{"title":"Podman crun and cgroups v2","url":"https://seanbehan.ca/posts/podman-crun","description":"Getting Podman onto cgroups v2 and crun on distributions that still default to cgroups v1 and runc.","author":"Sean Behan","published":"2021-09-19T03:09:02.000Z","updated":null,"draft":false,"tags":["docker","linux","podman"],"readingMinutes":2,"image":null,"sections":[{"id":"introduction","text":"Introduction","level":2},{"id":"switching-to-crun","text":"Switching to crun","level":2},{"id":"enabling-cgroups-v2","text":"Enabling cgroups v2","level":2},{"id":"verification","text":"Verification","level":2}],"content_format":"text/markdown","content_url":"https://seanbehan.ca/posts/podman-crun.md","content":"### Introduction\n\nPodman[^1] is a container management software similar to Docker that can run\n\nOCI containers as regular users (not root) by using container management\n\nlibraries such as crun or runc, and cgroups v1 or v2. It can be used as a\n\ndrop-in replacement for Docker and supports docker-compose using\n\npodman-compose.\n\nUnfortunately for some distributions after installing podman the operating\n\nsystem defaults to cgroups v1 and runc, not cgroups v2 and crun. As was the\n\ncase on Rocky Linux for me.\n\n### Switching to crun\n\nFirst we can switch to crun instead of runc by installing crun with our package\n\nmanager. It was already installed for me, but on Fedora you would use `sudo dnf\n\ninstall crun`\n\nThen you can edit the file `/usr/share/containers/containers.conf` and change\n\nthe line `runtime = \"runc\"` to `runtime = \"crun\"`. Now you can verify that\n\nyou're using crun with `podman info | grep crun`.\n\n```\nname: crun\npackage: crun-0.20.1-1.module+el8.4.0+643+525e162a.x86_64\npath: /usr/bin/crun\n  crun version 0.20.1\n```\n\n### Enabling cgroups v2\n\nNow the harder part was enabling cgroups v2. Luckily I found a\n\n[comment](https://github.com/containers/podman/issues/9410#issuecomment-785840320)\n\non a GitHub issue outlining the steps you need to complete to get cgroups v2 to\n\nwork.\n\nFirst we can enable it in the kernel with\n\n```\nsudo grubby --update-kernel=ALL --args=\"systemd.unified_cgroup_hierarchy=1\"\n```\n\nThen we can enable linger. This will also allow our containers to remain\n\nrunning after logging out.\n\n```\nsudo loginctl enable-linger codebam\n```\n\nThen the last step which made everything work for me is to set the\n\n`pid_limit=0`. For me it was in `/usr/share/containers/containers.conf` instead\n\nof `/etc/containers/`.\n\n### Verification\n\nNow you can reboot. `podman info | grep cgroup` should say\n\n```\ncgroupControllers: []\ncgroupManager: systemd\ncgroupVersion: v2\n```\n\nNow we're using cgroups v2 and crun.\n\n[^1]: https://podman.io\n"}