Answers: <p>You didn't mention what distribution you're using inside your container (which would have implications w/r/t which version of systemd you're using), but the following will successfully boot a CentOS container running systemd:</p>
  
  <pre><code>docker run -it --rm \
    -e container=docker \
    --tmpfs /run \
    --tmpfs /tmp \
    -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
    --cap-add SYS_ADMIN \
    centos /sbin/init
  </code></pre>
  
  <p>This is with Docker 17.05.0-ce; older versions may require additional flags.  Using a stock <code>centos:7</code> image, your initial environment inside the container looks like this:</p>
  
  <pre><code># systemctl status
      State: running
       Jobs: 0 queued
     Failed: 0 units
      Since: Mon 2017-12-04 17:47:15 UTC; 45s ago
  [...]
  </code></pre>
  
  <p>And:</p>
  
  <pre><code># ps -fe
  UID        PID  PPID  C STIME TTY          TIME CMD
  root         1     0  0 17:47 ?        00:00:00 /sbin/init
  root        16     1  0 17:47 ?        00:00:00 /usr/lib/systemd/systemd-journald
  dbus        26     1  0 17:47 ?        00:00:00 /bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
  root        28     1  0 17:47 ?        00:00:00 /usr/lib/systemd/systemd-logind
  root        30     1  0 17:47 console  00:00:00 /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt220
  root        32     0  0 17:47 ?        00:00:00 bash
  root        58    32  0 17:48 ?        00:00:00 ps -fe
  </code></pre>
  
  <p>Note that I'm using <code>--rm</code> here not because it's necessary but because I'm terrible at cleaning things up after the fact.  It's not necessary to get the container to run.</p>
  
  <blockquote>
    <p>but looks like most of them compromise the security of the container and the host</p>
  </blockquote>
  
  <p>Well, running systemd does require privileges beyond those granted to a typical Docker container (hence the <code>--cap-add</code>).  Whether this has security implications for your environment or not depends on what you're doing.</p>
  
Answers: CC BY-SA 3.0
Answers: 2018-01-03T19:49:47.213Z
Answers: The security hole doesn't really depend on what you're doing, it is here, it's more about the fact you acknowledge and accept it for what you're doing. (sorry but I need to stress the point that mounting /sys/'anything' is a large security hole as it gives the container access to a large part of the underlying host for which the container has been isolated)
Answers: Tensibai
Answers: CC BY-SA 3.0
Answers: 2017-12-04T17:41:12.210Z
Answers: 2017-12-04T17:49:36.110Z
Answers: 2017-12-04T17:49:36.110Z
Answers: larsks
Answers: <p>For example, if you want to run systemd in a Arch Linux container,
  run this command: <code>docker run -it --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro --name=ArchLinux archlinux /bin/sh -c "if [ -x /etc/docker-start ]; then exec /etc/docker-start; else exec /bin/sh; fi"</code></p>
  
  <p>Then run these commands in the container:</p>
  
  <pre><code>echo 'Server = https://THE_FASTEST_MIRROR_FOR_YOU/archlinux/$repo/os/$arch' &gt;/etc/pacman.d/mirrorlist
  pacman -Sy --noconfirm systemd systemd-sysvcompat
  passwd -d root
  echo -en '#!/bin/sh\numount /etc/hostname; umount /etc/hosts; umount /etc/resolv.conf; exec /usr/lib/systemd/systemd' &gt;/etc/docker-start
  chmod 700 /etc/docker-start
  echo -e 'nameserver 8.8.8.8' &gt;/etc/resolv.conf
  exit
  </code></pre>
  
  <p>Then start the container and attach to it: <code>docker start -ia ArchLinux</code></p>
  
  <p>You need to run with <code>--privileged</code>, and this may cause some security problems. Please try to avoid it if possible.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-01-17T16:47:47.843Z
Answers: 2020-01-18T14:09:01.603Z
Answers: 2020-01-18T14:09:01.603Z
Answers: Sam0230
Answers: <p>According to <a href="https://developers.redhat.com/blog/2014/05/05/running-systemd-within-docker-container/" rel="nofollow noreferrer">this blog</a>, it is possible to run systemd inside a docker container by building the following dockerfile:</p>
  
  <blockquote>
  <pre><code>FROM fedora:rawhide
  MAINTAINER "Dan Walsh" &lt;dwalsh@redhat.com&gt;
  ENV container docker
  RUN yum -y update; yum clean all
  RUN yum -y install systemd; yum clean all;
  (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done);
  rm -f /lib/systemd/system/multi-user.target.wants/*;
  rm -f /etc/systemd/system/*.wants/*;
  rm -f /lib/systemd/system/local-fs.target.wants/*;
  rm -f /lib/systemd/system/sockets.target.wants/*udev*;
  rm -f /lib/systemd/system/sockets.target.wants/*initctl*;
  rm -f /lib/systemd/system/basic.target.wants/*;
  rm -f /lib/systemd/system/anaconda.target.wants/*;
  VOLUME [ "/sys/fs/cgroup" ]
  CMD ["/usr/sbin/init"]
  </code></pre>
  </blockquote>
  
  <p>using this command:</p>
  
  <blockquote>
  <pre><code>docker build -t httpd_rawhide .
  </code></pre>
  </blockquote>
  
  <p>The author indicates that the built docker image could be used as a base image</p>
  
  <blockquote>
  <pre><code>FROM systemd_rawhide
  RUN yum -y install httpd; yum clean all; systemctl enable httpd.service
  EXPOSE 80
  CMD ["/usr/sbin/init"]
  </code></pre>
  </blockquote>
  
  <p>and if the container is run</p>
  
  <blockquote>
  <pre><code>docker run –privileged -ti -v /sys/fs/cgroup:/sys/fs/cgroup:ro -p 80:80 httpd_rawhide
  </code></pre>
  </blockquote>
  
  <p>systemd will run inside the docker container. It is also possible to run multiple services using systemd. According to the creator of this blog it would be possible to run both mariadb and http inside the same container.</p>
  
  <p>Based on this blog and other articles I read my conclusion is that it is technically possible to run systemd inside a docker container, but I would recommend to avoid running systemd inside a container. </p>
  
  <p>First of all, if systemd is able to run inside a container then this means that it is possible to run multiple services like the author did. From a docker perspective this is not recommended as docker is meant to scale horizontally, i.e. if the load increases of http then addtional docker images should be started. </p>
  
  <p>Second, if such a systemd container will be deployed on an orchestration platform like docker swarm. Will that work? I have some doubts whether that will work. </p>
  
  <p>Third, Running systemd by mounting the cgroup in a privileged container does not look very secure. </p>
  
  <p>In conclusion, although you indicated that the script requires systemd, either rewrite the code or use something else. Running systemd inside a docker container should be avoided in my opinion.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-04T17:28:24.160Z
Answers: Note that the blog post referenced here is from 2014, which given the pace of Docker (and systemd) development is comparatively ancient.
Answers: larsks
Answers: CC BY-SA 4.0
Answers: 2017-11-30T22:42:38.740Z
Answers: 2019-03-29T19:51:37.623Z
Answers: 2019-03-29T19:51:37.623Z
Answers: 030
Body: <p>I have seen many workarounds for this to run systemd inside docker containers but looks like most of them compromise the security of the container and the host. How are most people here dealing with running systemd specific stuff inside the container. </p>
  
Comments: CC BY-SA 3.0
Comments: 2017-07-31T14:49:04.757Z
Comments: Could you explain why you need systemd?
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-08-01T04:32:33.723Z
Comments: My application is setup in production using some bash scripts which use systemd extensively. I cannot change them but i would want to dockerize the solution.
Comments: lakshayk
Comments: CC BY-SA 3.0
Comments: 2017-08-02T08:38:10.123Z
Comments: Could you add the information you have found and add the pros and cons for every approach?
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-08-02T15:10:19.927Z
Comments: Why do you want to dockerize this application if it doesn't fit well into the docker way (and you can't change it)?
Comments: Xiong Chiamiov
Comments: CC BY-SA 3.0
Comments: 2017-08-03T04:23:55.653Z
Comments: Clients time and again want docker images to test out in their CI/CD pipelines
Comments: lakshayk
Comments: CC BY-SA 3.0
Comments: 2017-08-03T16:48:19.970Z
Comments: Did you consider to provide VMs to the customers?
Comments: 030
Comments: CC BY-SA 3.0
Comments: 2017-08-04T05:55:45.887Z
Comments: Business decision does not change on small technical limitations :)
Comments: lakshayk
Tags: <docker>
Title: Is there any concrete and acceptable solution for running systemd inside the docker container?
UserDisplayName: lakshayk
ThreadText: # Is there any concrete and acceptable solution for running systemd inside the docker container?
  
  (Asked by: username_0 on 2017-07-31)
  
  I have seen many workarounds for this to run systemd inside docker containers but looks like most of them compromise the security of the container and the host. How are most people here dealing with running systemd specific stuff inside the container.
  
  **Tags:** docker
  
  > **Comments:**
  > **username_1**: Could you explain why you need systemd?  
  > **username_0**: My application is setup in production using some bash scripts which use systemd extensively. I cannot change them but i would want to dockerize the solution.  
  > **username_1**: Could you add the information you have found and add the pros and cons for every approach?  
  > **username_2**: Why do you want to dockerize this application if it doesn't fit well into the docker way (and you can't change it)?  
  > **username_0**: Clients time and again want docker images to test out in their CI/CD pipelines  
  > **username_1**: Did you consider to provide VMs to the customers?  
  > **username_0**: Business decision does not change on small technical limitations :)  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_3 on 2017-12-04. Score: 6
  
  You didn't mention what distribution you're using inside your container (which would have implications w/r/t which version of systemd you're using), but the following will successfully boot a CentOS container running systemd:
  
  ```
  docker run -it --rm \
    -e container=docker \
    --tmpfs /run \
    --tmpfs /tmp \
    -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
    --cap-add SYS_ADMIN \
    centos /sbin/init
  
  ```
  
  This is with Docker 17.05.0-ce; older versions may require additional flags. Using a stock `centos:7` image, your initial environment inside the container looks like this:
  
  ```
  # systemctl status
      State: running
       Jobs: 0 queued
     Failed: 0 units
      Since: Mon 2017-12-04 17:47:15 UTC; 45s ago
  [...]
  
  ```
  
  And:
  
  ```
  # ps -fe
  UID        PID  PPID  C STIME TTY          TIME CMD
  root         1     0  0 17:47 ?        00:00:00 /sbin/init
  root        16     1  0 17:47 ?        00:00:00 /usr/lib/systemd/systemd-journald
  dbus        26     1  0 17:47 ?        00:00:00 /bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
  root        28     1  0 17:47 ?        00:00:00 /usr/lib/systemd/systemd-logind
  root        30     1  0 17:47 console  00:00:00 /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt220
  root        32     0  0 17:47 ?        00:00:00 bash
  root        58    32  0 17:48 ?        00:00:00 ps -fe
  
  ```
  
  Note that I'm using `--rm` here not because it's necessary but because I'm terrible at cleaning things up after the fact. It's not necessary to get the container to run.
  
  > but looks like most of them compromise the security of the container and the host
  
  Well, running systemd does require privileges beyond those granted to a typical Docker container (hence the `--cap-add`). Whether this has security implications for your environment or not depends on what you're doing.
  
  > **Comments:**
  > **username_4**: The security hole doesn't really depend on what you're doing, it is here, it's more about the fact you acknowledge and accept it for what you're doing. (sorry but I need to stress the point that mounting /sys/'anything' is a large security hole as it gives the container access to a large part of the underlying host for which the container has been isolated)  
  
  ---
  
  ### Answer by username_5 on 2020-01-17. Score: 2
  
  For example, if you want to run systemd in a Arch Linux container,
  run this command: `docker run -it --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro --name=ArchLinux archlinux /bin/sh -c "if [ -x /etc/docker-start ]; then exec /etc/docker-start; else exec /bin/sh; fi"`
  
  Then run these commands in the container:
  
  ```
  echo 'Server = https://THE_FASTEST_MIRROR_FOR_YOU/archlinux/$repo/os/$arch' >/etc/pacman.d/mirrorlist
  pacman -Sy --noconfirm systemd systemd-sysvcompat
  passwd -d root
  echo -en '#!/bin/sh\numount /etc/hostname; umount /etc/hosts; umount /etc/resolv.conf; exec /usr/lib/systemd/systemd' >/etc/docker-start
  chmod 700 /etc/docker-start
  echo -e 'nameserver 8.8.8.8' >/etc/resolv.conf
  exit
  
  ```
  
  Then start the container and attach to it: `docker start -ia ArchLinux`
  
  You need to run with `--privileged`, and this may cause some security problems. Please try to avoid it if possible.
  
  
  ---
  
  ### Answer by username_1 on 2017-11-30. Score: 0
  
  According to [this blog](https://developers.redhat.com/blog/2014/05/05/running-systemd-within-docker-container/), it is possible to run systemd inside a docker container by building the following dockerfile:
  
  > ```
  > FROM fedora:rawhide
  > MAINTAINER "Dan Walsh" <dwalsh@redhat.com>
  > ENV container docker
  > RUN yum -y update; yum clean all
  > RUN yum -y install systemd; yum clean all;
  > (cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] || rm -f $i; done);
  > rm -f /lib/systemd/system/multi-user.target.wants/*;
  > rm -f /etc/systemd/system/*.wants/*;
  > rm -f /lib/systemd/system/local-fs.target.wants/*;
  > rm -f /lib/systemd/system/sockets.target.wants/*udev*;
  > rm -f /lib/systemd/system/sockets.target.wants/*initctl*;
  > rm -f /lib/systemd/system/basic.target.wants/*;
  > rm -f /lib/systemd/system/anaconda.target.wants/*;
  > VOLUME [ "/sys/fs/cgroup" ]
  > CMD ["/usr/sbin/init"]
  >
  > ```
  
  using this command:
  
  > ```
  > docker build -t httpd_rawhide .
  >
  > ```
  
  The author indicates that the built docker image could be used as a base image
  
  > ```
  > FROM systemd_rawhide
  > RUN yum -y install httpd; yum clean all; systemctl enable httpd.service
  > EXPOSE 80
  > CMD ["/usr/sbin/init"]
  >
  > ```
  
  and if the container is run
  
  > ```
  > docker run –privileged -ti -v /sys/fs/cgroup:/sys/fs/cgroup:ro -p 80:80 httpd_rawhide
  >
  > ```
  
  systemd will run inside the docker container. It is also possible to run multiple services using systemd. According to the creator of this blog it would be possible to run both mariadb and http inside the same container.
  
  Based on this blog and other articles I read my conclusion is that it is technically possible to run systemd inside a docker container, but I would recommend to avoid running systemd inside a container.
  
  First of all, if systemd is able to run inside a container then this means that it is possible to run multiple services like the author did. From a docker perspective this is not recommended as docker is meant to scale horizontally, i.e. if the load increases of http then addtional docker images should be started.
  
  Second, if such a systemd container will be deployed on an orchestration platform like docker swarm. Will that work? I have some doubts whether that will work.
  
  Third, Running systemd by mounting the cgroup in a privileged container does not look very secure.
  
  In conclusion, although you indicated that the script requires systemd, either rewrite the code or use something else. Running systemd inside a docker container should be avoided in my opinion.
  
  > **Comments:**
  > **username_3**: Note that the blog post referenced here is from 2014, which given the pace of Docker (and systemd) development is comparatively ancient.  
  
  ---
  
  