public/dotfiles
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docker/: install rootful Docker; gate kind on it

Browse Source 
kind never worked reliably against rootless Docker on Kasm, even with the
cgroup delegation from docker-rootless-cgroup/. So install full Docker
where we can, and flip bin/'s kind gate from "rootless is available" to
"a rootful daemon answers" — kind is simply skipped on Kasm now.

docker/install.sh no-ops when a rootless daemon is already running so it
never fights Kasm's setup. It runs before bin/ in bootstrap so the kind
gate can see the daemon it just started. zsh/zshrc re-execs via newgrp
when the account gained the docker group but the live shell predates it.

docker-rootless-cgroup/ keeps its delegation (still useful for
per-container resource limits); only its kind-centric comments change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
noconnor
2026-07-12 04:39:58 -04:00
co-authored by Claude Opus 4.8
parent ddeb73fd1c
commit 3751836c5c
5 changed files with 97 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-rootless-cgroup/install.sh
+8 -5
View File
@@ -1,7 +1,10 @@
#!/usr/bin/env sh
# docker-rootless-cgroup/install.sh — give rootless Docker cgroup v2 controller
# delegation on a systemd-less host (e.g. Kasm), so per-container cgroups work
# and `kind` can create clusters.
# delegation on a systemd-less host (e.g. Kasm), so per-container cgroups work.
# (This was originally done to support `kind`, but kind never worked reliably
# against rootless Docker even with delegation — bin/ now only installs kind
# where full Docker is available. The delegation itself is still useful for
# per-container resource limits.)
#
# Why: rootless Docker only receives delegated cgroup v2 controllers when
# systemd sets `Delegate=yes` on the user session. Kasm images run no systemd
@@ -117,7 +120,7 @@ cat > "$tmp" <<'SH'
#!/bin/sh
# Managed by dotfiles (docker-rootless-cgroup). Shadows /usr/bin/dockerd-rootless.sh
# on PATH. Places the rootless Docker daemon in a private, delegated cgroup v2
# leaf so it can enable controllers (needed by `kind`), then execs the real
# leaf so it can enable controllers (per-container cgroups), then execs the real
# launcher. No-op if the delegated slice is absent, so it is safe anywhere.
_cg=/sys/fs/cgroup/rootless/daemon
if [ -w /sys/fs/cgroup/rootless ] && [ -d "$_cg" ]; then
@@ -156,9 +159,9 @@ done
driver="$(docker info -f '{{.CgroupDriver}}' 2>/dev/null || true)"
if [ "$driver" = "none" ] || [ -z "$driver" ]; then
say "docker-rootless-cgroup: WARNING — CgroupDriver is still '${driver:-unreachable}'."
say " kind will not work yet. Inspect the new dockerd's cgroup:"
say " Per-container cgroups will not work yet. Inspect the new dockerd's cgroup:"
say " cat /proc/\$(pgrep -x dockerd | head -1)/cgroup # expect .../rootless/daemon"
exit 0
fi
say "docker-rootless-cgroup: done. CgroupDriver=$driver — rootless Docker now has"
say " delegated cgroups; \`kind create cluster\` can run."
say " delegated cgroups; per-container resource limits work."