Can rootless podman containers run outside of user.slice for exclusive CPU isolation?

[bulatsir]

Question

Is it possible to run rootless podman container processes outside of user.slice to use cpuset.cpus.partition=root for exclusive CPU isolation?

Background

I need to isolate specific CPUs so that no other processes can be scheduled on them except my container processes. In cgroup v2, this requires partition=root setting.

What I tried

1. Created top-level slice with partition=root:

# /etc/systemd/system/isolated.slice
[Slice]
AllowedCPUs=0-3

# Configured exclusive CPUs:
echo "0-3" > /sys/fs/cgroup/isolated.slice/cpuset.cpus.exclusive
echo "root" > /sys/fs/cgroup/isolated.slice/cpuset.cpus.partition

2. Ran rootless podman with --cgroup-parent=/isolated.slice

3. Also tried with systemd service:

[Service]
Slice=isolated.slice
User=myuser
ExecStart=/usr/bin/podman run ...

Result

• Podman process starts in /isolated.slice/
• But container processes always end up in /user.slice/user-1024.slice/...
• Container processes run on non-isolated CPUs (not 0-3)

cat /proc/<container_pid>/cgroup
0::/user.slice/user-1024.slice/[email protected]/...

ps -eo pid,comm,psr | grep <process>
# shows CPUs outside of 0-3

I also tried creating a slice inside user.slice with AllowedCPUs=0-3. Container processes run on those CPUs, but isolation is not exclusive and other processes can still be scheduled there via taskset -c 0-3.

Questions

1. Is there any way to run rootless container processes outside of user.slice?
2. Or is this an architectural limitation of rootless podman?

Environment

• Podman version: 4.9.3
• OS: Ubuntu 24.04.2 LTS
• Kernel: 6.14.0-1018-aws
• cgroup: v2 (unified)