support rootless healthchecks

Signed-off-by: Arjun Raja Yogidas <[email protected]>

Author: coderbirju

pkg/healthcheck/healthcheck_manager_linux.go

@@ -50,6 +50,10 @@ func CreateTimer(ctx context.Context, container containerd.Container) error {
 	log.G(ctx).Debugf("Creating healthcheck timer unit: %s", hcName)
 
 	cmd := []string{}
+	if rootlessutil.IsRootless() {
+		cmd = append(cmd, fmt.Sprintf("--uid=%d", rootlessutil.ParentEUID()))
+	}
+
 	if path := os.Getenv("PATH"); path != "" {
 		cmd = append(cmd, "--setenv=PATH="+path)
 	}
@@ -62,11 +66,11 @@ func CreateTimer(ctx context.Context, container containerd.Container) error {
 		cmd = append(cmd, "--debug")
 	}
 
-	conn, err := dbus.NewSystemConnectionContext(context.Background())
-	if err != nil {
-		return fmt.Errorf("systemd DBUS connect error: %w", err)
-	}
-	defer conn.Close()
+	// conn, err := dbus.NewSystemConnectionContext(context.Background())
+	// if err != nil {
+	// 	return fmt.Errorf("systemd DBUS connect error: %w", err)
+	// }
+	// defer conn.Close()
 
 	log.G(ctx).Debugf("creating healthcheck timer with: systemd-run %s", strings.Join(cmd, " "))
 	run := exec.Command("systemd-run", cmd...)
@@ -88,7 +92,13 @@ func StartTimer(ctx context.Context, container containerd.Container) error {
 	}
 
 	hcName := hcUnitName(container.ID(), true)
-	conn, err := dbus.NewSystemConnectionContext(context.Background())
+	var conn *dbus.Conn
+	var err error
+	if rootlessutil.IsRootless() {
+		conn, err = dbus.NewUserConnectionContext(ctx)
+	} else {
+		conn, err = dbus.NewSystemConnectionContext(ctx)
+	}
 	if err != nil {
 		return fmt.Errorf("systemd DBUS connect error: %w", err)
 	}
@@ -115,44 +125,6 @@ func RemoveTransientHealthCheckFiles(ctx context.Context, container containerd.C
 	return ForceRemoveTransientHealthCheckFiles(ctx, container.ID())
 }
 
-// RemoveTransientHealthCheckFilesByID stops and cleans up the transient timer and service using just the container ID.
-// This function is deprecated and no longer used. Use ForceRemoveTransientHealthCheckFiles instead.
-/*
-func RemoveTransientHealthCheckFilesByID(ctx context.Context, containerID string) error {
-	log.G(ctx).Debugf("Removing healthcheck timer unit: %s", containerID)
-
-	conn, err := dbus.NewSystemConnectionContext(context.Background())
-	if err != nil {
-		return fmt.Errorf("systemd DBUS connect error: %w", err)
-	}
-	defer conn.Close()
-
-	unitName := hcUnitName(containerID, true)
-	timer := unitName + ".timer"
-	service := unitName + ".service"
-
-	// Stop timer
-	tChan := make(chan string)
-	if _, err := conn.StopUnitContext(context.Background(), timer, "ignore-dependencies", tChan); err == nil {
-		if msg := <-tChan; msg != "done" {
-			log.G(ctx).Warnf("timer stop message: %s", msg)
-		}
-	}
-
-	// Stop service
-	sChan := make(chan string)
-	if _, err := conn.StopUnitContext(context.Background(), service, "ignore-dependencies", sChan); err == nil {
-		if msg := <-sChan; msg != "done" {
-			log.G(ctx).Warnf("service stop message: %s", msg)
-		}
-	}
-
-	// Reset failed units
-	_ = conn.ResetFailedUnitContext(context.Background(), service)
-	return nil
-}
-*/
-
 // ForceRemoveTransientHealthCheckFiles forcefully stops and cleans up the transient timer and service
 // using just the container ID. This function is non-blocking and uses timeouts to prevent hanging
 // on systemd operations. It logs errors as warnings but continues cleanup attempts.
@@ -174,7 +146,13 @@ func ForceRemoveTransientHealthCheckFiles(ctx context.Context, containerID strin
 	go func() {
 		defer close(errChan)
 
-		conn, err := dbus.NewSystemConnectionContext(timeoutCtx)
+		var conn *dbus.Conn
+		var err error
+		if rootlessutil.IsRootless() {
+			conn, err = dbus.NewUserConnectionContext(ctx)
+		} else {
+			conn, err = dbus.NewSystemConnectionContext(ctx)
+		}
 		if err != nil {
 			log.G(ctx).Warnf("systemd DBUS connect error during force cleanup: %v", err)
 			errChan <- fmt.Errorf("systemd DBUS connect error: %w", err)
@@ -300,10 +278,10 @@ func shouldSkipHealthCheckSystemd(hc *Healthcheck) bool {
 		return true
 	}
 
-	// Skip healthchecks in rootless environments to avoid systemd DBUS permission issues
-	if rootlessutil.IsRootless() {
-		return true
-	}
+	// // Skip healthchecks in rootless environments to avoid systemd DBUS permission issues
+	// if rootlessutil.IsRootless() {
+	// 	return true
+	// }
 
 	// Don't proceed if health check is nil, empty, explicitly NONE or interval is 0.
 	if hc == nil || len(hc.Test) == 0 || hc.Test[0] == "NONE" || hc.Interval == 0 {