin/podman $LOGGING system service

[Install]
WantedBy=default.target

# /etc/systemd/system/podman.service.d/override.conf
[Unit]
Requires=
After=
Requires=docker.socket
After=docker.socket

Is there a way to make systemd understand I want to cut podman.socket out?

2 Answers 2

1

Now I'm not sure if having multiple socket activating the same service is problematic, didn't seem to be the case up until now, but assuming the default podman.socket unit is properly disabled.

The command

podman system service

does not currently support more than one listening socket.

Relevant source code (with a permalink into GitHub main branch as of 2 July 2023):

https://github.com/containers/podman/blob/539be58163a1730af0d84b39fcde585983cd9925/cmd/podman/system/service_abi.go#L48-L50

See also: podman GitHub issue #17754 ("Error: wrong number of file descriptors for socket activation protocol (2 != 1)")

1

According to the systemd documentation, you are unable to override dependencies of service units:

Dependencies (After=, etc.) cannot be reset to an empty list, so dependencies can only be added in drop-ins. If you want to remove dependencies, you have to override the entire unit.

I have found it easier to install the podman-docker package.

It sets up a script so commands like docker are seamlessly redirected to podman and it also sets up a symlink for /run/docker.sock to point to the Podman socket. No changes to systemd were necessary last time I had to do this, just make sure that podman.socket is enabled and running.

1
  • Hmm, interesting. I did have this package installed(but obviously my docker.socket unit would have overwritten the symlink I suppose), I'll test that out. Mar 13, 2023 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .