I use Docker Desktop on Windows.

This time I needed to use Systemd on CentOS 7, so I looked into it.

Overview

If you run CentOS 7 in a container without doing anything special, running the systemctl command produces an error like this.

sh-4.2# systemctl start sshd
Failed to get D-Bus connection: Operation not permitted

https://hub.docker.com/_/centos/

リンク先を開く

hub.docker.com

To avoid this, you need to add options when starting the container. Docker Hub describes this, but even following those instructions did not work for me. The required settings seem to differ depending on the environment.

Test Environment

Windows 10 Pro (21H2)
OS build: 19044.1741
Installed RAM: 64.0GB
Docker Desktop 4.8.2 (79419) WSL 2 backend

The following assumes running CentOS 7 + Systemd in the environment above. Other environments will likely require different settings.

Configuration

I used the following article as a reference.

https://qiita.com/shusugmt/items/92ece6874ba5aeff2b41

リンク先を開く

qiita.com

Systemd is not running on the host side, but simply adding cap_add did not work. Building the container with VOLUME [ "/sys/fs/cgroup" ] worked.

I still do not know what the correct answer really is. For now, I will paste the settings that worked.

I also put them on GitHub.

https://github.com/usurageha/docker-centos7-systemd-sshd

リンク先を開く

github.com

Settings

Dockerfile. It runs SSHd through Systemd.

FROM centos:7
Install SSHd and sudo
ENV PACKAGES=“sudo openssh-server”
RUN yum -y update 

&& yum install -y ${PACKAGES} 

&& rm -rf /var/cache/yum/* 

&& yum clean all; systemctl enable sshd.service 

&& sed -i -e “s/^#UseDNS yes/UseDNS no/” /etc/ssh/sshd_config
Create user and Configure passwordless sudo
ARG USER_NAME=user
ARG USER_PASSWD=password
RUN useradd -c “Default User” -d /home/${USER_NAME} -s /bin/bash ${USER_NAME} 

&& echo “${USER_NAME}:${USER_PASSWD}” | chpasswd 

&& usermod -aG wheel ${USER_NAME} 

&& echo “${USER_NAME}        ALL=(ALL)       NOPASSWD: ALL” >> /etc/sudoers
EXPOSE 22
VOLUME [ “/sys/fs/cgroup” ]
CMD ["/usr/sbin/init"]

docker-compose.yml. If VOLUME is defined in the Dockerfile, it looks like mounting /sys/fs/cgroup is not necessary. Looking at Cgroup Version in docker info, it was version 1.

version: '3.9'
services:
centos7:
    image: centos7-systemd-sshd:latest
    build:
        context: .
        args:
            USER_NAME: "user"
            USER_PASSWD: "password"
    ports:
        - "2222:22"
    cap_add:
        - SYS_ADMIN
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:rw
    # restart: always

Running It

I ran it normally and confirmed that I could connect over ssh.

$ docker-compose up
[+] Running 1/0
 ⠿ Container docker-centos7-systemd-sshd-centos7-1  Created         0.0s
Attaching to docker-centos7-systemd-sshd-centos7-1

Access it from a suitable client.

$ ssh user@localhost -p 2222
The authenticity of host '[localhost]:2222 ([127.0.0.1]:2222)' can't be established.
ED25519 key fingerprint is SHA256:7/IkwboYviNsx2fj08osEqHEDXZnNtEJy0gj54u2VVI.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[localhost]:2222' (ED25519) to the list of known hosts.
user@localhost's password:
Last login: Fri Jun 17 10:34:42 2022 from 172.19.0.1
[user@2d73595a5ac4 ~]$ cat /etc/redhat-release
CentOS Linux release 7.9.2009 (Core)

Me

You can use it in a way that feels similar to a VM, but I think using a VM instead of a container is probably better.