Rootless Docker resource limit reset after each reboot and needs daemon reload

Following the Documentation here, the resource limiting does work on rootless Docker running with cgroup v2; but after each reboot you’d need to run System Daemon reload followed by Docker service restart (as the non-root user) to allow delegation of all controllers. If not, the default enabled service after reboot will throw these warnings and does not allow resource limiting:

WARNING: No memory limit support
WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support

Anyone has any solution or work around for this?

What OS do you use on node?

It’s running on Oracle Linux v8 (Kernel - 4.18.0-513).

Oracle Linux is not on the list of supported OSs. How did you install Docker?

You’re right, Oracle Linux is not listed there, but we’ve used CentOS upstream to install Docker on these hosts.

The point is that if an OS is not officially supported, even if you are able to find a repository which alows you to install it, we can1t tell whether the behavior is would happen on CentOS or only on the not supported OS. Oracle Linux could be based on CentOS/Rad Hat, but Ubuntu is based on Debian, yet Ubuntu and Debian have different packages for Docker.

I have been in a similar situation where I thought I had to work on a machine where Docker was installed and I thought the OS was Debian based. It turned out it was Oracle Linux and it had Podman, not Docker and later the maintainer installed Docker from the CentOS repository. It worked eventually, but I knew immediately that it would not be supported and I could only ask the community on the forum where I would need to answer myself probably :slight_smile: The difference is that I didn’t have rootless Docker. I have no experience in Rootless Docker on not supported operating systems and to be honest I haven’t used Rootless Docker in production a lot as in production systems I usually have to work with Kubernetes.

Can you try to install Docker on a CentOS virtual machine and try if you can reproduce the same issue? If you can reproduce it on a supported operating system, that would help you to get more replies and maybe even report the issue as a bug. On the other hand, CentOS 8 stream will reach its end of life in May, so the problem is not just an OS which is not supported, but an OS on which you installed Docker from a repo which will rech its end of life soon so it is not likely to get support for that.

As a community, we could still help, but as I wrote, I have no experience in Rootless Docker on Oracle Linux.

By the way, you could try to wok with Podman if you like Rootless Containers, as one of the main features of Podman is that it does not need root user to run containers and it uses the same network driver as well. Of course that would not be supported by Docker either.

I’m able to reproduce this on RockyLinux 9.4
It’s not a big issue for me, but I’m just curious to know what is missing.

[icmdocker@rocky9 ~]$ docker info 
Client: Docker Engine - Community
 Version:    24.0.9
 Context:    default
 Debug Mode: false

Server:
 Containers: 10
  Running: 10
  Paused: 0
  Stopped: 0
 Images: 22
 Server Version: 24.0.9
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: false
  userxattr: true
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 2bf793ef6dc9a18e00cb12efb64355c2c9d5eb41
 runc version: v1.1.13-0-g58aa920
 init version: de40ad0
 Security Options:
  seccomp
   Profile: builtin
  rootless
  cgroupns
 Kernel Version: 5.14.0-427.28.1.el9_4.x86_64
 Operating System: Rocky Linux 9.4 (Blue Onyx)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 7.505GiB
 Name: rocky9
 ID: d84e7552-0338-4a66-bef9-acf3ea2a4ac6
 Docker Root Dir: /home/icmdocker/docker
 Debug Mode: false
 Username: gdpxl
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: No cpu cfs quota support
WARNING: No cpu cfs period support
WARNING: No cpu shares support
WARNING: No cpuset support
WARNING: No io.weight support
WARNING: No io.weight (per device) support
WARNING: No io.max (rbps) support
WARNING: No io.max (wbps) support
WARNING: No io.max (riops) support
WARNING: No io.max (wiops) support