use cri-o to run pod and container when `cgroup_manager=systemd`

Question

I successfully use cri-o to run pod and container, following the guide and tutorial, whose default cgroup_manager is cgroupfs.

when I tried to set cgroup_manager = "systemd" in /etc/crio/crio.conf and restart crio service.

then, I tried the same steps in tutorial

POD_ID=$(sudo crictl runp test/testdata/sandbox_config.json)

got the error below:

FATA[0000] run pod sandbox failed: rpc error: code = Unknown desc = cri-o configured with systemd cgroup manager, but did not receive slice as parent: /Burstable/pod_123-456

the sandbox_config.json is same as sandbox_config.json

How to use cri-o to start pod and container when cgroup_manager=systemd? Is there a sample?

Answer 1

When you switch the cgroup manager to systemd in /etc/crio/crio.conf, you have to modify the pod yaml/json to give the cgroup_parent a slice instead. So in your sandbox_config.json change

"linux": {
        "cgroup_parent": "/Burstable/pod_123-456",

to something like this

"linux": {
        "cgroup_parent": "podabc.slice",

Try re-creating your pod and it should start up fine now.

Answer 2

I have found a successful demo in crictl.md.

I think it may be the linux cgroup config in sandbox_config.json above is not suitable for systemd.

$ cat pod-config.json
{
    "metadata": {
        "name": "nginx-sandbox",
        "namespace": "default",
        "attempt": 1,
        "uid": "hdishd83djaidwnduwk28bcsb"
    },
    "log_directory": "/tmp",
    "linux": {
    }
}

$ cat container-config.json
{
  "metadata": {
      "name": "busybox"
  },
  "image":{
      "image": "busybox"
  },
  "command": [
      "top"
  ],
  "log_path":"busybox/0.log",
  "linux": {
  }
}

However, I still don't know how to config the linux.* in sandbox_config.json for systemd.

Answer 3

One thing I've had to do is set my cgroup-manager for crictl to systemd: in crictl.yaml:

runtime-endpoint: unix:///var/run/crio/crio.sock
cgroup-manager: systemd

As I understand it, you don't need to specify a cgroup in the pod config (you can, but it's not required). CRI-O and crictl just have to be asking for the same cgroup hierarchy