Kubernetes Pod: Failed to get D-Bus Connection

5/23/2019

I have a docker containter based on centos/systemd. I run the container with

docker run -d --privileged -v /sys/fs/cgroup:/sys/fs/cgroup:ro <image>

Then i can access the container with:

docker exec -ti <containerID> /bin/bash

Then i can list all loaded units with the command systemctl . This works fine.

Now i want to deploy the image into a kubernetes cluster, this works also fine and i can access the running pod in the cluster via kubectl exec -ti <pod> /bin/bash

If i type now the command systemctl i get the error message

Failed to get D-Bus connection: Operation not permitted

How is it possible to make systemd/systemctl available in the pod?

HINT: Need systemd because of software running inside container, so supervisord is not an option here

-- bucky
dbus
docker
kubernetes
linux
systemd

2 Answers

1/25/2020

The command to start systemd would have to be in a script in the container. I use /usr/sbin/init or /usr/lib/systemd/systemd --systemd --unit=basic.target. Additionally you need start systemd with the tmpfs for /run to store runtime information. Scripting it is not easy and Tableau is a good example of why it's being done.

Also, I recommend to NOT use --privileged at all costs, because it's a security risk plus you may accidentally alter or bring down the host with changes made inside the container.

-- MarcT
Source: StackOverflow

5/25/2019

It is a sad observation that the old proposal from Daniel Walsh (Redhat) is still floating around - which includes a hint to run a "privileged container" to get some systemd behaviour, by basically talking to the daemon outside of the container.

Drop that. Just forget it. You can't get that in a real cluster unless violating its basic designs.

And in most cases, the requirement for systemd in a container is not very strict when looking closer. There are quite a number of service-manager or an init-daemon implmentations for containers. You could try with the docker-systemctl-replacement script for example.

-- Guido U. Draheim
Source: StackOverflow