Support TLJH inside a container

[rgaiacs]

Part of jupyterhub/team-compass#846 (comment).

Part of jupyterhub/team-compass#851.

In the documentation, Installing on your own server includes

that says

Running TLJH inside a docker container is not supported, since we depend on systemd.

My understanding is that Docker requires some special privileges and mount options to use systemd in containers making it unsafe.

But after read How to run systemd in a container by Daniel Walsh and Podman - systemd in containers by Daniel Schier, my understanding is that

1. Podman supports containers with systemd out of the box
2. It is safe to run containers with systemd on Podman

@yuvipanda what is your opinion of making Podman the 1st class container engine for The Littlest JupyterHub?

[rgaiacs]

After #1057, my understanding is that the statement in the documentation

Running TLJH inside a docker container is not supported, since we depend on systemd.

is not 100% accurate. A more accurate statement is

Running a production TLJH inside container is not supported as it would require the use of the --privileged flag.

Could someone point to me the operations on TLJH that requires the --privileged flag? Thanks!

[manics]

I don't think it requires --privileged, but you do need the correct host mounts (e.g. cgroups), and depending on your system you may need some additional capabilities (--cap-add).

If you're using rootless Podman/Docker you may also need to mess with subuids/subgids, though this is unlikely to be needed if your distribution officially provides Podman packages. I don't know about rootless Docker, I use Podman 😄

[minrk]

Running in a container is a pain, since it doesn't run the full startup machinery we expect. I don't think it should be supported, even if it is technically possible.

Unless it's a lot easier than I think to run a full init setup in a container?