Debian 11下Docker Rootless启动容器报错：failed to create shim task

• 服务器：debian-11
• Docker版本：23.0.1

按照Docker官方Rootless模式文档配置环境，运行dockerd-rootless.sh启动守护进程后报错：

open /sys/fs/cgroup/user.slice/user-1004.slice/cgroup.controllers: no such file or directory

手动创建该目录并将权限设置给用户certidock后，执行docker run hello-world出现以下错误：

certidock@cont-test:/etc/profile.d$ docker run hello-world
docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: unable to apply cgroup configuration: unable to start unit "docker-7d0ec8e9f2be784420ada3f5b4a3a7ce89cc0c2bcc1cfe92cda1950b7c9461d4.scope" (properties [{Name:Description Value:"libcontainer container 7d0ec8e9f2be784420ada3f5b4a3a7ce89cc0c2bcc1cfe92cda1950b7c9461d4"} {Name:Slice Value:"user.slice"} {Name:Delegate Value:true} {Name:PIDs Value:@au [59175]} {Name:MemoryAccounting Value:true} {Name:CPUAccounting Value:true} {Name:IOAccounting Value:true} {Name:TasksAccounting Value:true} {Name:DefaultDependencies Value:false}]): Permission denied: unknown.
ERRO[0000] error waiting for container: 

解决步骤 #

1. 启用cgroup v2
   Rootless Docker依赖cgroup v2，Debian 11默认未启用。编辑/etc/default/grub，修改GRUB_CMDLINE_LINUX行：

GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1"

更新grub并重启服务器：

sudo update-grub
sudo reboot

2. 验证cgroup v2状态
   重启后执行以下命令，输出包含cgroup2即为生效：

mount | grep cgroup

3. 配置用户cgroup委托权限
   创建systemd配置文件，为用户分配cgroup权限：

sudo mkdir -p /etc/systemd/system/user@.service.d
sudo tee /etc/systemd/system/user@.service.d/delegate.conf <<EOF
[Service]
Delegate=cpu cpuset io memory pids
EOF

重新加载systemd配置，退出当前用户会话后重新登录：

sudo systemctl daemon-reload

4. 重新初始化Rootless Docker
   切换到certidock用户，重新执行初始化脚本：

dockerd-rootless-setuptool.sh install

启动Docker守护进程：

systemctl --user start docker

5. 测试容器运行
   再次执行命令验证：

docker run hello-world

内容的提问来源于stack exchange，提问作者openHBP