<p>I'm having a dockerfile that runs fine with CentOS as a baseimage and enabled systemd, as suggested on CentOS official docker hub image documentation - <a href="https://hub.docker.com/_/centos/" rel="nofollow noreferrer">https://hub.docker.com/_/centos/</a>.</p>

<p>I'll have to start my container using this following command - </p>

<pre><code>docker run -d -p 8080:8080  -e "container=docker" --privileged=true -d --security-opt seccomp:unconfined --cap-add=SYS_ADMIN -v /sys/fs/cgroup:/sys/fs/cgroup:ro myapplicationImage bash -c "/usr/sbin/init"
</code></pre>

<p>Till here, everything works like a charm, I can run my image and everything works fine. I'm trying to deploy my image to Azure Container service, so I was trying to create a yaml file that uses this docker image and creates a cluster. </p>

<p><strong>My Yaml file looks like this.</strong></p>

<pre><code>apiVersion: apps/v2beta1
kind: Deployment
metadata:
  name: myapp-test
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: myapp-test
    spec:
      containers:
      - name: myapp-test
        image: myappregistry.azurecr.io/myapp-test:1.0
        ports:
        - containerPort: 8080
        args: ["--allow-privileged=true","bash"]
        securityContext:
          capabilities:
            add: ["SYS_ADMIN"]
          privileged: true
        command: [ "-c","/usr/sbin/init" ]
      imagePullSecrets:
        - name: myapp-secret-test      
---
apiVersion: v1
kind: Service
metadata:
  name: myapp-test
spec:
  type: LoadBalancer
  ports:
  - port: 8080
  selector:
    app: myapp-test
</code></pre>

<p>This doesn't spin-up my image. The above is a kubernetes cluster yaml file. 
I've also tried Docker-Compose.</p>

<pre><code>version: '3'

services:
  myapp-test:
    build: ./myapp-folder
    environment:
      - container=docker
    volumes:
      - ./sys/fs/cgroup:/sys/fs/cgroup:ro
    ports:
      - "8082:8080"
    privileged: true
    cap_add:
      - SYS_ADMIN
    security_opt:
      - seccomp:unconfined 
    command: "/usr/sbin/init"  
</code></pre>

<p>Both of these configurations fails to create containers. I'm using same configuration as mentioned in above docker run time command and converted that into yaml. But runtime command works and I can access my application, but yaml files fail. Am I missing anything?</p>

<p><strong>here is my kubernetes error:</strong></p>

<pre><code>➜  $ kubectl get po --watch                 
NAME                            READY     STATUS              RESTARTS   AGE
myapp-test-6957c57f6c-zmbt6   0/1       RunContainerError   4          9m
myapp-test-6957c57f6c-zmbt6   0/1       CrashLoopBackOff   4         9m

➜  $ kubectl get svc --watch                                   
NAME           TYPE           CLUSTER-IP    EXTERNAL-IP    PORT(S)          AGE
myapp-test   LoadBalancer   10.0.X.XXX   120.XXX.XX.XXX   8080:30150/TCP   12m
kubernetes     ClusterIP      10.0.0.1      &lt;none&gt;         443/TCP          43m
</code></pre>

<p><strong>In case of Docker Compose:</strong></p>

<p>The container gets kicked in fine, but the service inside my application fails to start. I cannot reach my localhost:8080, but container keeps running.</p>

<p>I'm thinking if it has something to do with my systemd enabled container while accessing it on compose or cluster?</p>

<p>Thanks!</p>

<p>According to <a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#define-a-command-and-arguments-when-you-create-a-pod" rel="nofollow noreferrer">the fine manual</a>, if you provide <code>command:</code> it supersedes <code>ENTRYPOINT</code>, and <code>args:</code> supersedes <code>CMD</code>, meaning your final "command" that image runs is:</p>

<pre><code>-c /usr/sbin/init --allow-privileged=true bash
</code></pre>

<p>which looks very suspicious with the leading <code>-c</code>, especially since your <code>docker-compose.yml</code> only contains <code>/usr/sbin/init</code>.</p>
