Describe the bug

After updating to OrbStack 2.2.1, no Docker container inside Linux 24.04 machine x86 can start. Every docker run fails at container creation while setting up the systemd cgroup scope. This worked on the previous OrbStack version — it is a regression introduced by 2.2.1 (specifically the new OrbStack kernel that ships with it).

To Reproduce

docker run --rm hello-world in ubuntu 24.04 machine from orbstack with orbstack version 2.2.1

Expected behavior

Container starts normally (e.g. the standard hello-world "Hello from Docker!" message).

Diagnostic report (REQUIRED)

docker: Error response from daemon: failed to create task for container: failed to create shim task:
OCI runtime create failed: runc create failed: unable to start container process:
unable to apply cgroup configuration: unable to start unit
"docker-.scope" (properties [{Name:Description Value:"libcontainer container "}
{Name:Slice Value:"system.slice"} {Name:Delegate Value:true} {Name:PIDs Value:@au [1819]}
{Name:MemoryAccounting Value:true} {Name:CPUAccounting Value:true} {Name:IOAccounting Value:true}
{Name:TasksAccounting Value:true} {Name:DefaultDependencies Value:false}]):
Failed to determine whether process 1819 is a kernel thread: Inappropriate ioctl for device

(exit code 125)

Screenshots and additional context (optional)

Analysis

• This is not image-specific — it fails before the container's process runs, at the cgroup-scope creation step, so every container is affected.
• Docker uses the systemd cgroup driver on cgroup v2. To start a container it asks systemd (over D-Bus) to create a transient docker-<id>.scope unit.
• While creating that scope, systemd determines whether the container init process is a kernel thread, and that check fails with Inappropriate ioctl for device (ENOTTY). This indicates the kernel-side syscall/ioctl systemd relies on for process introspection is no longer behaving as systemd expects on the 2.2.1 kernel.
• The failure appeared only after updating to 2.2.1 with its new kernel build, so this is a regression in the OrbStack kernel's interaction with the in-VM systemd.

Workaround

Switching Docker off the systemd cgroup driver to cgroupfs should bypass the systemd scope-creation path. In the Docker daemon config (/etc/docker/daemon.json):

{ "exec-opts": ["native.cgroupdriver=cgroupfs"] }

then restart Docker. (Reverting the OrbStack update is the other workaround.)

Environment