Why hasn't Docker Rootless implemented cgroup v1? Are there any limitations? #48778
-
|
Why hasn't Docker Rootless implemented cgroup v1? Are there any limitations? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Because there was no easy and secure way to delegate cgroup v1 to non-root users. Most Linux distributions have already switched to cgroup v2 that properly supports rootless delegation. |
Beta Was this translation helpful? Give feedback.
-
|
I'm a bit confused about this: the root user can support both cgroupv1 and cgroup v2, while non-root users do not support cgroupv1. Is this more of a security consideration or an implementation cost issue? Because from an implementation perspective, if cgroupv1 itself were readable and writable, it seems like it could support cgroupv1. So, is it more of a security concern? |
Beta Was this translation helpful? Give feedback.
Because there was no easy and secure way to delegate cgroup v1 to non-root users.
You can still run Rootless Docker on cgroup v1 hosts, but cgroup-related flags such as
--cpusand--memoryare just ignored.Most Linux distributions have already switched to cgroup v2 that properly supports rootless delegation.
https://rootlesscontaine.rs/getting-started/common/cgroup2/