5

I would like to run a docker container which will have the ability to run systemctl commands on its host.

Following this question I didn't find a solution that would work for me.

I have no hard limits on the docker base image, so using ubuntu-16.04 docker image for an ubuntu-16.04 host and ubuntu-18.04 docker image for an ubuntu-18.04 host is totally acceptable.

3 Answers 3

6

After some investigation I was able to run a docker container with the ability to run systemctl command.

  1. The following worked when running on an ubuntu:16.04 host:

    • sudo docker run --privileged -v /run/systemd/system:/run/systemd/system -v /bin/systemctl:/bin/systemctl -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -it ubuntu:16.04 systemctl
      
    • sudo docker run --privileged -v /run/systemd/system:/run/systemd/system -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -it ubuntu:16.04 systemctl
      
  2. And on ubuntu:18.04 host:

    sudo docker run --privileged -v /run/systemd/system:/run/systemd/system -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -it ubuntu:18.04 systemctl
    

    Since systemctl doesn't come with this image

3
  • A container needing systemd in it doesn't make much sense. If you need that, you might need to rethink the architecture. The purpose of a container is the run as a single service, if you have more than 1 service running in your container then you aren't using it properly. You can't use or think of containers as a normal OS or a virtual machine.
    – Dan
    Dec 3, 2020 at 16:15
  • 3
    I want my container to be able to talk with its host systemd, in order to monitor and start/stop/restart the services , I don't want the actual container to use systemd
    – ofirule
    Dec 3, 2020 at 16:18
  • do you know about ubuntu 20.04?
    – York Yang
    Jun 22 at 7:45
2

Thanks ofirule

Tried your solution on debian:10, your solution effectively allows to run the systemctl but it won't allow it to see/control the host's systemd processes. For this to work the /sys/fs/cgroup directory must also be mounted as a volume:

docker run -it --rm -v /bin/systemctl:/bin/systemctl -v /run/systemd/system:/run/systemd/system -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -v /sys/fs/cgroup:/sys/fs/cgroup debian:10 systemctl --no-pager status

With this i can control the host's systemd services and even do a shutdown/reboot through systemd.

This seems specific to Debian 10 and not needed for Ubuntu 18.04. Other Debian/Ubuntu versions might or might not need it.

3
  • Adding the --privileged flag didn't solve it? I guess there are some differences between different OSes
    – ofirule
    Jan 27, 2021 at 9:42
  • No, the command runs fine but the host's services are not seen. Neither with --privileged nor with -u 0:0. Seems at least on Debian /sys/fs/cgroup is required. Will test it on an Ubuntu 18:04
    – Martin
    Jan 27, 2021 at 9:56
  • Tested it on ubuntu:18.04 on aarch64 (don't have access to a ubuntu pc right now) and you are correct, mapping /sys/fs/cgroup seems not necessary. For aarch64 a bunch of libs must also be mapped to allow systemctl to run, but that is probably aarch64 specific which seems to have a more stripped down docker image. I update my response to mention it is Debian10 specific. Thanks !
    – Martin
    Jan 27, 2021 at 10:34
0

Not allowed to comment. But this worked for my Ubuntu 18.04 setup:

sudo docker run --privileged \
-v /run/systemd/system:/run/systemd/system \
-v /lib/:/lib/ \
-v /usr/lib/x86_64-linux-gnu/:/usr/lib/x86_64-linux-gnu/ \
-v /bin/systemctl:/bin/systemctl \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket \
-it ubuntu:18.04 /bin/sh -c "systemctl restart openvpn.service; systemctl status openvpn.service"

If the command complains about error while loading shared libraries: libip4tc.so.0: -> run locate libip4tc.so.0 to find out where this file is and mount the folder as a volume.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.