tracker for podman 2.x progress

[dustymabe]

In #560 we elected to pin podman 1.9.3 in our testing and stable streams for now. This ticket will serve as a tracker for existing issues with podman 2.x that could or should block 2.x from hitting testing/stable.

• Pids-limit should only be set if the user set it containers/podman#6842 (suggested by @jdoss)
• After podman 2 upgrade, systemd fails to start in containers on cgroups v1 hosts containers/podman#6734 (suggested by @dustymabe)
• [2.0 regression] /sys/fs/{selinux,cgroup} no longer masked during build (not reproducible with buildah) containers/podman#6879 (suggested by @travier)
• rootless: can't run systemd in a container: Failed to create control group containers/podman#7441 (suggested by @dustymabe)

[dustymabe]

I switched over my weechat node today to the next stream and the container didn't come up because of containers/podman#6734. Running systemd in a container is an important use case. We're hitting the issue because running systemd in a container on cgroups v1 regressed.

[dustymabe]

FYI: If you'd like to test out podman 2.x to find if your containers still work we have docs on how to switch between streams. You should target next.

[dustymabe]

containers/podman#6734 is closed now with the fix in containers/podman#7339. This landed in the 2.0.5 release with containers/podman@ce1389b:

[dustymabe@media podman ((v2.0.5))]$ git tag --contains ce1389b
v2.0.5

I'll try to verify this fixes the problem I was seeing at least.

[travier]

I had containers/podman#6879 opened for podman 2.0 but this should be fixed now with 2.0.5.

[dustymabe]

I had containers/podman#6879 opened for podman 2.0 but this should be fixed now with 2.0.5.

Added it to the list in the description. Thanks!

[dustymabe]

I just opened containers/podman#7441 and added it to the list. Running systemd in a rootless container still does not work.

[dustymabe]

The fix for containers/podman#7441 has been backported to podman 2.0.6 and I've confirmed it seems to fix the problem. I'm thinking that we should get that into next-devel as soon as there is an rpm available for 2.0.6 and then do an ad-hoc next release this week.

Then we could switch over testing in next week's round of releases.

[dustymabe]

Today's next stream release (32.20200901.1.0) includes podman 2.0.6, which should fix all outstanding issues mentioned in this ticket. If all goes well it will land in testing next week. Please give the next stream a spin and report issues!

• download
• switch streams

[dustymabe]

The fix for this went into testing stream release 32.20200907.2.0. Please try out the new release and report issues.

[zyclonite]

@dustymabe could below error be related to that upgrade?

podman[]: Error: requested OCI runtime runc is not compatible with NoCgroups: invalid argument

we are running containers in a systemd unit with --name %N --conmon-pidfile %t/%N.pid --cgroups disabled --log-driver journald so systemd has always control over the process (also following shutdown order)

should cgroups disabled still work?

tested on the current 32.20200907.* releases

[dustymabe]

hey @zyclonite - can you open a new issue for this and we can discuss it more there? When you open the new issue can you mention what version you were upgrading from that your systemd unit worked in?

[dustymabe]

The fix for this went into stable stream release 32.20200907.3.0.

[zyclonite]

@dustymabe did that now, added already our findings as well #634