Re: [lxc-users] Unable to Start Unprivileged Containers on Debian / Jessie

Mon, 22 Sep 2014 17:17:45 -0700 

On 22/09/14 16:34, Serge Hallyn wrote:

Quoting Naoki Kawakami (dole...@parallels.com):

Hi Chris,

Insure your plato user indeed has write access to the cgroups
created by prep.sh and that the bash PID which would run lxc-start
is indeed in the tasks file of each created cgroup.
I remember having to edit this script because it did not work for me
as is (though I am not on debian-based OS).
This script seems to complete without errors, and I can see what appears to be the desired effect in the hierarchy. Sorry for making it confusing. "socrates" is both the unprivileged user, and the container name. Plato is the physical machine. Putting "Controllers=cpuset cpu cpuacct memory devices freezer net_cls blkio perf_event" into /etc/systemd/logind.conf didn't make any difference, incidentally (systemd version 208-8).
Can someone confirm that the script is/not the problem? Or is there something I'm missing? 

        socrates@plato:~$ find /sys/fs/cgroup/ -ls | grep socrates
        socrates@plato:~$ ./prep.sh
        looking at blkio
        [sudo] password for socrates:
        looking at cgmanager
        looking at cpu
        looking at cpuacct
        looking at cpu,cpuacct
        looking at cpuset
        1
        looking at devices
        looking at freezer
        looking at net_cls
        looking at perf_event
        looking at systemd
        socrates@plato:~$ find /sys/fs/cgroup/ -ls | grep socrates
10533 0 drwxr-xr-x 2 socrates root 60 Sep 23 00:59 /sys/fs/cgroup/cgmanager/socrates 9820 4 -rw-r--r-- 1 socrates socrates 4 Sep 23 00:59 /sys/fs/cgroup/cgmanager/socrates/tasks 10170 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/perf_event/socrates 10174 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/perf_event/socrates/notify_on_release 10173 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/perf_event/socrates/tasks 10172 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/perf_event/socrates/cgroup.clone_children 10171 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/perf_event/socrates/cgroup.procs 9717 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates 9748 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_queued_recursive 9747 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_merged_recursive 9746 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_wait_time_recursive 9745 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_service_time_recursive 9744 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_serviced_recursive 9743 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_service_bytes_recursive 9742 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.sectors_recursive 9741 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.time_recursive 9740 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_queued 9739 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_merged 9738 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_wait_time 9737 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_service_time 9736 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_serviced 9735 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.io_service_bytes 9734 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.sectors 9733 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.time 9732 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.leaf_weight 9731 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.leaf_weight_device 9730 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.weight 9729 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.weight_device 9728 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.throttle.io_serviced 9727 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.throttle.io_service_bytes 9726 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.throttle.write_iops_device 9725 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.throttle.read_iops_device 9724 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.throttle.write_bps_device 9723 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.throttle.read_bps_device 9722 0 --w------- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/blkio.reset_stats 9721 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/notify_on_release 9720 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/tasks 9719 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/cgroup.clone_children 9718 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/blkio/socrates/cgroup.procs 10843 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/net_cls/socrates 10848 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/net_cls/socrates/net_cls.classid 10847 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/net_cls/socrates/notify_on_release 10846 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/net_cls/socrates/tasks 10845 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/net_cls/socrates/cgroup.clone_children 10844 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/net_cls/socrates/cgroup.procs 10062 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates 10069 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/freezer.parent_freezing 10068 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/freezer.self_freezing 10067 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/freezer.state 10066 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/notify_on_release 10065 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/tasks 10064 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/cgroup.clone_children 10063 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/freezer/socrates/cgroup.procs 10014 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates 10021 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/devices.list 10020 0 --w------- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/devices.deny 10019 0 --w------- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/devices.allow 10018 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/notify_on_release 10017 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/tasks 10016 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/cgroup.clone_children 10015 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/devices/socrates/cgroup.procs 9831 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates 9839 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/cpuacct.stat 9838 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/cpuacct.usage_percpu 9837 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/cpuacct.usage 9836 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/cpu.shares 9835 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/notify_on_release 9834 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/tasks 9833 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/cgroup.clone_children 9832 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpu,cpuacct/socrates/cgroup.procs 10724 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates 10739 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.memory_spread_slab 10738 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.memory_spread_page 10737 0 -r--r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.memory_pressure 10736 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.memory_migrate 10735 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.sched_relax_domain_level 10734 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.sched_load_balance 10733 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.mem_hardwall 10732 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.mem_exclusive 10731 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.cpu_exclusive 10730 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.mems 10729 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cpuset.cpus 10728 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/notify_on_release 10727 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/tasks 10726 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cgroup.clone_children 10725 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/cpuset/socrates/cgroup.procs 10215 0 drwxr-xr-x 2 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/systemd/socrates 10219 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/systemd/socrates/notify_on_release 10218 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/systemd/socrates/tasks 10217 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/systemd/socrates/cgroup.clone_children 10216 0 -rw-r--r-- 1 socrates root 0 Sep 23 00:59 /sys/fs/cgroup/systemd/socrates/cgroup.procs 
Indeed it looks like that's the problem.

If you are running systemd, logind should be creating your cgroups
(and placing you in them) for you.  If not, then you can install
systemd-shim and cgmanager, which should do it for you.
I've tried both systemd and now systemd-shim/cgmanager, they both seem to fail. The systemd/cgmanager system doesn't allocate cgroups at login and seems to significantly impair cgroup initiation. 

        socrates@plato:~$ /etc/init.d/cgmanager status
        [ ok ] cgmanager is running.
        socrates@plato:~$ find /sys/fs/cgroup/ -ls | grep socrates
        socrates@plato:~$ ./prep.sh
        looking at cgmanager
        [sudo] password for socrates:
        socrates@plato:~$ find /sys/fs/cgroup/ -ls | grep socrates
8902 0 drwxr-xr-x 2 socrates root 60 Sep 23 01:10 /sys/fs/cgroup/cgmanager/socrates 8925 4 -rw-r--r-- 1 socrates socrates 5 Sep 23 01:10 /sys/fs/cgroup/cgmanager/socrates/tasks 

        root@plato:~# lxc-checkconfig  | grep required
        Cgroup namespace: required
        root@plato:~# mount | grep cgroup
        cgroup on /sys/fs/cgroup type tmpfs (rw,relatime,size=12k)
Any thoughts? In the meantime I'll revert the system back to the default systemd-sysv. 
_______________________________________________
lxc-users mailing list
lxc-users@lists.linuxcontainers.org
http://lists.linuxcontainers.org/listinfo/lxc-users

Reply via email to