Docker issues

[idl0r]

Hey,

we have some docker processes running which is fine so far, but, needrestart detects services running in a docker container and wants to restart docker itself.
docker itself should be restarted, if required but restarting it for it's processes/childs makes no sense. So they should be ignored or they should be restarted the proper way.

Here is an example

[main] eval /etc/needrestart/needrestart.conf
[main] needrestart v3.3
[main] running in root mode
[main] systemd detected
[Core] #1245 is a NeedRestart::Interp::Java
[Core] #1245 uses obsolete script file(s):
[Core] #1245  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/rt.jar
[main] #1245 is a child of #1210
[Core] #1682 is a NeedRestart::Interp::Java
[Core] #1986 is a NeedRestart::Interp::Java
[Core] #1986 uses obsolete script file(s):
[Core] #1986  /opt/tomcat/lib/tomcat-util.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/ext/sunjce_provider.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/resources.jar
[Core] #1986  /opt/tomcat/lib/el-api.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/charsets.jar
[Core] #1986  /opt/tomcat/lib/catalina-ha.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/ext/cldrdata.jar
[Core] #1986  /opt/tomcat/bin/tomcat-juli.jar
[Core] #1986  /opt/tomcat/lib/websocket-api.jar
[Core] #1986  /opt/tomcat/lib/tomcat-i18n-ja.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/rt.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/ext/localedata.jar
[Core] #1986  /opt/tomcat/bin/bootstrap.jar
[Core] #1986  /opt/tomcat/lib/tomcat-i18n-ru.jar
[Core] #1986  /opt/tomcat/lib/babiel-catalina.jar
[Core] #1986  /opt/tomcat/bin/commons-daemon.jar
[Core] #1986  /opt/tomcat/lib/catalina.jar
[Core] #1986  /opt/tomcat/lib/tomcat-coyote.jar
[Core] #1986  /opt/tomcat/lib/catalina-ant.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/ext/dnsns.jar
[Core] #1986  /opt/tomcat/lib/servlet-api.jar
[Core] #1986  /opt/tomcat/lib/tomcat-jdbc.jar
[Core] #1986  /opt/tomcat/lib/tomcat-i18n-fr.jar
[Core] #1986  /opt/tomcat/lib/annotations-api.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/jce.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/jsse.jar
[Core] #1986  /opt/tomcat/lib/jasper.jar
[Core] #1986  /opt/tomcat/lib/tomcat-api.jar
[Core] #1986  /opt/tomcat/lib/tomcat-i18n-es.jar
[Core] #1986  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/ext/sunec.jar
[Core] #1986  /opt/tomcat/lib/tomcat-dbcp.jar
[Core] #1986  /opt/tomcat/lib/catalina-tribes.jar
[Core] #1986  /opt/tomcat/lib/tomcat7-websocket.jar
[Core] #1986  /opt/tomcat/lib/ecj-4.4.2.jar
[Core] #1986  /opt/tomcat/lib/jasper-el.jar
[Core] #1986  /opt/tomcat/lib/jsp-api.jar
[main] #1986 is a child of #1967
[Core] #2240 is a NeedRestart::Interp::Java
[Core] #2769 is a NeedRestart::Interp::Java
[main] #5261 uses deleted /usr/lib64/libsystemd.so.0.6.0;5d428ff8
[main] #5261 is not a child
[main] #5912 uses deleted /usr/lib64/libudev.so.1.6.2;5d428ff8
[main] #5912 is not a child
[Core] #20262 is a NeedRestart::Interp::Java
[Core] #20262 uses obsolete script file(s):
[Core] #20262  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/rt.jar
[main] #20262 is a child of #20237
[Core] #22762 is a NeedRestart::Interp::Java
[Core] #26240 is a NeedRestart::Interp::Python
[Python] #26240: source=/usr/sbin/tuned
[Core] #31203 is a NeedRestart::Interp::Java
[Core] #31203 uses obsolete script file(s):
[Core] #31203  /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.222.b10-0.el7_6.x86_64/jre/lib/rt.jar
[main] #31203 is a child of #31187
[Core] #32089 is a NeedRestart::Interp::Java
[main] #1210 exe => /usr/bin/docker-containerd-shim
[main] #1967 exe => /usr/bin/docker-containerd-shim
[main] #5261 exe => /usr/bin/dbus-daemon
[main] #5261 is dbus.service
[main] #5912 exe => /usr/bin/dockerd
[main] #5912 is docker.service
[main] #20237 exe => /usr/bin/docker-containerd-shim
[main] #31187 exe => /usr/bin/docker-containerd-shim
WARN - Services: 2 (!), Containers: none, Sessions: none|Services=2;;0;0 Containers=0;;0;0 Sessions=0;0;;0
Services:
- dbus.service
- docker.service

It may be related to #80

In this case it's a CentOS 7.6 system.

[svenbs]

@liske : Is there anything we could do to support progress? Is this something a PR would be accepted for? If so, should the solution be discussed in more detail prior to submitting a PR?

[liske]

First we need to get the root cause why needrestart does not detect the process as docker related and ignore those PIDs. The docker detection is based on cgroup name matching. Could you please provide the content of /proc/$PID/cgroup?

[no-response]

This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.

[daylicron]

First we need to get the root cause why needrestart does not detect the process as docker related and ignore those PIDs. The docker detection is based on cgroup name matching. Could you please provide the content of /proc/$PID/cgroup?

Checking this on an CentOS 7.6 System:

systemctl status docker.service
Docs: https://docs.docker.com
 Main PID: 1619 (dockerd)
    Tasks: 420
   Memory: 3.7G
   CGroup: /system.slice/docker.service
           ├─ 1619 /usr/bin/dockerd
           ├─ 1676 docker-containerd --config /var/run/docker/containerd/containerd.toml
           ├─ 2762 docker-containerd-shim -namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/fe967a435417f5aa0aa1ee8ce69005fb408b83f140eda0f98b...
           ├─ 2772 docker-containerd-shim -namespace moby -workdir /var/lib/docker/containerd/daemon/io.containerd.runtime.v1.linux/moby/98424ad72e4033272bb34bbb2cb29689401bc3938d36113d63...
[...]

Checking the cgroups of the Docker daemon:

cat /proc/1619/cgroup 
11:perf_event:/
10:devices:/system.slice/docker.service
9:freezer:/
8:memory:/system.slice/docker.service
7:cpuset:/
6:blkio:/system.slice/docker.service
5:hugetlb:/
4:pids:/system.slice/docker.service
3:cpuacct,cpu:/system.slice/docker.service
2:net_prio,net_cls:/
1:name=systemd:/system.slice/docker.service

Now checking the cgroups of a Docker container:

cat /proc/2762/cgroup 
11:perf_event:/
10:devices:/system.slice/docker.service
9:freezer:/
8:memory:/system.slice/docker.service
7:cpuset:/
6:blkio:/system.slice/docker.service
5:hugetlb:/
4:pids:/system.slice/docker.service
3:cpuacct,cpu:/system.slice/docker.service
2:net_prio,net_cls:/
1:name=systemd:/system.slice/docker.service

[liske]

The cgroup naming style was not detected, yet.