[CentOS 7] Missing libsystemd headers

[hswong3i]

For CentOS 7 which already install with following packages (p.s. YAJL installed from CentOS 8 due to too old from CentOS 7):

yum install -y \
  autoconf \
  automake \
  cmake \
  gcc \
  gettext \
  glibc-static \
  libcap-devel \
  libseccomp-devel \
  libtool \
  make \
  systemd-devel
wget http://mirror.centos.org/centos/8/AppStream/x86_64/os/Packages/yajl-2.1.0-10.el8.x86_64.rpm
wget http://mirror.centos.org/centos/8/PowerTools/x86_64/os/Packages/yajl-devel-2.1.0-10.el8.x86_64.rpm
rpm -iv yajl*.rpm

After that try to compile crun with:

git clone https://github.com/containers/crun.git
cd crun
./autogen.sh
./configure

But result with following error message:

checking systemd/sd-bus.h usability... no
checking systemd/sd-bus.h presence... no
checking for systemd/sd-bus.h... no
configure: error: *** Missing libsystemd headers

P.S. other OS such as CentOS 8 or Fedora 32 or Debian 10 or Ubuntu 18.04/19.10/20.04 are all working fine ;-)

Understand that missing systemd/sd-bus.h due to legacy systemd 219 (see systemd/pystemd#4); BTW may I confirm:

• Do crun support CentOS/RHEL 7?
• Beside upgrade YAJL from CentOS 7 2.0.4 to CentOS 8 2.1.0, any else suggested workaround for YAJL?
• Beside upgrade systemd to 231 with https://copr.fedorainfracloud.org/coprs/jsynacek/systemd-backports-for-centos-7/, shall I compile crun with ./configure --disable-systemd?
• Shall we automatically skip and silent error message for missing systemd/sd-bus.h and so compile without it if platform not supported?

[giuseppe]

I confirm that sd_bus is required to work with systemd, so we either use a newer version or --disable-systemd.

Whether disabling systemd is the right choice, depends on your user case. How are you going to use crun?

Similarly for yajl, a newer version that what is available on CentOS 7 is required. An alternative would be to compile a static version for libyajl and use it for building crun.

[hswong3i]

I confirm that sd_bus is required to work with systemd, so we either use a newer version or --disable-systemd.

IMHO upgrading systemd to 231 on CentOS 7 with https://copr.fedorainfracloud.org/coprs/jsynacek/systemd-backports-for-centos-7/ is relatively risky; I prefer with --disable-systemd style.

Whether disabling systemd is the right choice, depends on your user case. How are you going to use crun?

I will use it with both:

• Podman v1.9.2 (https://github.com/alvistack/ansible-role-podman)
• CRI-O v1.18.1 + Kubernetes v1.18.2 (https://github.com/alvistack/ansible-role-cri_o)

Generally I am NOT prefer for running:

• Standard systemd as init inside container
• cgroup v1 nor v2 inside container

Therefore shall I simply compile crun with --disable-systemd for CentOS 7? e.g.

[root@au7koh4waequ-1 ~]# TMP_DIR="$(mktemp -d)" \
      && git clone https://github.com/containers/crun.git $TMP_DIR \
      && cd $TMP_DIR \
      && ./autogen.sh \
      && export CFLAGS="$(pkg-config --cflags libseccomp)" \
      && (./configure || ./configure --disable-systemd) \
      && make \
      && make install
      && rm -rf $TMP_DIR
[root@au7koh4waequ-1 ~]# crun --version
crun version 0.13
commit: e79e4de4ac16da0ce48777afb72c6241de870525
spec: 1.0.0
+SELINUX +APPARMOR +CAP +SECCOMP +YAJL

[giuseppe]

yes, if you disable systemd though, you must ensure the same cgroup driver is used for Podman and CRI-O

[hswong3i]

yes, if you disable systemd though, you must ensure the same cgroup driver is used for Podman and CRI-O

Does this means both podman and crio should use cgroup_manager = "cgroupfs" instead of cgroup_manager = "systemd"?

It looks a bit silly for me since we could use cgroup_manager = "systemd" when running with CentOS 7 + runc + crio + kubernetes + cgroup v1...

[giuseppe]

If crun is compiled only with cgroupfs then yes. I have not really cared about centos 7 so far, but I can take a look and see what is possible to do to get systemd support

[hswong3i]

I really love the idea of crun with c, instead of runc with go from docker; as long as switching all of my Ansible Roles/Collections to crun based I need to find a workable answer for both Ubuntu 18.04/19.10/20.04 and CentOS/RHEL 7/8 and openSUSE 15.1 and Debian 10 and Fedora 32.

Since most of my RHEL-based customers are still running with RHEL 7, in the meantime I will pin cgroup_manager = "cgroupfs" for CentOS/RHEL 7, where leaving all modern OS default with cgroup_manager = "systemd"...

@giuseppe thank you for your interest in crun with systemd support on CentOS 7 if possible ;-)

[giuseppe]

I've seen some issues when running on CentOS 7 that I've fixed with: #357

You can use a static binary for crun, it works on CentOS 7 and you won't have to worry about external dependencies (https://github.com/containers/crun/tree/master/contrib/static-builder-x86_64).

Without that, I don't see a way for using the systemd backend given the version available on RHEL/CentOS 7.

I'd also suggest moving to RHEL 8 for container workloads. Is there any special reason for using RHEL/CentOS 7?

[hswong3i]

@giuseppe my primary goal is to provide an Ansible Role for crun (see #362) from source code for most supported OS; most likely static build with nix package manager could solve this problem (see #364)?