#!/bin/sh
# Entrypoint: starts systemd as PID 1.
# Without --privileged, Docker mounts the cgroup v2 file system read-only and systemd can not
# create its control groups. With --cgroupns=private and CAP_SYS_ADMIN the container may
# remount its own part of the tree read-write. With --privileged the remount is not needed.

if [ ! -f /sys/fs/cgroup/cgroup.controllers ]; then
	echo "container-init: cgroup v2 is required (unified hierarchy at /sys/fs/cgroup)" >&2
	exit 1
fi

if awk '$5 == "/sys/fs/cgroup" { split($6, o, ","); if (o[1] == "ro") found = 1 } END { exit !found }' /proc/self/mountinfo; then
	if ! mount -o remount,rw /sys/fs/cgroup; then
		echo "container-init: /sys/fs/cgroup is read-only, start the container with --cgroupns=private --cap-add SYS_ADMIN (or --privileged)" >&2
		exit 1
	fi
fi

exec /sbin/init "$@"
