manage docker group with systemd-sysusers

[p5]

systemd-sysusers works from a declarative drop-in configuration file (e.g., /usr/lib/sysusers.d/myapp.conf) as an alternative to running groupadd inside the spec files.

This is especially useful in "atomic" distros, such as Silverblue, where groupadd is ran inside a CI environment and will not propagate to the end user system as /etc/passwd is owned by the system.

A better explanation is probably in the Fedora change document - https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format

If the maintainers approve, I'd like to implement this for the RPMs.

[thaJeztah]

A (draft) pull request for discussion probably won't do harm. I'm not familiar (yet) with that feature, so perhaps seeing the changes would help 😅.

Some quick questions;

• Does this require a specific version of systemd? (keeping in mind that we package for various distros, some of which may be on older versions)
• IIRC, we still (although not actively "support") ship some scripts to provide compatibility with non-systemd setups (at least for the .deb variants); would this change be applicable for the .deb packages as well? (and if so, would that preserve that compatibility)?

also /cc @neersighted @tianon-sso in case you have thoughts 😅

[tianon]

I think this is a great idea, and we should do it for the debs too. If the file is generic, it should maybe live in contrib in the Moby repo?

[p5]

I am unfamilar with debs, but sysusers would be useful across the board.

It does require a systemd version newer than 215, which was released in July 2014 according to the Google Wikipedia summary.

The actual configuration would simply be a single line configuration file present in /usr/lib/sysusers.d/*.conf containing:

g docker -

This says "I want a group (g) named docker with a dynamic GID (-)", and would replace the %post groupadd commands inside the spec files.

Obviously systemd-sysusers would not be compatible with systems without systemd, so I am unsure how this change would affect those systems. Although you mentioned there are existing scripts which are used for these machines, so theoretically we can just move the groupadd to those scripts.

I think this is a great idea, and we should do it for the debs too. If the file is generic, it should maybe live in contrib in the Moby repo?

As to where this should live - you all know far better than I do. If moby also uses the "docker" group, it should be useful there, so shifting it as far upstream as possible could be ideal.

[tianon]

Yeah, that sounds great IMO

Looks like https://manpages.debian.org/bookworm/debhelper/dh_installsysusers.1.en.html is the appropriate way to invoke this for Debian (ie, an appropriate symlink in the right place).

[p5]

I've made a couple PRs to demonstrate how this will look.

The first is ready to review in moby/moby. This adds the configuration file which this packaging repo would be able to use.

The second is an example of the changes required to implement here. This one currently echos the file to the right location since I couldn't get the Makefile to use my fork's contents.

Please let me know what you think.

[p5]

Hello
Any chance the moby/moby PR could be reviewed and/or merged? I don't believe this will have any affect on users since it will only be consumed when the packagers decide to.

I'd like to try and get sysusers in place soon for F43 (releasing in 5 months) to give it some time to brew.