Bug 1932739

Summary: Rootless Podman doesn't work with cgroups v2
Product: Red Hat Enterprise Linux 8 Reporter: Mike Rochefort <mroche>
Component: podmanAssignee: Tom Sweeney <tsweeney>
Status: CLOSED DUPLICATE QA Contact: atomic-bugs <atomic-bugs>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 8.3CC: bbaude, dwalsh, jligon, jnovy, lsm5, mheon, ossman, pthomas, umohnani
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-03-02 22:28:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mike Rochefort 2021-02-25 05:44:18 UTC
Bringing my info over from https://github.com/containers/podman/issues/9410:

I recently upgraded my workstation to the latest 8.3 packages available (was already on 8.3 as of Dec 1) and I can no
longer run any container on my system via rootless. My workstation has been using cgroups v2 with crun since 8.3 dropped
with no problem. However, with podman-2.2.1-7.module+el8.3.1+9857+68fb1526.x86_64 this no longer works. I can confirm that
reverting to cgroups v1 solves this issue.

Podman Version:

Version:      2.2.1
API Version:  2
Go Version:   go1.14.7
Built:        Mon Feb  8 16:19:06 2021
OS/Arch:      linux/amd64



Podman Info --debug:

host:
  arch: amd64
  buildahVersion: 1.18.0
  cgroupManager: systemd # cgroupfs also doesn't work
  cgroupVersion: v2
  conmon:
    package: conmon-2.0.22-3.module+el8.3.1+9857+68fb1526.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.0.22, commit: a40e3092dbe499ea1d85ab339caea023b74829b9'
  cpus: 12
  distribution:
    distribution: '"rhel"'
    version: "8.3"
  eventLogger: file
  hostname: workstation.omenos.local
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 4.18.0-240.15.1.el8_3.x86_64
  linkmode: dynamic
  memFree: 14667104256
  memTotal: 33434611712
  ociRuntime:
    name: crun
    package: crun-0.16-2.module+el8.3.1+9857+68fb1526.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 0.16
      commit: eb0145e5ad4d8207e84a327248af76663d4e50dd
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  remoteSocket:
    path: /run/user/1000/podman/podman.sock
  rootless: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.1.8-1.module+el8.3.1+9857+68fb1526.x86_64
    version: |-
      slirp4netns version 1.1.8
      commit: d361001f495417b880f20329121e3aa431a8f90f
      libslirp: 4.3.1
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.4.3
  swapFree: 16894652416
  swapTotal: 16894652416
  uptime: 1h 36m 51.14s (Approximately 0.04 days)
registries:
  search:
  - registry.redhat.io
  - registry.access.redhat.com
  - registry.fedoraproject.org
  - registry.centos.org
  - docker.io
store:
  configFile: /home/omenos/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mount_program:
      Executable: /usr/bin/fuse-overlayfs
      Package: fuse-overlayfs-1.3.0-2.module+el8.3.1+9857+68fb1526.x86_64
      Version: |-
        fusermount3 version: 3.2.1
        fuse-overlayfs: version 1.3
        FUSE library version 3.2.1
        using FUSE kernel interface version 7.26
  graphRoot: /home/omenos/.local/share/containers/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 1
  runRoot: /run/user/1000
  volumePath: /home/omenos/.local/share/containers/storage/volumes
version:
  APIVersion: "2"
  Built: 1612819146
  BuiltTime: Mon Feb  8 16:19:06 2021
  GitCommit: ""
  GoVersion: go1.14.7
  OsArch: linux/amd64
  Version: 2.2.1


Resulting Error:

$ podman run --rm -it registry.redhat.io/ubi8/ubi:latest
Error: OCI runtime error: the requested cgroup controller `pids` is not available

I noticed there's this ticket: https://bugzilla.redhat.com/show_bug.cgi?id=1903983 which states Podman 3.x will be arriving
in RHEL 8.4. In all likelihood I would expect to solve this issue, but I don't know if this is a podman issue or a crun issue.

Comment 1 Pierre Ossman 2021-02-25 08:26:09 UTC
Dup of bug 1897579?

Comment 2 Mike Rochefort 2021-02-25 14:30:16 UTC
Yep, missed that one while doing a late night search. A dupe, and the temporary workaround of setting "pids_limit = 0" works for now.

Comment 3 Tom Sweeney 2021-03-02 22:28:57 UTC
Closing as a dupe based on the previous comment.

*** This bug has been marked as a duplicate of bug 1897579 ***