9

I would like to run a docker container which will have the ability to run systemctl commands on its host.

Following this question I didn't find a solution that would work for me.

I have no hard limits on the docker base image, so using ubuntu-16.04 docker image for an ubuntu-16.04 host and ubuntu-18.04 docker image for an ubuntu-18.04 host is totally acceptable.

3 Answers 3

8

After some investigation I was able to run a docker container with the ability to run systemctl command.

  1. The following worked when running on an ubuntu:16.04 host:

    • sudo docker run --privileged -v /run/systemd/system:/run/systemd/system -v /bin/systemctl:/bin/systemctl -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -it ubuntu:16.04 systemctl
      
    • sudo docker run --privileged -v /run/systemd/system:/run/systemd/system -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -it ubuntu:16.04 systemctl
      
  2. And on ubuntu:18.04 host:

    sudo docker run --privileged -v /run/systemd/system:/run/systemd/system -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -it ubuntu:18.04 systemctl
    

    Since systemctl doesn't come with this image

3
  • A container needing systemd in it doesn't make much sense. If you need that, you might need to rethink the architecture. The purpose of a container is the run as a single service, if you have more than 1 service running in your container then you aren't using it properly. You can't use or think of containers as a normal OS or a virtual machine.
    – Dan
    Dec 3, 2020 at 16:15
  • 4
    I want my container to be able to talk with its host systemd, in order to monitor and start/stop/restart the services , I don't want the actual container to use systemd
    – ofirule
    Dec 3, 2020 at 16:18
  • do you know about ubuntu 20.04?
    – York Yang
    Jun 22, 2022 at 7:45
3

Thanks ofirule

Tried your solution on debian:10, your solution effectively allows to run the systemctl but it won't allow it to see/control the host's systemd processes. For this to work the /sys/fs/cgroup directory must also be mounted as a volume:

docker run -it --rm -v /bin/systemctl:/bin/systemctl -v /run/systemd/system:/run/systemd/system -v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket -v /sys/fs/cgroup:/sys/fs/cgroup debian:10 systemctl --no-pager status

With this i can control the host's systemd services and even do a shutdown/reboot through systemd.

This seems specific to Debian 10 and not needed for Ubuntu 18.04. Other Debian/Ubuntu versions might or might not need it.

3
  • Adding the --privileged flag didn't solve it? I guess there are some differences between different OSes
    – ofirule
    Jan 27, 2021 at 9:42
  • No, the command runs fine but the host's services are not seen. Neither with --privileged nor with -u 0:0. Seems at least on Debian /sys/fs/cgroup is required. Will test it on an Ubuntu 18:04
    – Martin
    Jan 27, 2021 at 9:56
  • Tested it on ubuntu:18.04 on aarch64 (don't have access to a ubuntu pc right now) and you are correct, mapping /sys/fs/cgroup seems not necessary. For aarch64 a bunch of libs must also be mapped to allow systemctl to run, but that is probably aarch64 specific which seems to have a more stripped down docker image. I update my response to mention it is Debian10 specific. Thanks !
    – Martin
    Jan 27, 2021 at 10:34
1

Not allowed to comment. But this worked for my Ubuntu 18.04 setup:

sudo docker run --privileged \
-v /run/systemd/system:/run/systemd/system \
-v /lib/:/lib/ \
-v /usr/lib/x86_64-linux-gnu/:/usr/lib/x86_64-linux-gnu/ \
-v /bin/systemctl:/bin/systemctl \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket \
-it ubuntu:18.04 /bin/sh -c "systemctl restart openvpn.service; systemctl status openvpn.service"

If the command complains about error while loading shared libraries: libip4tc.so.0: -> run locate libip4tc.so.0 to find out where this file is and mount the folder as a volume.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .