Add support for cgroupns_mode

[twouters]

This fixes systemd support in Debian >=11 containers.

Minimal platforms configuration in molecule.yml:

platforms:
  - name: instance
    image: debian:bullseye
    command: /lib/systemd/systemd
    privileged: true
    cgroupns_mode: private

Example Dockerfile.j2:

FROM debian:bullseye

ARG DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y python3 sudo bash ca-certificates \
        iproute2 python3-apt aptitude
RUN apt-get update && apt-get install -y systemd; \
        systemctl mask [email protected]; \
        systemctl mask systemd-timesyncd.service;
RUN rm -f /lib/systemd/system/multi-user.target.wants/* \
    /etc/systemd/system/*.wants/* \
    /lib/systemd/system/local-fs.target.wants/* \
    /lib/systemd/system/sockets.target.wants/*udev* \
    /lib/systemd/system/sockets.target.wants/*initctl* \
    /lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup* \
    /lib/systemd/system/systemd-update-utmp*

[twouters]

This change doesn't seem to be required at all, the provided examples also work without the cgroupns_mode flag. 🤷‍♂️

[vincentstchu]

Hi @twouters, I think this PR could be helpful with docker for mac ansible/molecule#3349

[twouters]

Could be that this change is still required for mac, as commented above.

[zhan9san]

@twouters

Thank you for contribution.

Could you add doc in https://github.com/ansible-community/molecule-docker/blob/main/src/molecule_docker/driver.py#L56?

It would be great if you can add some description about this option.

[twouters]

Added some very very brief docs

[zhan9san]

@twouters

Thanks for your work.

I tested it on my Mac, and it works like a charm with cgroupv2 on Docker Desktop for Mac.

Related to

1. Host debian 11 running molecule on Debian 11 (Failed to connect to bus: No such file or directory) ansible/molecule#3632
2. using this on debian 11 aka. bullseye is resulting in a non-systemd  geerlingguy/docker-debian11-ansible#4

The example for cgroupv2 is as below.

❯ cat molecule/default/molecule.yml
---
dependency:
  name: galaxy
driver:
  name: docker
platforms:
  - name: instance
    image: geerlingguy/docker-debian11-ansible:latest
    command: ${MOLECULE_DOCKER_COMMAND:-""}
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:rw
    pre_build_image: true
    privileged: true
    cgroupns_mode: host
provisioner:
  name: ansible
verifier:
  name: ansible

IMPORTANT:

1. It's /sys/fs/cgroup:/sys/fs/cgroup:rw instead of /sys/fs/cgroup:/sys/fs/cgroup:ro
2. Ensure cgroupns_mode: host exist.