docker: cgroupdriver: runtime does not support docker cgroupdriver argument

[grahamwhaley]

Description of problem

It has been reported that the kata runtime does not support the docker --exec-opt native.cgroupdriver=systemd runtime option. See
https://docs.docker.com/engine/reference/commandline/dockerd/#options-for-the-runtime

Expected result

I suspect as we use systemd inside the mini-OS where the agent uses the same library as the default docker runtime to set up the cgroups for the container (aiui), that this feature could be implemented by an enhancement to the agent.

We should probably discuss first if/what/are there any benefits to using systemd to control the cgroups. There may well be, as this topic came up in relation to the Project Atomic item, now referenced over at kata-containers/documentation#222

[grahamwhaley]

/cc @xzr for bringing this to our attention, thanks!
/cc @devimc for thoughts on if this would be feasible via the agent etc.

I guess a minimum we should probably add an entry to the limitations document for a start.

[xzr]

On Atomic and an older version of Docker:

[vagrant@localhost ~]$ sudo docker --version
Docker version 1.13.1, build dded712/1.13.1
[vagrant@localhost ~]$ sudo docker run --rm centos uname -a
Incorrect Usage. flag provided but not defined: -systemd-cgroup

time="2018-08-28T14:56:37Z" level=error msg="flag provided but not defined: -systemd-cgroup" arch=amd64 name=kata-runtime pid=2974 source=runtime
flag provided but not defined: -systemd-cgroup
NAME:
kata-runtime - kata-runtime runtime

kata-runtime is a command line program for running applications packaged
according to the Open Container Initiative (OCI).

USAGE:
kata-runtime [global options] command [command options] [arguments...]

VERSION:
kata-runtime : 1.2.0
commit : 0bcb32f
OCI specs: 1.0.1

COMMANDS:
create Create a container
delete Delete any resources held by one or more containers
exec Execute new process inside the container
kill Kill sends signals to the container's init process
list lists containers started by kata-runtime with the given root
pause suspend all processes in a container
ps ps displays the processes running inside a container
resume unpause all previously paused processes in a container
run create and run a container
spec create a new specification file
start executes the user defined process in a created container
state output the state of a container
update update container resource constraints
events display container events such as OOM notifications, cpu, memory, and IO usage statistics
version display version details
kata-check tests if system can run Kata Containers
kata-env display settings. Default to TOML
factory manage vm factory
help, h Shows a list of commands or help for one command

GLOBAL OPTIONS:
--kata-config value Kata Containers config file path
--log value set the log file path where internal debug information is written (default: "/dev/null")
--log-format value set the format used by logs ('text' (default), or 'json') (default: "text")
--root value root directory for storage of container state (this should be located in tmpfs) (default: "/var/run/kata-containers")
--kata-show-default-config-paths show config file paths that will be checked for (in order)
--help, -h show help
--version, -v print the version

NOTES:

• Commands starting "kata-" and options starting "--kata-" are Kata Containers extensions.

URL:

The canonical URL for this project is: https://github.com/kata-containers

/usr/bin/docker-current: Error response from daemon: containerd: container not started.
ERRO[0000] error getting events from daemon: context canceled

On regular Centos 7 and latest Docker CE:

[vagrant@localhost ~]$ sudo docker --version
Docker version 18.06.1-ce, build e68fc7a
[vagrant@localhost ~]$ sudo docker run --rm centos uname -a
docker: Error response from daemon: OCI runtime create failed: unable to retrieve OCI runtime error (open /run/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/6133b291b26f03ca4e11f6d8be1946e7ac0986c5c1919fcc3048fc29d1c32b88/log.json: no such file or directory): /usr/bin/kata-runtime did not terminate sucessfully: unknown.

[devimc]

After having read coreos/bugs#1435 , https://www.freedesktop.org/wiki/Software/systemd/ControlGroupInterface/ and https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html , from my point of view it's worthless to use systemd's resource control in the VM, because nobody is able to control it by using systemctl set-property ... and there is no a docker service running in the VM, having said that I propose to support it but in the host, when we support cgroups in the host, by now these are the gaps that need to be closed to make dockerd --exec-opt native.cgroupdriver=systemd happy:

• runtime: add systemd-cgroup option
• runtime: translate systemd cgroupsPath to cgroupfs cgroupsPath, for example system.slice:docker:abc to /docker/abc

I'll be working on that

cc @bergwolf @grahamwhaley @xzr