Run Docker as SystemD service

Dockerfile

@@ -87,6 +87,7 @@ RUN zypper in -y \
     mdadm \
     multipath-tools \
     nano \
+    net-tools \
     netcat-openbsd \
     nfs-utils \
     open-iscsi \

framework/files/etc/systemd/system/multi-user.target.wants/docker.service

@@ -0,0 +1,47 @@
+[Unit]
+Description=Docker Application Container Engine
+Documentation=https://docs.docker.com
+After=network-online.target docker.socket firewalld.service containerd.service
+Wants=network-online.target containerd.service
+Requires=docker.socket
+
+[Service]
+Type=notify
+# the default is not to use systemd for cgroups because the delegate issues still
+# exists and systemd currently does not support the cgroup feature set required
+# for containers run by docker
+ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
+ExecReload=/bin/kill -s HUP $MAINPID
+TimeoutStartSec=0
+RestartSec=2
+Restart=always
+
+# Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229.
+# Both the old, and new location are accepted by systemd 229 and up, so using the old location
+# to make them work for either version of systemd.
+StartLimitBurst=3
+
+# Note that StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230.
+# Both the old, and new name are accepted by systemd 230 and up, so using the old name to make
+# this option work for either version of systemd.
+StartLimitInterval=60s
+
+# Having non-zero Limit*s causes performance problems due to accounting overhead
+# in the kernel. We recommend using cgroups to do container-local accounting.
+LimitNOFILE=infinity
+LimitNPROC=infinity
+LimitCORE=infinity
+
+# Comment TasksMax if your systemd version does not support it.
+# Only systemd 226 and above support this option.
+TasksMax=infinity
+
+# set delegate yes so that systemd does not reset the cgroups of docker containers
+Delegate=yes
+
+# kill only the docker process, not all processes in the cgroup
+KillMode=process
+OOMScoreAdjust=-500
+
+[Install]
+WantedBy=multi-user.target

framework/files/system/oem/01_ros-rootfs.yaml

@@ -28,10 +28,7 @@ stages:
           /usr/libexec
           /var/log
           /var/lib/rancher
-          /var/lib/kubelet
-          /var/lib/wicked
-          /var/lib/longhorn
-          /var/lib/cni
+          /var/lib/docker
         PERSISTENT_STATE_BIND: "true"
   rootfs.before:
     - name: "Pull data from provider"

scripts/package

@@ -43,8 +43,6 @@ if [ "${TAG}" = "dev" ]; then
     PXE_ASSET_VERSION=${TAG}
 fi
 
-./scripts/package-helm
-
 cat > build/output.ipxe << EOF
 #!ipxe
 set arch ${ARCH}