Upstream systemd unit files from docker-ce-packaging repo #42373

thaJeztah · 2021-05-12T09:46:19Z

The docker-ce-packaging repo currently maintains its own copy of the systemd unit files for docker; https://github.com/docker/docker-ce-packaging/tree/6857538d997e58d7b941c65522c9c0526c5fc9da/systemd

This PR moves the changes from those files back to the ones in this repository. There were some conflicts, so needs a review.

I also removed the (now unused) .rpm version of the systemd unit.

I tried to preserve history from the docker-ce-packaging repository, taking this approach;

# install filter-repo (https://github.com/newren/git-filter-repo/blob/main/INSTALL.md)
brew install git-filter-repo

# create a temporary clone of the packaging repo
git clone https://github.com/docker/docker-ce-packaging.git ~/Projects/packaging_tmp
cd ~/Projects/packaging_tmp

# remove all code, except for the files we need, and rename the files
git filter-repo \
    --path-match systemd/ \
    --path-rename systemd/docker.service:contrib/init/systemd/docker.service \
    --path-rename systemd/docker.socket:contrib/init/systemd/docker.socket


# integrate the files in the docker repository
cd ~/go/src/github.com/docker/docker/
git checkout -b upstream_systemd_units
git remote add packaging_tmp ~/Projects/packaging_tmp
git fetch packaging_tmp


git merge --allow-unrelated-histories --signoff -S packaging_tmp/master

After this is merged, I'll update the containerd-packaging repository to remove the systemd unit files from that repository and to consume the unit files from this repository instead.

Differences between the results in this branch, and the units currently in docker-ce-packaging;

in docker.service:

git diff --no-index ~/go/src/github.com/docker/docker-ce-packaging/systemd/docker.service contrib/init/systemd/docker.service
diff --git a/Users/sebastiaan/go/src/github.com/docker/docker-ce-packaging/systemd/docker.service b/contrib/init/systemd/docker.service
index 942008045d..c40735a2b5 100644
--- a/Users/sebastiaan/go/src/github.com/docker/docker-ce-packaging/systemd/docker.service
+++ b/contrib/init/systemd/docker.service
@@ -1,7 +1,7 @@
 [Unit]
 Description=Docker Application Container Engine
 Documentation=https://docs.docker.com
-After=network-online.target firewalld.service containerd.service
+After=network-online.target docker.socket firewalld.service containerd.service
 Wants=network-online.target
 Requires=docker.socket containerd.service

@@ -12,7 +12,7 @@ Type=notify
 # for containers run by docker
 ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
 ExecReload=/bin/kill -s HUP $MAINPID
-TimeoutSec=0
+TimeoutStartSec=0
 RestartSec=2
 Restart=always

in docker.socket:

git diff --no-index ~/go/src/github.com/docker/docker-ce-packaging/systemd/docker.socket contrib/init/systemd/docker.socket
diff --git a/Users/sebastiaan/go/src/github.com/docker/docker-ce-packaging/systemd/docker.socket b/contrib/init/systemd/docker.socket
index 9db5049150..c76a23296e 100644
--- a/Users/sebastiaan/go/src/github.com/docker/docker-ce-packaging/systemd/docker.socket
+++ b/contrib/init/systemd/docker.socket
@@ -2,7 +2,9 @@
 Description=Docker Socket for the API

 [Socket]
-ListenStream=/var/run/docker.sock
+# If /var/run is not implemented as a symlink to /run, you may need to
+# specify ListenStream=/var/run/docker.sock instead.
+ListenStream=/run/docker.sock
 SocketMode=0660
 SocketUser=root
 SocketGroup=docker

Signed-off-by: Eli Uriegas <[email protected]>

Old versions of things on CentOS 7 strike again! infinity is not a thing for TimeoutSec on systemd < 229 Signed-off-by: Eli Uriegas <[email protected]>

Merged with https://github.com/seemethere/unir

The daemon won't actually start without containerd Signed-off-by: Eli Uriegas <[email protected]>

Set containerd to be a systemd bind for docker

Merging the develop changes into master

Signed-off-by: Michael Crosby <[email protected]>

Signed-off-by: Andrew Hsu <[email protected]> (cherry picked from commit 51879873897afe298cbb736acef34b5a0b500424) Signed-off-by: Andrew Hsu <[email protected]>

[master] bring in changes that went first to 18.09 branch

Merged with https://github.com/seemethere/unir

set LimitCORE=infinity to ensure complete core creation, allows extraction of as much information as possible. Signed-off-by: Sebastiaan van Stijn <[email protected]>

There is a not-insignificant performance overhead for all containers (if containerd is a child of Docker, which is the current setup) if systemd sets rlimits on the main Docker daemon process (because the limits propogate to all children). Signed-off-by: Sebastiaan van Stijn <[email protected]>

Systemd sets a default of 512 tasks, which is far too low to run many containers. Note that TasksMax is only supported on systemd 226 and above. Signed-off-by: Sebastiaan van Stijn <[email protected]>

We need to add delegate yes to docker's service file so that it can manage the cgroups of the processes that it launches without systemd interfering with them and moving the processes after it is reloaded. Delegate= Turns on delegation of further resource control partitioning to processes of the unit. For unprivileged services (i.e. those using the User= setting), this allows processes to create a subhierarchy beneath its control group path. For privileged services and scopes, this ensures the processes will have all control group controllers enabled. This is the proper fix for issue moby#20152 Signed-off-by: Sebastiaan van Stijn <[email protected]>

Change the kill mode to process so that systemd does not kill container processes when the daemon is shutdown but only the docker daemon Signed-off-by: Sebastiaan van Stijn <[email protected]>

This adds support for reloading the docker daemon (SIGHIUP) so that changes in '/etc/docker/daemon.json' can be loaded at runtime by reloading the service through systemd ('systemctl reload docker') Before this change, systemd would output an error that "reloading" is not supported for the docker service; systemctl reload docker Failed to reload docker.service: Job type reload is not applicable for unit docker.service. After this change, the docker daemon can be reloaded through 'systemctl reload docker', which reloads the configuration; journalctl -f -u docker.service May 02 03:49:20 testing systemd[1]: Reloading Docker Application Container Engine. May 02 03:49:20 testing docker[28496]: time="2016-05-02T03:49:20.143964103-04:00" level=info msg="Got signal to reload configuration, reloading from: /etc/docker/daemon.json" May 02 03:49:20 testing systemd[1]: Reloaded Docker Application Container Engine. Signed-off-by: Sebastiaan van Stijn <[email protected]>

Note that StartLimit* options were moved from "Service" to "Unit" in systemd 229 (systemd/systemd@6bf0f40) both the old, and new location are accepted by systemd 229 and up, so using the old location to make them work for either version of systemd. StartLimitInterval was renamed to StartLimitIntervalSec in systemd 230 (systemd/systemd@f0367da) both the old, and new name are accepted by systemd 230 and up, so using the old name to make this option work for either version of systemd. Signed-off-by: Sebastiaan van Stijn <[email protected]>

Removes the need for the offline installer to install the shim process and instead installs the shim process as part of the packaging. May be easier in the future to just package the shim process on it's own but that'll come after this 18.09 release Signed-off-by: Eli Uriegas <[email protected]>

Remove offline installer to install shim-process

iptables is sometimes placed in `/usr/sbin` Signed-off-by: Eli Uriegas <[email protected]>

Merged with https://github.com/seemethere/unir

Set the PATH to what appears to be the standard on latest Ubuntu (18.04) and Debian (9), fixing the following two issues: 1. PATH did not contain /bin (leading to ContainerTop/ps not working on newer distros, among the other things). 2. $PATH can't be specified in Environment directives in .service files. While at it, also: 3. Remove the comment about RPM as it looks misleading on deb-based systems. Signed-off-by: Kir Kolyshkin <[email protected]>

[master] systemd/docker.service: fix PATH

Signed-off-by: Eli Uriegas <[email protected]>

Use image artifacts as daemon and dependencies

thaJeztah · 2021-05-12T09:49:21Z

Looks like one PR was merged in docker-ce-packaging that misses a DCO; (docker/docker-ce-packaging#304)

thaJeztah · 2021-05-12T09:52:50Z

contrib/init/systemd/docker.service

Actually; I should probably pick the one from this repository; looks like TimeoutSec is deprecated in favour of TimeoutStartSec; systemd/systemd#11155

Changed this one to TimeoutStartSec

thaJeztah · 2021-05-12T09:56:14Z

contrib/init/systemd/docker.service

There was a merge conflict here, because the unit file in docker-ce-packaging did not have docker.socket here; that was added in this repository through #7257, so I opted to keep that in the list and append the containerd.service from the docker-ce-packaging repository

…temd_units Signed-off-by: Sebastiaan van Stijn <[email protected]>

This unit file was created when we packaged rpms without the socket activation unit, but that's no longer the case. Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah · 2021-05-12T10:01:17Z

One notable difference between this repo and docker-ce-packaging is in the docker.socket file, which changed to use /run/docker.socket in this repository;

moby/contrib/init/systemd/docker.socket

Lines 5 to 7 in 7af0344

    
           # If /var/run is not implemented as a symlink to /run, you may need to 
        
           # specify ListenStream=/var/run/docker.sock instead. 
        
           ListenStream=/run/docker.sock

That change was contributed in #39275, but has not been used in docker-ce packages so far, so we need to double-check if we anticipate problems because of that change

tianon

LGTM 👀

thaJeztah · 2021-05-19T12:39:44Z

@AkihiroSuda @cpuguy83 PTAL

for the record: I ran CI with "skip DCO" (because of the one commit that was missing a DCO); CI only validates "new" commits, so after this is merged that should not (fingers crossed) cause a problem

The packaging repository was maintaining its own version of the systemd units. These files were originally based on the units in the upstream docker / moby repository, but diverged. PR moby/moby#42373 merged back the units from this repository to upstream, so we can now consume those files instead of the ones that were maintained in this repository. Signed-off-by: Sebastiaan van Stijn <[email protected]>

The packaging repository was maintaining its own version of the systemd units. These files were originally based on the units in the upstream docker / moby repository, but diverged. PR moby/moby#42373 merged back the units from this repository to upstream, so we can now consume those files instead of the ones that were maintained in this repository. Signed-off-by: Sebastiaan van Stijn <[email protected]> Upstream-commit: c4c2d89 Component: packaging

The packaging repository was maintaining its own version of the systemd units. These files were originally based on the units in the upstream docker / moby repository, but diverged. PR moby/moby#42373 merged back the units from this repository to upstream, so we can now consume those files instead of the ones that were maintained in this repository. Signed-off-by: Sebastiaan van Stijn <[email protected]>

Origin: upstream, cherry-picked parts of moby/moby#42373 and moby/moby#42622 Bug-Debian: https://bugs.debian.org/989490 Fixes proper shutdown of containers. Gbp-Pq: Name engine-systemd-service-after-containerd.patch

seemethere and others added 30 commits June 6, 2017 11:32

Add initial systemd scripts

bb68bc5

Signed-off-by: Eli Uriegas <[email protected]>

Use internal systemd scripts for RPM packaging

509b86c

Signed-off-by: Eli Uriegas <[email protected]>

Use internal systemd scripts for DEB packaging

b8bcf70

Signed-off-by: Eli Uriegas <[email protected]>

Add systemd files, add containerd-proxy config

6cd66ea

Signed-off-by: Eli Uriegas <[email protected]>

Round out systemd for RPM packaging

a5c809e

Signed-off-by: Eli Uriegas <[email protected]>

Revive pre / post steps, update offline location

e086064

Signed-off-by: Eli Uriegas <[email protected]>

Some changes to get this working on CentOS 7

cdb1e70

Old versions of things on CentOS 7 strike again! infinity is not a thing for TimeoutSec on systemd < 229 Signed-off-by: Eli Uriegas <[email protected]>

Merge pull request moby#131 from seemethere/rpm_new

55e6314

Merged with https://github.com/seemethere/unir

Set containerd to be a systemd bind for docker

e56475a

The daemon won't actually start without containerd Signed-off-by: Eli Uriegas <[email protected]>

Merge pull request moby#150 from seemethere/require

7126d94

Set containerd to be a systemd bind for docker

Merge pull request moby#151 from docker/develop

d5abba2

Merging the develop changes into master

Add post-stop

0c8e758

Signed-off-by: Michael Crosby <[email protected]>

added RestartSec

53343f1

Signed-off-by: Andrew Hsu <[email protected]> (cherry picked from commit 51879873897afe298cbb736acef34b5a0b500424) Signed-off-by: Andrew Hsu <[email protected]>

Merge pull request moby#169 from andrewhsu/sync

21458dd

[master] bring in changes that went first to 18.09 branch

Merge pull request moby#168 from crosbymichael/prestart

ffc5810

Merged with https://github.com/seemethere/unir

systemd: no limit on core size

ef9ee10

set LimitCORE=infinity to ensure complete core creation, allows extraction of as much information as possible. Signed-off-by: Sebastiaan van Stijn <[email protected]>

systemd: don't limit tasks

7daf2db

Systemd sets a default of 512 tasks, which is far too low to run many containers. Note that TasksMax is only supported on systemd 226 and above. Signed-off-by: Sebastiaan van Stijn <[email protected]>

systemd: set systemd KillMode

f30757f

Change the kill mode to process so that systemd does not kill container processes when the daemon is shutdown but only the docker daemon Signed-off-by: Sebastiaan van Stijn <[email protected]>

Merge pull request moby#191 from seemethere/no_offline_installer

c37156f

Remove offline installer to install shim-process

Add /usr/sbin to our path variable for systemd

ea996b8

iptables is sometimes placed in `/usr/sbin` Signed-off-by: Eli Uriegas <[email protected]>

Merge pull request moby#213 from seemethere/iptables_fix

b49ab7f

Merged with https://github.com/seemethere/unir

Merge pull request moby#231 from kolyshkin/fix-path

da38ea9

[master] systemd/docker.service: fix PATH

Use image artifacts as daemon and dependencies

212521b

Signed-off-by: Eli Uriegas <[email protected]>

Merge pull request moby#223 from seemethere/f

4ec6ae3

Use image artifacts as daemon and dependencies

thaJeztah added area/systemd area/packaging labels May 12, 2021

thaJeztah commented May 12, 2021

View reviewed changes

thaJeztah added 2 commits May 12, 2021 11:57

Merge remote-tracking branch 'packaging_tmp/master' into upstream_sys…

11dd2b7

…temd_units Signed-off-by: Sebastiaan van Stijn <[email protected]>

contrib: remove unused "rpm" variant of systemd unit

35c1542

This unit file was created when we packaged rpms without the socket activation unit, but that's no longer the case. Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah force-pushed the upstream_systemd_units branch from 3bc1c83 to 35c1542 Compare May 12, 2021 09:58

tianon approved these changes May 13, 2021

View reviewed changes

thaJeztah mentioned this pull request May 17, 2021

hack/validate: skip DCO in "default" #42384

Merged

AkihiroSuda approved these changes May 19, 2021

View reviewed changes

AkihiroSuda merged commit 84bf80a into moby:master May 19, 2021

thaJeztah deleted the upstream_systemd_units branch May 19, 2021 13:13

thaJeztah added this to the 21.xx milestone May 20, 2021

This was referenced May 20, 2021

Use systemd unit files from upstream repository docker/docker-ce-packaging#547

Merged

Add PIDFile to docker.service unit file to make systemd clean up pid file more reliably docker/docker-ce-packaging#499

Closed

thaJeztah mentioned this pull request Aug 11, 2022

libcontainerd/supervisor: refactoring and cleanup in preparation of custom containerd.toml #43945

Merged

This was referenced Feb 3, 2023

engine: 23.0.0 errata docker/docs#16659

Merged

Example docker.service requires an externally managed containerd #44912

Closed

thaJeztah mentioned this pull request Feb 24, 2023

Container ulimits are inherited from containerd by default #45060

Closed

This was referenced Mar 6, 2023

Review / revisit systemd unit files docker/for-linux#73

Open

Revert commit that changed LimitNOFILE to infinity to avoid regressions containerd/containerd#7566

Closed

polarathene mentioned this pull request May 13, 2023

fix: Normalize RLIMIT_NOFILE (LimitNOFILE) to sensible defaults #45534

Merged

nirs mentioned this pull request Aug 6, 2025

WIP: Docker service test kubernetes/minikube#21175

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Upstream systemd unit files from docker-ce-packaging repo #42373

Upstream systemd unit files from docker-ce-packaging repo #42373

Uh oh!

thaJeztah commented May 12, 2021 •

edited

Loading

Uh oh!

thaJeztah commented May 12, 2021

Uh oh!

thaJeztah May 12, 2021

Uh oh!

thaJeztah May 12, 2021

Uh oh!

thaJeztah May 12, 2021

Uh oh!

thaJeztah commented May 12, 2021

Uh oh!

tianon left a comment

Uh oh!

thaJeztah commented May 19, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

Upstream systemd unit files from docker-ce-packaging repo #42373

Upstream systemd unit files from docker-ce-packaging repo #42373

Uh oh!

Conversation

thaJeztah commented May 12, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thaJeztah commented May 12, 2021

Uh oh!

thaJeztah May 12, 2021

Choose a reason for hiding this comment

Uh oh!

thaJeztah May 12, 2021

Choose a reason for hiding this comment

Uh oh!

thaJeztah May 12, 2021

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented May 12, 2021

Uh oh!

tianon left a comment

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented May 19, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

13 participants

thaJeztah commented May 12, 2021 •

edited

Loading