4 files changed, 57 insertions, 7 deletions

diff --git a/pkg/rootless/rootless.go b/pkg/rootless/rootless.go
new file mode 100644
index 000000000..7e9fe9db6
--- /dev/null
+++ b/pkg/rootless/rootless.go
@@ -0,0 +1,45 @@
+package rootless
+
+import (
+	"os"
+
+	"github.com/containers/storage"
+	"github.com/pkg/errors"
+)
+
+func TryJoinPauseProcess(pausePidPath string) (bool, int, error) {
+	if _, err := os.Stat(pausePidPath); err != nil {
+		return false, -1, nil
+	}
+
+	became, ret, err := TryJoinFromFilePaths("", false, []string{pausePidPath})
+	if err == nil {
+		return became, ret, err
+	}
+
+	// It could not join the pause process, let's lock the file before trying to delete it.
+	pidFileLock, err := storage.GetLockfile(pausePidPath)
+	if err != nil {
+		// The file was deleted by another process.
+		if os.IsNotExist(err) {
+			return false, -1, nil
+		}
+		return false, -1, errors.Wrapf(err, "error acquiring lock on %s", pausePidPath)
+	}
+
+	pidFileLock.Lock()
+	defer func() {
+		if pidFileLock.Locked() {
+			pidFileLock.Unlock()
+		}
+	}()
+
+	// Now the pause PID file is locked.  Try to join once again in case it changed while it was not locked.
+	became, ret, err = TryJoinFromFilePaths("", false, []string{pausePidPath})
+	if err != nil {
+		// It is still failing.  We can safely remove it.
+		os.Remove(pausePidPath)
+		return false, -1, nil
+	}
+	return became, ret, err
+}
diff --git a/pkg/rootless/rootless_linux.go b/pkg/rootless/rootless_linux.go
index 6f6239e5f..99307e8c4 100644
--- a/pkg/rootless/rootless_linux.go
+++ b/pkg/rootless/rootless_linux.go
@@ -431,12 +431,14 @@ func becomeRootInUserNS(pausePid, fileToRead string, fileOutput *os.File) (bool,
 		if err != nil {
 			return false, -1, errors.Wrapf(err, "cannot write setgroups file")
 		}
+		logrus.Debugf("write setgroups file exited with 0")
 
 		uidMap := fmt.Sprintf("/proc/%d/uid_map", pid)
 		err = ioutil.WriteFile(uidMap, []byte(fmt.Sprintf("%d %d 1\n", 0, os.Geteuid())), 0666)
 		if err != nil {
 			return false, -1, errors.Wrapf(err, "cannot write uid_map")
 		}
+		logrus.Debugf("write uid_map exited with 0")
 	}
 
 	gidsMapped := false
@@ -566,10 +568,10 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 
 			r, w := os.NewFile(uintptr(fds[0]), "read file"), os.NewFile(uintptr(fds[1]), "write file")
 
-			defer errorhandling.CloseQuiet(w)
 			defer errorhandling.CloseQuiet(r)
 
 			if _, _, err := becomeRootInUserNS("", path, w); err != nil {
+				w.Close()
 				lastErr = err
 				continue
 			}
@@ -578,7 +580,6 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 				return false, 0, err
 			}
 			defer func() {
-				errorhandling.CloseQuiet(r)
 				C.reexec_in_user_namespace_wait(-1, 0)
 			}()
 
@@ -603,7 +604,7 @@ func TryJoinFromFilePaths(pausePidPath string, needNewNamespace bool, paths []st
 
 	return joinUserAndMountNS(uint(pausePid), pausePidPath)
 }
-func readMappingsProc(path string) ([]idtools.IDMap, error) {
+func ReadMappingsProc(path string) ([]idtools.IDMap, error) {
 	file, err := os.Open(path)
 	if err != nil {
 		return nil, errors.Wrapf(err, "cannot open %s", path)
@@ -669,7 +670,7 @@ func ConfigurationMatches() (bool, error) {
 		return false, err
 	}
 
-	currentUIDs, err := readMappingsProc("/proc/self/uid_map")
+	currentUIDs, err := ReadMappingsProc("/proc/self/uid_map")
 	if err != nil {
 		return false, err
 	}
@@ -678,7 +679,7 @@ func ConfigurationMatches() (bool, error) {
 		return false, err
 	}
 
-	currentGIDs, err := readMappingsProc("/proc/self/gid_map")
+	currentGIDs, err := ReadMappingsProc("/proc/self/gid_map")
 	if err != nil {
 		return false, err
 	}
diff --git a/pkg/rootless/rootless_unsupported.go b/pkg/rootless/rootless_unsupported.go
index ddd9182b0..ce488f364 100644
--- a/pkg/rootless/rootless_unsupported.go
+++ b/pkg/rootless/rootless_unsupported.go
@@ -65,3 +65,8 @@ func ConfigurationMatches() (bool, error) {
 func GetConfiguredMappings() ([]idtools.IDMap, []idtools.IDMap, error) {
 	return nil, nil, errors.New("this function is not supported on this os")
 }
+
+// ReadMappingsProc returns the uid_map and gid_map
+func ReadMappingsProc(path string) ([]idtools.IDMap, error) {
+	return nil, nil
+}
diff --git a/pkg/spec/createconfig.go b/pkg/spec/createconfig.go
index a65263b7d..3685450f0 100644
--- a/pkg/spec/createconfig.go
+++ b/pkg/spec/createconfig.go
@@ -195,8 +195,7 @@ func (c *CreateConfig) getContainerCreateOptions(runtime *libpod.Runtime, pod *l
 	if c.Interactive {
 		options = append(options, libpod.WithStdin())
 	}
-	if c.Systemd && (strings.HasSuffix(c.Command[0], "init") ||
-		strings.HasSuffix(c.Command[0], "systemd")) {
+	if c.Systemd {
 		options = append(options, libpod.WithSystemd())
 	}
 	if c.Name != "" {