systemd, cgroupsv2: not bind mount /sys/fs/cgroup/systemd

when running on a cgroups v2 system, do not bind mount
the named hierarchy /sys/fs/cgroup/systemd as it doesn't exist
anymore.  Instead bind mount the entire /sys/fs/cgroup.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

libpod/container_internal_linux.go

@@ -466,6 +466,23 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
 		g.AddMount(tmpfsMnt)
 	}
 
+	unified, err := cgroups.IsCgroup2UnifiedMode()
+	if err != nil {
+		return err
+	}
+
+	g.RemoveMount("/sys/fs/cgroup")
+
+	if unified {
+		sourcePath := filepath.Join("/sys/fs/cgroup")
+		systemdMnt := spec.Mount{
+			Destination: "/sys/fs/cgroup",
+			Type:        "bind",
+			Source:      sourcePath,
+			Options:     []string{"bind", "private", "rw"},
+		}
+		g.AddMount(systemdMnt)
+	} else {
 		// rootless containers have no write access to /sys/fs/cgroup, so don't
 		// add any mount into the container.
 		if !rootless.IsRootless() {
@@ -473,10 +490,10 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
 			if err != nil {
 				return err
 			}
-		sourcePath := filepath.Join("/sys/fs/cgroup/systemd", cgroupPath)
+			sourcePath := filepath.Join("/sys/fs/cgroup", cgroupPath)
 
 			systemdMnt := spec.Mount{
-			Destination: "/sys/fs/cgroup/systemd",
+				Destination: "/sys/fs/cgroup",
 				Type:        "bind",
 				Source:      sourcePath,
 				Options:     []string{"bind", "private"},
@@ -484,13 +501,14 @@ func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) erro
 			g.AddMount(systemdMnt)
 		} else {
 			systemdMnt := spec.Mount{
-			Destination: "/sys/fs/cgroup/systemd",
+				Destination: "/sys/fs/cgroup",
 				Type:        "bind",
-			Source:      "/sys/fs/cgroup/systemd",
+				Source:      "/sys/fs/cgroup",
 				Options:     []string{"bind", "nodev", "noexec", "nosuid"},
 			}
 			g.AddMount(systemdMnt)
 		}
+	}
 
 	return nil
 }