Re: [atomic-devel] Systemd, containers, and pid=host

[Daniel J Walsh <dwalsh redhat com>]

On 03/12/2015 03:35 PM, Lars Kellogg-Stedman wrote:
> On Thu, Mar 12, 2015 at 01:21:01PM -0400, Daniel J Walsh wrote:
>> docker run -d -v /sys/fs/cgroup:/sys/fs/cgroup -n MYUNIT MYUNIT
>>  
>> With docker-1.5.0 in rhel this should run systemd within a container
> Have we done something to remove the requirement for --privileged when
> using systemd in a container?  With vanilla docker, units making use
> of, e.g., PrivateTmp=true will fail without CAP_SYS_ADMIN.
>
We have containers in RHEL and Centos which do not have this requirement.

We are moving the patches into Fedora/Rawhide now.  There are two
patches that have
not been accepted upstream yet, which have kept us from doing this til now.

I think systemd will be the best option for this.  Perhaps we could
cause the /sys/fs/cgroup to
be mounted with a command, to keep systemd happy.