healthcheck: support rootless mode

[giuseppe]

now that dbus authentication works fine from a user namespace (systemd
241 works fine), we can enable rootless healthchecks.

It uses "systemd-run --user" for creating the healthcheck timer and
communicates with the user instance of systemd listening at
$XDG_RUNTIME_DIR/systemd/private.

Closes: #3523

Signed-off-by: Giuseppe Scrivano [email protected]

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[stefanb2]

Looks like this fixes this issue:

$ podman run --name=docker_mongo_3_4_7 -d ... --healthcheck-command /bin/sh -c docker-healthcheck docker.COMPANY.COM:5004/PATH/mongo:3.4.7 --smallfiles
922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c

$ systemctl --user status 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c
● 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.service - /usr/bin/podman healthcheck run 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0b>
   Loaded: loaded (/run/user/1000/systemd/transient/922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.service; transient)
Transient: yes
   Active: inactive (dead) since Tue 2019-07-09 15:30:50 EEST; 6s ago
  Process: 17103 ExecStart=/usr/bin/podman healthcheck run 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c (code=exited, status=0/SUCCESS)
 Main PID: 17103 (code=exited, status=0/SUCCESS)

heinä 09 15:30:50 beckst-lnx systemd[1641]: Started /usr/bin/podman healthcheck run 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.
heinä 09 15:30:50 beckst-lnx podman[17103]: healthy
heinä 09 15:30:50 beckst-lnx systemd[1641]: 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.service: Succeeded.

$ systemctl --user status 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.timer
● 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.timer - /usr/bin/podman healthcheck run 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5>
   Loaded: loaded (/run/user/1000/systemd/transient/922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.timer; transient)
Transient: yes
   Active: active (waiting) since Tue 2019-07-09 15:26:10 EEST; 5min ago
  Trigger: Tue 2019-07-09 15:31:51 EEST; 19s left

heinä 09 15:26:10 beckst-lnx systemd[1641]: Started /usr/bin/podman healthcheck run 922d1277cc48418620843ecdc2ea1447c2cbd1322eaa0be5b8fe5c8fbc15e99c.

$ podman container inspect --format '{{json .Config.Healthcheck}}' docker_mongo_3_4_7
{"Test":["/bin/sh","-c","docker-healthcheck"],"Interval":30000000000,"Timeout":30000000000,"Retries":3}

$ podman container inspect --format '{{json .State.Healthcheck}}' docker_mongo_3_4_7
{"Status":"healthy","FailingStreak":0,"Log":[{"Start":"2019-07-09T15:30:50.215217205+03:00","End":"2019-07-09T15:30:50.417395522+03:00","ExitCode":0,"Output":""},{"Start":"2019-07-09T15:31:21.21267606+03:00","End":"2019-07-09T15:31:21.408044864+03:00","ExitCode":0,"Output":""},{"Start":"2019-07-09T15:31:52.215381587+03:00","End":"2019-07-09T15:31:52.41479621+03:00","ExitCode":0,"Output":""},{"Start":"2019-07-09T15:32:23.23313914+03:00","End":"2019-07-09T15:32:23.456162557+03:00","ExitCode":0,"Output":""},{"Start":"2019-07-09T15:32:54.218175701+03:00","End":"2019-07-09T15:32:54.412113251+03:00","ExitCode":0,"Output":""}]}

I'm unsure: should I report this here or on the issue? Is there a comment command I have to write to "acknowledge" the fix?

[giuseppe]

@stefanb2 here it is enough. Thanks to have tried it out!

[stefanb2]

... and the service & timer units are removed after the container is stopped.

[rhatdan]

/lgtm
/hold

[mheon]

LGTM, nice work @giuseppe

[mheon]

/hold cancel