initrd: Mount cgroup2 filesystem for Podman 6+ compatibility

[joelcapitao]

Podman 6 removed cgroups v1 support (podman-container-tools/podman#27271).
Specifically, commit e860773c0d added a mandatory check at startup
that verifies /sys/fs/cgroup is mounted as cgroup2. If the check
fails, Podman exits with: "Cgroups v1 not supported".

Prior to Podman 6, this worked because there was no such verification -
Podman would simply run without cgroups if none were mounted.

Note: osbuild does not actually need cgroup functionality - this is
only to satisfy Podman 6+'s mandatory startup check.

Partially closes: osbuild/osbuild#2502

Assisted-by: OpenCode (Claude Opus 4)

[achilleas-k]

Thank you. This LGTM but the new test is failing.

[joelcapitao]

hmm the target path /sys/fs/cgroup does not exist in fedora-bootc rootfs, so the moveMount operation fails.

[joelcapitao]

@achilleas-k it's working fine now with last changes. I didn't hit the CI issue because I did my test locally with osbuild/osbuild#2503 which ensures /sys/fs/cgroup is available.

[brlane-rht]

I think the readme should also have info about this added to it.

Also, will this work correctly on systems that still use cgroups1 and older podman versions? Or is that something we don't care about at this point?

[joelcapitao]

I think the readme should also have info about this added to it.

Good point, I added the section to the README

Also, will this work correctly on systems that still use cgroups1 and older podman versions? Or is that something we don't care about at this point?

As we are basically following the Podman lifecycle here, I'd say we should not care about old systems (kernel < 4.5 and/or podman < 2.x)

[alexlarsson]

lgtm

[alexlarsson]

The failure seems to be a flake. Can someone rerun it?

[alexlarsson]

The rerun failed, but that seems to be a real failure:
=== Cgroup2 mount test ===
FAIL: /sys/fs/cgroup is not mounted

[alexlarsson]

There were some issues in the handling of the mount, i pushed a fix. Also I changed things to mount /proc earlier so we can get proper debug output in mountAPIs()

[achilleas-k]

Thanks!