From 9c3623163a25c86fa83136d80e99b92bf0cc4c66 Mon Sep 17 00:00:00 2001
From: Dmitry Meyer <me@undef.im>
Date: Thu, 17 Oct 2024 14:20:41 +0000
Subject: [PATCH] [dind] Enable cgroups v2 nesting

See: https://github.com/moby/moby/blob/65cfcc2/hack/dind#L59
See: https://github.com/earthly/earthly/blob/08b0d1f/buildkitd/dockerd-wrapper.sh#L63
Fixes: https://github.com/dstackai/dstack/issues/1854
---
 docker/dind/start-dockerd | 74 ++++++++++++++++++++++++++-------------
 1 file changed, 50 insertions(+), 24 deletions(-)

diff --git a/docker/dind/start-dockerd b/docker/dind/start-dockerd
index be71d0804..9a07eec9a 100755
--- a/docker/dind/start-dockerd
+++ b/docker/dind/start-dockerd
@@ -1,32 +1,58 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-mkdir /mnt/_tmp
-if ! mount -t tmpfs none /mnt/_tmp 2> /dev/null; then
-    echo 'docker privileged mode required'
+check_privileged_mode_or_die() {
+    mkdir /mnt/_tmp
+    if ! mount -t tmpfs none /mnt/_tmp 2> /dev/null; then
+        echo 'docker privileged mode required'
+        rm -r /mnt/_tmp
+        exit 101
+    fi
+    umount /mnt/_tmp
     rm -r /mnt/_tmp
-    exit 101
-fi
-umount /mnt/_tmp
-rm -r /mnt/_tmp
+}
 
-if ! supervisorctl status > /dev/null; then
-    supervisord -c /etc/supervisord.conf
-    action='started'
-else
-    supervisorctl restart dockerd > /dev/null
-    action='restarted'
-fi
+start_restart_dockerd() {
+    if ! supervisorctl status > /dev/null; then
+        supervisord -c /etc/supervisord.conf
+        echo 'started'
+    else
+        supervisorctl restart dockerd > /dev/null
+        echo 'restarted'
+    fi
+}
 
-for _i in {1..10}; do
-    if supervisorctl tail dockerd | grep -q 'API listen on'; then
-        echo "dockerd ${action}"
-        exit 0
+move_processes_to_nested_cgroup() {
+    # detect cgroups v2
+    if [[ -f /sys/fs/cgroup/cgroup.controllers ]]; then
+        local group=/sys/fs/cgroup/dockerd
+        mkdir -p ${group}
+        xargs -rn1 < /sys/fs/cgroup/cgroup.procs > ${group}/cgroup.procs || true
     fi
-    sleep 1
-done
+}
 
-supervisorctl stop dockerd > /dev/null
-echo 'failed to start dockerd:'
-supervisorctl tail dockerd
-exit 102
+wait_dockerd_started() {
+    for _i in {1..10}; do
+        if supervisorctl tail dockerd | grep -q 'API listen on'; then
+            return 0
+        fi
+        sleep 1
+    done
+    return 1
+}
+
+show_dockerd_log_and_die() {
+    supervisorctl stop dockerd > /dev/null
+    echo 'failed to start dockerd:'
+    supervisorctl tail dockerd
+    exit 102
+}
+
+
+check_privileged_mode_or_die
+event=$(start_restart_dockerd)
+if ! wait_dockerd_started; then
+    show_dockerd_log_and_die
+fi
+move_processes_to_nested_cgroup
+echo "dockerd ${event}"