Regression in 0.6.8 on Bottlerocket: /sys/fs/cgroup umount fails with EBUSY

[ddrozdovich]

After upgrading Envbox from 0.6.7 to 0.6.8, workspaces no longer start on AWS Bottlerocket nodes.

0.6.7 works correctly with the same cluster and workspace configuration.

Environment:

AWS EKS
Bottlerocket OS 1.64.0 (aws-k8s-1.36)
Kubernetes 1.36
containerd 2.2.5+bottlerocket
cgroup v2

Error:

Waiting for dockerd to startup...

Failed to create Container-based Virtual Machine:
umount: /sys/fs/cgroup: target is busy.
envbox: failed to umount /sys/fs/cgroup

This looks related to the cgroup changes introduced in #169 and adjusted in #173.

0.6.8 added wrap_dockerd.sh, which can execute:

umount /sys/fs/cgroup
mount -t cgroup2 cgroup /sys/fs/cgroup

The failure is coming directly from that new code path.

#173 already mentions EBUSY problems with the new cgroup remount logic, but it looks like Bottlerocket/containerd exposes another mount topology where:

cgroup_mount_root != "/"

while /sys/fs/cgroup still cannot safely be unmounted.

Regression range:

0.6.7: working
0.6.8: broken

I can provide /proc/self/mountinfo, findmnt -R /sys/fs/cgroup, and other cgroup details from the failing pod if useful.

[linear-code]

ENG-3334