Avoiding dbus Errors with cgroups v2 and podman on Rocky Linux 8

Introduction

cgroups v2 is an excellent evolution over cgroups v1 and provides additional functionality such as enhanced resource allocation management, resource isolation, Pressure Stall Information, and more.

When enabling cgroups v2 on Rocky Linux 8 however (which uses cgroups v1 by default) for use with podman, there are areas of the system including your containers.conf and pam configurations, that need to be checked and updated if necessary.

Problem

You run sudo grubby --update-kernel=/boot/vmlinuz-$(uname -r) --args="systemd.unified_cgroup_hierarchy=1" and then reboot your Rocky Linux 8 system to enable cgroups v2. However, upon running a container with podman run, you observe this dbus error:

dbus: couldn't determine address of session bus  Failed to create bus connection: No such file or directory

Symptoms

The following commands should provide output for your user. If not, that usually means the pam configuration is too strict on the system and is not allowing the user's dbus session to run:

systemctl status user@$(id -u).service
systemctl status user-$(id -u).slice
echo $XDG_RUNTIME_DIR

Resolution

Your system-wide containers.conf configuration at /etc/containers/containers.conf or at the user-level at $HOME/.config/containers/containers.conf should contain the below line under [engine]:

cgroup_manager = "cgroupfs"

In addition, check your pam configuration. A configuration that is too strict, can cause the user's dbus session to not run and thus the couldn't determine address of session bus errors appear when executing podman. Adding the line session optional pam_systemd.so in /etc/pam.d/sshd is not enough, the same line also needs to be set in /etc/pam.d/password-auth and /etc/pam.d/system-auth as well, to ensure the user's dbus session activates and runs without interruption.

Root Cause

cgroup_manager = "cgroupfs" not being set in either the system-level /etc/containers/containers.conf file or the user-level $HOME/.config/containers/containers.conf configuration.

session optional pam_systemd.so only being set in /etc/pam.d/sshd and not in /etc/pam.d/password-auth and /etc/pam.d/system-auth as well.

References & related articles

About cgroup v2 - Kubernetes Documentation Lab 4: Advanced System and process monitoring - Rocky Linux Documentation Podman Documentation What does pam_systemd.so do?