[Docker] – How to create a container with permission to run a process?

If you are trying to execute the command $systemctl start docker inside of a Docker container started by the command as for example $docker run -i -t myImage /bin/bash  then probably you are facing the following message.

System has not been booted with systemd as init system (PID 1). Can’t operate.

Note that the default profile permissions used to start a docker container will not allow this operation. For a further understanding check the Seccomp security profiles for Docker section in the Docker docs.

Also, a container is relatively well isolated from other containers and its host machine. You can control how isolated a container’s network, storage, or other underlying subsystems are from other containers or from the host machine. Then, you need to mount the host’s /sys/fs/cgroup volume in order to persist the resource usage for a set of processes to be allowed to manage them inside of a container. To understand better it sees the blog post Docker Internals and the official documentation

Following an example regards to how to start a Fedora image where you will be able to manage the process.

docker run -d –name fedora28 -e=container=docker –stop-signal=SIGRTMIN+3 –cap-add=SYS_ADMIN –security-opt=seccomp:unconfined -v /sys/fs/cgroup:/sys/fs/cgroup:ro fedora /sbin/init

The param --name will define the name of the container which can be checked as follows.

Screen Shot 2018-08-19 at 11.25.12

After perform the above steps you can access the container started and manage the process via systemctl as follows.

docker exec -it fedora28 bash

Screen Shot 2018-08-19 at 11.29.30

Note, also that when this container is started you are executing the /sbin/init, linux, SO initialization script in order to set up this configuration.

Screen Shot 2018-08-19 at 11.38.46









Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s