Different cgroup controllers available in KDE/Wayland and a terminal login session

[mscharley]

Issue Description

I'm trying to get going with rootless podman and kind to start trying out a simple kubernetes setup but I couldn't run kind create cluster due to a missing cpu cgroup controller.

Steps to reproduce the issue

These work for me, but I'm not sure exactly how tied to my specific installation they are:

1. Install OpenSUSE Tumbleweed
2. Install podman via zypper install podman
3. Install podman desktop via flatpak (flathub)
4. Use podman desktop to download kind.
5. Attempt to create a cluster either through podman desktop or directly through a graphical shell results in the following error message:

$ kind create cluster
enabling experimental podman provider
ERROR: failed to create cluster: running kind with rootless provider requires setting systemd property "Delegate=yes", see https://kind.sigs.k8s.io/docs/user/rootless/

This error is being generated because despite delegation actually being configured, the cpu and cpuset cgroup controllers specifically aren't available.

I've followed the instructions at both https://kind.sigs.k8s.io/docs/user/rootless/ and https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md trying to sort this out. systemd-run --scope --user kind create cluster doesn't seem to change anything.

Describe the results you received

The needed cpu cgroup controller is only available when logging into the system directly using a text terminal.

In the graphical session, I can see by tracing up the process tree that the systemd init process has the correct cgroup controllers available but every process beneath it seems be limited to only memory and pids.

Describe the results you expected

Login sessions should have the same cgroup capabilities available regardless of if they are a graphical session or a text session.

podman info output

host:
  arch: amd64
  buildahVersion: 1.35.3
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.11-1.1.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: unknown'
  cpuUtilization:
    idlePercent: 98.64
    systemPercent: 0.55
    userPercent: 0.8
  cpus: 32
  databaseBackend: sqlite
  distribution:
    distribution: opensuse-tumbleweed
    version: "20240510"
  eventLogger: journald
  freeLocks: 2048
  hostname: madellyn-suse
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.8.8-1-default
  linkmode: dynamic
  logDriver: journald
  memFree: 49939288064
  memTotal: 67323990016
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.10.0-1.3.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.10.0
    package: netavark-1.10.3-1.2.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.10.3
  ociRuntime:
    name: crun
    package: crun-1.14.4-1.2.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.14.4
      commit: a220ca661ce078f2c37b38c92e66cf66c012d9c1
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-20240426.d03c4e2-2.1.x86_64
    version: |
      pasta 20240426.d03c4e2-2.1
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: false
    path: /run/user/1000/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.0-1.1.x86_64
    version: |-
      slirp4netns version 1.3.0
      commit: unknown
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 5
      libseccomp: 2.5.5
  swapFree: 67311960064
  swapTotal: 67311960064
  uptime: 0h 21m 4.00s
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.opensuse.org
  - registry.suse.com
  - docker.io
store:
  configFile: /home/madellyn/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/madellyn/.local/share/containers/storage
  graphRootAllocated: 610832220160
  graphRootUsed: 243170897920
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/madellyn/.local/share/containers/storage/volumes
version:
  APIVersion: 5.0.2
  Built: 1713529050
  BuiltTime: Fri Apr 19 22:17:30 2024
  GitCommit: ""
  GoVersion: go1.21.9
  Os: linux
  OsArch: linux/amd64
  Version: 5.0.2

If I run this in a login session created via a text terminal then cpu and cpuset are listed under cgroupControllers as well.

Podman in a container

No

Privileged Or Rootless

Rootless

Upstream Latest Release

No

Additional environment details

I'm running KDE on OpenSUSE Tumbleweed. It's late now, and I haven't tested whether it's a KDE issue, a wayland issue or a graphical session issue yet but I wanted to document what I've found so far somewhere at least.

Kernel: 6.8.8
KDE Plasma: 6.0.4
KDE Framework: 6.1.0

Additional information

Podman is overall working, I can run other applications like distrobox or specific containers just fine.

[mscharley]

I also seem to get the correct cgroup controllers available if I access via an SSH login session, eg. ssh localhost podman info.

Testing the Plasma X11 login session gives the same broken result, however the IceWM session that came with OpenSUSE is working correctly and lists the cpu and cpuset cgroup controllers. At this point I'm going to say it's something with Plasma 6.

[mscharley]

For what it's worth, ssh localhost $(which kind) create cluster has let me get kind running as a short-term workaround.

[Luap99]

I move this to a discussion as podman cannot influence how the cgroup in you current env is set up so this does not seem to be a podman bug.
If this is only with Plamasa then maybe ask the KDE devs if they drop the controllers for some reason.

[mscharley]

Thanks, I wasn't quite sure where to put it and an issue seemed the best approach. I was reaching out in case someone had some more information but with the extra narrowing I did today to it seeming like a KDE issue then you're probably right. If it's a KDE 6.x specific thing then it's a reasonably recent change.