/sys/fs/cgroup mounted readonly

BornDeranged

Good morning everyone, I have installed mailcow 2 days ago and it has been a very good experience so far!
My installation seems to be working fine, I just have on very specific question:
Is it correct that the following mount is read-only?

tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)

I have a control script I deploy on my servers and it alerts on ro mounts because I have had root filesytems becoming ro, and this is the first time that this mount point pops up as readonly.

Regards,
Patrick

esackbauer

That looks strange.
With my Debian 12 it looks like this:
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)

But as we do not know anything about your installation (VPS or self hosted, which OS, mailcow.conf etc), it is hard to guess.

BornDeranged

esackbauer
Yes indeed, sorry.
It’s a Debian 12 as well, hosted with a Hetzner VPS.
On a different machine, but using the Debian docker version, it looks like yours as well.
An obvious difference is the use of cgroup (v1) vs cgroup (v2)…. which made me check the Debian version and I obviously mis-clicked and installed Buster 😏
OK, upgrading as we speak. I’ll report back.

esackbauer

Debian docker versions tend to be too old, and more importantly the docker compose coming with it.
Pls check against minimum requirements:

You need Docker (a version >= 20.10.2 is required) and Docker Compose (a version >= 2.0 is required).

This is why the installation instructions tell you to install docker from docker repository.

BornDeranged

esackbauer

Yes I did install docker from the repository from the start.
So, after a series of OS upgardes (gotta love Debian), I have

root@hx2:/etc/systemd# mount | grep cgroup
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime)

root@hx2:/etc/systemd# cat /etc/debian_version
12.2

root@hx2:/etc/systemd# docker --version
Docker version 24.0.7, build afdd53b

so I’m getting closer, still missing the ,nsdelegate,memory_recursiveprot)part.

esackbauer

what is your docker compose version?

BornDeranged

esackbauer
I use the build-in (v2) version docker compose, not docker-compose.
So I guess it’s the same version number as docker.

esackbauer

BornDeranged So I guess it’s the same

You did 😉

BornDeranged And docker compose –version does not work.

its docker compose version

esackbauer

Please don’t guess, check the version. Its completely different version numbering

BornDeranged

esackbauer
I am not guessing.
I don’t have a docker-composefile.
And docker compose --version does not work.

BornDeranged

esackbauer
TIL 😇

root@hx2:~# docker compose version
Docker Compose version v2.21.0
root@hx2:~# docker version
Client: Docker Engine - Community
 Version:           24.0.7
 API version:       1.43
 Go version:        go1.20.10
 Git commit:        afdd53b
 Built:             Thu Oct 26 09:08:02 2023
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          24.0.7
  API version:      1.43 (minimum version 1.12)
  Go version:       go1.20.10
  Git commit:       311b9ff
  Built:            Thu Oct 26 09:08:02 2023
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          1.6.25
  GitCommit:        d8f198a4ed8892c764191ef7b3b06d8a2eeb5c7f
 runc:
  Version:          1.1.10
  GitCommit:        v1.1.10-0-g18a0cb0
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

BornDeranged

Removing and reinstalling the same docker version did the trick

root@hx2:/opt/mailcow-dockerized# mount|grep cgroup
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)

Thanks for your help!