Add user systemd service and socket #3662

marusak · 2019-07-29T09:01:57Z

This enables user to interact with varlink.
Before this PR user could only do sudo varlink call unix:/run/podman/io.podman/io.podman.ListContainer to list containers owned by root. With this PR a normal user can also call varlink call unix:/run/user/1000/podman/io.podman/io.podman.ListContainers which lists user owned containers.

I have one problem though. Can someone please give me some hints, I admit I don't really understand how and why pause.pid is used, but it seems it causes some problem. Here is how to reproduce my problem:

This works just fine after I start my machine. Steps I do:

systemctl --user start io.podman.socket
varlink call unix:/run/user/1000/podman/io.podman/io.podman.ListContainers

 "containers": [
    {
      "command": [
        "/bin/bash"
      ],
      "containerrunning": false,
      "createdat": "2019-07-29T10:25:30+02:00",
      "id": "11d619fcd6ec3d4f9f6ebe663c87d270797980703089af594a4a13fd82b5f3d4",
      "image": "docker.io/library/fedora:latest",
      "imageid": "d09302f77cfcc3e867829d80ff47f9e7738ffef69730d54ec44341a9fb1d359b",
      "labels": {
        "maintainer": "Clement Verna <[email protected]>"
      },
      "mounts": [
        {
...

When I do any other varlink call (for example the same as in 2.) I get Unable to connect: CannotConnect

$ systemctl --user status io.podman.socket
● io.podman.socket - Podman Remote API Socket
   Loaded: loaded (/usr/lib/systemd/user/io.podman.socket; disabled; vendor preset: enabled)
   Active: failed (Result: service-start-limit-hit) since Mon 2019-07-29 10:35:00 CEST; 7s ago
     Docs: man:podman-varlink(1)
   Listen: /run/user/1000/podman/io.podman (Stream)

Jul 29 10:34:16 dhcppc4 systemd[1338]: Listening on Podman Remote API Socket.
Jul 29 10:35:00 dhcppc4 systemd[1338]: io.podman.socket: Failed with result 'service-start-limit-hit'.

$ systemctl --user status io.podman.service
● io.podman.service - Podman Remote API Service
   Loaded: loaded (/usr/lib/systemd/user/io.podman.service; disabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Mon 2019-07-29 10:35:00 CEST; 19s ago
     Docs: man:podman-varlink(1)
  Process: 16351 ExecStart=/usr/bin/podman varlink unix:/run/user/1000/podman/io.podman (code=exited, status=1/FAILURE)
 Main PID: 16351 (code=exited, status=1/FAILURE)

Jul 29 10:35:00 dhcppc4 systemd[1338]: Started Podman Remote API Service.
Jul 29 10:35:00 dhcppc4 podman[16351]: time="2019-07-29T10:35:00+02:00" level=error msg="cannot join pause process.  You may need to remove /run/user/1000/libpod/pause.pid and stop all containers"
Jul 29 10:35:00 dhcppc4 podman[16351]: time="2019-07-29T10:35:00+02:00" level=error msg="you can use `system migrate` to recreate the pause process"
Jul 29 10:35:00 dhcppc4 podman[16351]: time="2019-07-29T10:35:00+02:00" level=error msg="open /proc/16176/ns/user: no such file or directory"
Jul 29 10:35:00 dhcppc4 systemd[1338]: io.podman.service: Main process exited, code=exited, status=1/FAILURE
Jul 29 10:35:00 dhcppc4 systemd[1338]: io.podman.service: Failed with result 'exit-code'.
Jul 29 10:35:00 dhcppc4 systemd[1338]: io.podman.service: Start request repeated too quickly.
Jul 29 10:35:00 dhcppc4 systemd[1338]: io.podman.service: Failed with result 'exit-code'.
Jul 29 10:35:00 dhcppc4 systemd[1338]: Failed to start Podman Remote API Service.

Removing /run/user/1000/libpod/pause.pid and restarting both socket and service I can get it to the same state as after boot, but doing varlink call gets it back to the same failed state. (varlink call returns Connection closed.)

If I reboot the machine I can do exactly one varlink call and then get back to this failed state.

openshift-ci-robot · 2019-07-29T09:02:17Z

Hi @marusak. Thanks for your PR.

I'm waiting for a containers or openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rh-atomic-bot · 2019-07-29T09:09:29Z

Can one of the admins verify this patch?
I understand the following commands:

bot, add author to whitelist
bot, test pull request
bot, test pull request once

mheon · 2019-07-29T13:30:37Z

@baude PTAL

rhatdan · 2019-07-29T19:43:46Z

I think the latest podman commands work without setting up a systemd unit file/service.

podman-remote commands are supposed to automatically launch a podman varlink session to handle the remote connection.

baude · 2019-07-29T20:18:12Z

this is true for podman-remote when using the bridge.

giuseppe · 2019-07-30T08:41:40Z

I have one problem though. Can someone please give me some hints, I admit I don't really understand how and why pause.pid is used, but it seems it causes some problem. Here is how to reproduce my problem:

pause.pid is used for rootless containers to keep the user namespace alive so that all containers can run from the same namespace.

Looks like systemd is killing all the processes in the cgroup when you start it from a unit file.

Can you try with KillMode=none in the service file? I think we need to require it for rootless containers

marusak · 2019-07-30T09:47:33Z

Can you try with KillMode=none in the service file?

Awesome, adding it into the service file fixes it. Is KillMode=none unwanted for root containers? If it can go into the same service file or we need to crate two different ones?

giuseppe · 2019-07-30T10:06:33Z

Awesome, adding it into the service file fixes it. Is KillMode=none unwanted for root containers? If it can go into the same service file or we need to crate two different ones?

root containers don't need a pause process as they don't need to join the same user namespace.

giuseppe · 2019-07-30T10:07:33Z

Awesome, adding it into the service file fixes it. Is KillMode=none unwanted for root containers? If it can go into the same service file or we need to crate two different ones?

although we can probably simplify and add it for root containers as well

giuseppe · 2019-07-30T10:14:58Z

@marusak could you amend your patch to include it?

marusak · 2019-07-30T10:19:45Z

could you amend your patch to include it?

of course, I'll push here in a bit.
Are there tests for these varlink stuff where I should also test that it works with normal user?

giuseppe · 2019-07-30T10:22:06Z

I don't think we have tests for io.podman.service

marusak · 2019-07-30T10:37:32Z

Updated

giuseppe · 2019-07-30T10:39:19Z

/ok-to-test
/approve

openshift-ci-robot · 2019-07-30T10:39:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, marusak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

giuseppe · 2019-07-30T10:40:59Z

please add a Signed-off-by: to the commit and repush.

You can do it with git commit --amend -s

marusak · 2019-07-30T10:41:53Z

Added Signed-off-by line

marusak · 2019-08-05T11:33:30Z

One issue I've found. Not sure if this is related to these changes or this has nothing to do with this change, but I cannot call GetContainerStats, see:

$ podman run -dit --name foo fedora
fe2a46137a99962f25b152c851f0e58d8974b7d990ff49e40705e2a4e87cb309

$ varlink call unix:/run/user/1000/podman/io.podman/io.podman.GetContainerStats '{ "name": "foo" }'
Call failed with error: io.podman.ErrorOccurred
{
  "reason": "unable to load cgroup at /libpod_parent/libpod-fe2a46137a99962f25b152c851f0e58d8974b7d990ff49e40705e2a4e87cb309: cgroups: cgroup deleted"
}

$ podman ps
CONTAINER ID  IMAGE                            COMMAND    CREATED         STATUS             PORTS  NAMES
fe2a46137a99  docker.io/library/fedora:latest  /bin/bash  20 seconds ago  Up 19 seconds ago         foo
0eaa3d1b2e57  docker.io/library/fedora:latest  /bin/bash  3 hours ago     Up 3 hours ago            stoic_kapitsa

mheon · 2019-08-05T12:57:50Z

I think stats is an expected failure for rootless - probably need to touch up the error message.

It requires CGroups to be present, but rootless Podman has no privileges to make CGroups.

rhatdan · 2019-08-05T13:02:27Z

No privs for cgroupsV1...

marusak · 2019-08-07T13:43:24Z

I opened #3749 not to block this as that happens on master as well.

marusak · 2019-08-12T09:49:27Z

Does this need some additional attention from my side?

rhatdan · 2019-08-12T17:36:22Z

@marusak Can you rebase and repush. There were lots of fixes in the CI system on Friday, that should make this PR mergable.

marusak · 2019-08-12T17:58:29Z

Can you rebase and repush.

Done

rhatdan · 2019-08-12T19:03:30Z

Makefile

@@ -397,7 +398,9 @@ install.docker: docker-docs
 install.systemd:
 	install ${SELINUXOPT} -m 755 -d ${DESTDIR}${SYSTEMDDIR} ${DESTDIR}${TMPFILESDIR}


You need to crate your ${DESTDIR}${USERSYSTEMDDIR} here.

Thanks for spotting! fixed

rhatdan · 2019-08-12T19:05:17Z

Makefile

@@ -397,7 +398,9 @@ install.docker: docker-docs
 install.systemd:
 	install ${SELINUXOPT} -m 755 -d ${DESTDIR}${SYSTEMDDIR} ${DESTDIR}${TMPFILESDIR}
 	install ${SELINUXOPT} -m 644 contrib/varlink/io.podman.socket ${DESTDIR}${SYSTEMDDIR}/io.podman.socket
+	install ${SELINUXOPT} -m 644 contrib/varlink/io.podman.socket ${DESTDIR}${USERSYSTEMDDIR}/io.podman.socket


Or do we need a -D in install.

This enables user to interact with varlink and create/manage rootless containers through it. Using as: `varlink call unix:/run/user/1000/podman/io.podman/io.podman.ListContainers` Signed-off-by: Matej Marusak <[email protected]>

rhatdan · 2019-08-13T12:14:09Z

LGTM
@baude @mheon @jwhonce PTAL

rhatdan · 2019-08-13T12:21:49Z

@giuseppe @vrothberg PTAL

vrothberg

LGTM

rhatdan · 2019-08-13T13:42:01Z

/lgtm

openshift-ci-robot requested review from mrunalp and TomSweeneyRedHat July 29, 2019 09:01

openshift-ci-robot added the size/S label Jul 29, 2019

openshift-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jul 29, 2019

marusak changed the title ~~foo: Add user systemd service and socket~~ Add user systemd service and socket Jul 29, 2019

marusak force-pushed the user_socket_service branch from 254b600 to 241c46c Compare July 30, 2019 10:37

openshift-ci-robot added ok-to-test and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 30, 2019

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 30, 2019

marusak force-pushed the user_socket_service branch from 241c46c to d106ab2 Compare July 30, 2019 10:41

marusak mentioned this pull request Aug 8, 2019

Show user owned containers and images cockpit-project/cockpit-podman#173

Merged

8 tasks

marusak force-pushed the user_socket_service branch from d106ab2 to d14c23a Compare August 12, 2019 17:56

rhatdan reviewed Aug 12, 2019

View reviewed changes

Add user systemd service and socket

daf7044

This enables user to interact with varlink and create/manage rootless containers through it. Using as: `varlink call unix:/run/user/1000/podman/io.podman/io.podman.ListContainers` Signed-off-by: Matej Marusak <[email protected]>

marusak force-pushed the user_socket_service branch from d14c23a to daf7044 Compare August 13, 2019 05:01

vrothberg reviewed Aug 13, 2019

View reviewed changes

openshift-ci-robot assigned rhatdan Aug 13, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 13, 2019

openshift-merge-robot merged commit b6c9b10 into containers:master Aug 13, 2019

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 26, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 26, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add user systemd service and socket #3662

Add user systemd service and socket #3662

marusak commented Jul 29, 2019

openshift-ci-robot commented Jul 29, 2019

rh-atomic-bot commented Jul 29, 2019

mheon commented Jul 29, 2019

rhatdan commented Jul 29, 2019

baude commented Jul 29, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

giuseppe commented Jul 30, 2019

giuseppe commented Jul 30, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

giuseppe commented Jul 30, 2019

openshift-ci-robot commented Jul 30, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

marusak commented Aug 5, 2019

mheon commented Aug 5, 2019

rhatdan commented Aug 5, 2019

marusak commented Aug 7, 2019

marusak commented Aug 12, 2019

rhatdan commented Aug 12, 2019

marusak commented Aug 12, 2019

rhatdan Aug 12, 2019

marusak Aug 13, 2019

rhatdan Aug 12, 2019

rhatdan commented Aug 13, 2019

rhatdan commented Aug 13, 2019

vrothberg left a comment

rhatdan commented Aug 13, 2019

		@@ -397,7 +398,9 @@ install.docker: docker-docs
		install.systemd:
		install ${SELINUXOPT} -m 755 -d ${DESTDIR}${SYSTEMDDIR} ${DESTDIR}${TMPFILESDIR}

Add user systemd service and socket #3662

Add user systemd service and socket #3662

Conversation

marusak commented Jul 29, 2019

openshift-ci-robot commented Jul 29, 2019

rh-atomic-bot commented Jul 29, 2019

mheon commented Jul 29, 2019

rhatdan commented Jul 29, 2019

baude commented Jul 29, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

giuseppe commented Jul 30, 2019

giuseppe commented Jul 30, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

giuseppe commented Jul 30, 2019

openshift-ci-robot commented Jul 30, 2019

giuseppe commented Jul 30, 2019

marusak commented Jul 30, 2019

marusak commented Aug 5, 2019

mheon commented Aug 5, 2019

rhatdan commented Aug 5, 2019

marusak commented Aug 7, 2019

marusak commented Aug 12, 2019

rhatdan commented Aug 12, 2019

marusak commented Aug 12, 2019

rhatdan Aug 12, 2019

Choose a reason for hiding this comment

marusak Aug 13, 2019

Choose a reason for hiding this comment

rhatdan Aug 12, 2019

Choose a reason for hiding this comment

rhatdan commented Aug 13, 2019

rhatdan commented Aug 13, 2019

vrothberg left a comment

Choose a reason for hiding this comment

rhatdan commented Aug 13, 2019