Alpine Linux and Systemd Containers (Round 2)

Once again, getting Systemd unprivileged containers on Alpine Linux to work.

This is a follow-up on my earlier post, Alpine Linux and Systemd Containers, which a certain point ceased to actually work. After a bit more work, I once again figured out how to run systemd containers on Alpine Linux. This may work for other, non-systemd based systems when it comes to creating systemd containers, but I haven't tested it. Take note that some stuff will be copied from the original post.

Before

Before this was all working, I would get errors like this:

Failed to mount cgroup at /sys/fs/cgroup/systemd: Operation not permitted

and

Failed to create root cgroup hierarchy: No such file or directory
Failed to allocate manager object: No such file or directory

I found a issue, https://github.com/debops/ansible-lxc/issues/15, which described a similar problem, and recommended manually creating the systemd cgroup. I used this on top of my original post to finally get things working again.

1. Dependencies

First you'll need to install some dependencies:

    apk add alpine-sdk automake m4 autoconf libtool fuse fuse-dev linux-vanilla-dev linux-headers libnih-dev linux-pam-dev

2. Install LXCFS

LXCFS has to be installed from source, since it is currently not in the Alpine repos. Download the zip from Github (https://github.com/lxc/lxcfs), unzip it, and cd to the unzipped directory. Then run the following:

      ./bootstrap.sh
      ./configure --prefix=/usr
      make
      make install

3. Add a service

Things a little easier this round. CGmananger doesn't need to be installed. We can do that ourselves! Just to make things easy, I put the script into a OpenRC startup script, which is below. Given you have installed LXCFS, running this service should get you all set to run systemd containers.

#!/sbin/openrc-run
# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$

name="lxcfs"

start() {
        ebegin "Starting lxcfs"

        mkdir -p /sys/fs/cgroup/systemd
        mount -t cgroup -o none,name=systemd systemd /sys/fs/cgroup/systemd
        chown 100000:100000 -R /sys/fs/cgroup/systemd/

        start-stop-daemon --start --exec /usr/bin/lxcfs  --name lxcfs \
        --background --pidfile /var/run/lxcfs.pid --make-pidfile -- /usr/var/lib/lxcfs

        eend $?
}

stop() {
        ebegin "Stopping lxcfs"
        start-stop-daemon --stop --exec /usr/bin/lxcfs --pidfile /var/run/lxcfs.pid --signal KILL
        umount /usr/var/lib/lxcfs/
        eend $?
}

Hopefully this should be it! Contact me at jacob (at) j2h2.com if you have any issues.

Posted Tuesday March 14, 2017

« Adventures with Honeypots -


Recent Posts

  • Alpine Linux and Systemd Containers (Round 2)

    This is a follow-up on my earlier post, Alpine Linux and Systemd Containers , which a certain point ceased to actually work. After a bit more work, I once again figured out how to run systemd containers on Alpine …

    Read More
  • Adventures with Honeypots

    The internet is a big and busy place. Attacks and scans are constantly going on from around the world. It’s a good idea for anyone in cybersecurity to get an idea of what’s going on. What vulnerabilities are being …

    Read More