#3690·youki

Difference between youki and runc for cgroupfs + rootless container(The rootless-podman-test is failing)

Author: saku3Created Aug 15, 2026Updated Sep 11, 2026

The rootless-podman-test is failing.

The logs are as follows:

https://github.com/youki-dev/youki/actions/runs/31830687220/job/94866205275

Logs
Run just test-rootless-podman
/home/runner/work/youki/youki/tests/rootless-tests/run.sh /home/runner/work/youki/youki/youki
+ runtime=/home/runner/work/youki/youki/youki
+ podman rm --force --ignore create-test
+ podman create --runtime /home/runner/work/youki/youki/youki --name create-test hello-world
Resolved "hello-world" as an alias (/etc/containers/registries.conf.d/shortnames.conf)
Trying to pull docker.io/library/hello-world:latest...
Getting image source signatures
Copying blob sha256:4f55086f7dd096d48b0e49be066971a8ed996521c2e190aa21b2435a847198b4
Copying config sha256:e2ac70e7319a02c5a477f5825259bd118b94e8b02c279c67afa63adab6d8685b
Writing manifest to image destination
eb23523f1ebede4bf69ad0d90324eb42b298c9c21b0eeea8d9fff2c97d3fb21a
+ podman start -a create-test
+ log=
Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/
+ echo Hello from Docker! This message shows that your installation appears to be working correctly. To generate this message, Docker took the following steps: 1. The Docker+ grep This message shows that your installation appears to be working correctly
 client contacted the Docker daemon. 2. The Docker daemon pulled the "hello-world" image from the Docker Hub. (amd64) 3. The Docker daemon created a new container from that image which runs the executable that produces the output you are currently reading. 4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal. To try something more ambitious, you can run an Ubuntu container with: $ docker run -it ubuntu bash Share images, automate workflows, and more with a free Docker ID: https://hub.docker.com/ For more examples and ideas, visit: https://docs.docker.com/get-started/
+ podman rm --force --ignore create-test
Hello from Docker! This message shows that your installation appears to be working correctly. To generate this message, Docker took the following steps: 1. The Docker client contacted the Docker daemon. 2. The Docker daemon pulled the "hello-world" image from the Docker Hub. (amd64) 3. The Docker daemon created a new container from that image which runs the executable that produces the output you are currently reading. 4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal. To try something more ambitious, you can run an Ubuntu container with: $ docker run -it ubuntu bash Share images, automate workflows, and more with a free Docker ID: https://hub.docker.com/ For more examples and ideas, visit: https://docs.docker.com/get-started/
create-test
+ head -c 10 /dev/random
+ base64
+ rand=ViyGw+ggZTNTbQ==
+ podman run --runtime /home/runner/work/youki/youki/youki fedora echo ViyGw+ggZTNTbQ==
Resolved "fedora" as an alias (/etc/containers/registries.conf.d/shortnames.conf)
Trying to pull registry.fedoraproject.org/fedora:latest...
Getting image source signatures
Copying blob sha256:5f1f9baa5854b6ca36b154bd2dbf163088cdf3d2b9bf0d5ec9de7368fa76c220
Copying config sha256:f9f9bffd915ea192880a7657a207c7653f17c8fea4fd4b0796bbca4a13e68e57
Writing manifest to image destination
+ log=ViyGw+ggZTNTbQ==
+ echo ViyGw+ggZTNTbQ==
+ grep ViyGw+ggZTNTbQ==
ViyGw+ggZTNTbQ==
+ podman kill exec-test
Error: no container with name or ID "exec-test" found: no such container
+ true
+ podman rm --force --ignore exec-test
+ podman run -d --runtime /home/runner/work/youki/youki/youki --name exec-test busybox sleep 10m
Resolved "busybox" as an alias (/etc/containers/registries.conf.d/shortnames.conf)
Trying to pull docker.io/library/busybox:latest...
Getting image source signatures
Copying blob sha256:b05093807bb0294152bb9cf86d64da722732dddaf7f8882fa1f120477dbc4db3
Copying config sha256:c6348fa86ba0fb2108c9334f5fe913ddc6d853313e655891f133a0127c30099f
Writing manifest to image destination
487d5a5af6b7e14c28751cb4f5c3bd41bc84b3e797eecd1b19872626a4056ae2
+ head -c 10 /dev/random
+ base64
+ rand=J0QuRxpIF1XuNw==
+ podman exec --runtime /home/runner/work/youki/youki/youki exec-test echo J0QuRxpIF1XuNw==
+ log=J0QuRxpIF1XuNw==
+ echo J0QuRxpIF1XuNw==
+ grep J0QuRxpIF1XuNw==
J0QuRxpIF1XuNw==
+ podman inspect exec-test
+ jq .[0].State.CgroupPath
+ tr -d "
+ CGROUP_SUB_PATH=/user.slice/user-1001.slice/[email protected]/user.slice/podman-7746.scope
+ CGROUP_PATH=/sys/fs/cgroup/user.slice/user-1001.slice/[email protected]/user.slice/podman-7746.scope/cgroup.procs
+ cat /sys/fs/cgroup/user.slice/user-1001.slice/[email protected]/user.slice/podman-7746.scope/cgroup.procs
+ wc -l
+ test 3 -eq 1
error: recipe `test-rootless-podman` failed on line 73 with exit code 1
Error: Process completed with exit code 1.

Trigger

It seems that the runner image was updated, causing Podman to use cgroupfs instead of systemd.

Runner Image
  Image: ubuntu-24.04
  Version: 20260810.271.1
  Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260810.271/images/ubuntu/Ubuntu2404-Readme.md
  Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260810.271

Root cause

The behavior differs between youki and runc when using cgroupfs in rootless mode.

When checking manually, you can see the difference between youki and runc.

youki

Three lines are displayed.

$ podman --cgroup-manager cgroupfs run -d --runtime youki --name exec-test busybox sleep 10m
$ cgrouppath=$(podman inspect exec-test | jq -r '.[0].State.CgroupPath')
$ cat /sys/fs/cgroup$cgrouppath/cgroup.procs
194388
194394
194397

runc

One line is displayed.

$ podman --cgroup-manager cgroupfs run -d --runtime runc --name exec-test busybox sleep 10m
$ cgrouppath=$(podman inspect exec-test | jq -r '.[0].State.CgroupPath')
$ cat /sys/fs/cgroup$cgrouppath/cgroup.procs
195054