opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-21 01:19:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10177 from giuseppe/always-honor-cgroup-parent

Browse Source 
cgroup: always honor --cgroup-parent
This commit is contained in:
OpenShift Merge Robot
2021-05-03 21:12:30 +02:00
committed by GitHub
parent 697ec8f6f0 17ce567c68
commit 24156f95fb
3 changed files with 48 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
libpod/container_internal_linux.go
View File

@ -2224,8 +2224,19 @@ func (c *Container) getOCICgroupPath() (string, error) {
}
cgroupManager := c.CgroupManager()
switch {
case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)) || c.config.NoCgroups:
case c.config.NoCgroups:
return "", nil
case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)):
if c.config.CgroupParent == CgroupfsDefaultCgroupParent {
// old versions of podman were setting the CgroupParent to CgroupfsDefaultCgroupParent
// by default. Avoid breaking these versions and check whether the cgroup parent is
// set to the default and in this case enable the old behavior. It should not be a real
// problem because the default CgroupParent is usually owned by root so rootless users
// cannot access it.
// This check might be lifted in a future version of Podman.
return "", nil
}
return c.config.CgroupParent, nil
case c.config.CgroupsMode == cgroupSplit:
if c.config.CgroupParent != "" {
return c.config.CgroupParent, nil

2
libpod/runtime_ctr.go
View File

@ -296,7 +296,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
return nil, errors.Wrapf(define.ErrInternal, "pod %s cgroup is not set", pod.ID())
}
ctr.config.CgroupParent = podCgroup
} else {
} else if !rootless.IsRootless() {
ctr.config.CgroupParent = CgroupfsDefaultCgroupParent
}
} else if strings.HasSuffix(path.Base(ctr.config.CgroupParent), ".slice") {

35
test/e2e/run_cgroup_parent_test.go
View File

@ -1,7 +1,10 @@
package integration
import (
"fmt"
"os"
"path/filepath"
"strings"
. "github.com/containers/podman/v3/test/utils"
. "github.com/onsi/ginkgo"
@ -58,6 +61,38 @@ var _ = Describe("Podman run with --cgroup-parent", func() {
Expect(ok).To(BeTrue())
})
Specify("always honor --cgroup-parent", func() {
SkipIfCgroupV1("test not supported in cgroups v1")
if Containerized() || podmanTest.CgroupManager == "cgroupfs" {
Skip("Requires Systemd cgroup manager support")
}
if IsRemote() {
Skip("Not supported for remote")
}
run := podmanTest.Podman([]string{"run", "-d", "--cgroupns=host", fedoraMinimal, "sleep", "100"})
run.WaitWithDefaultTimeout()
Expect(run.ExitCode()).To(Equal(0))
cid := run.OutputToString()
exec := podmanTest.Podman([]string{"exec", cid, "cat", "/proc/self/cgroup"})
exec.WaitWithDefaultTimeout()
Expect(exec.ExitCode()).To(Equal(0))
cgroup := filepath.Dir(strings.TrimRight(strings.Replace(exec.OutputToString(), "0::", "", -1), "\n"))
run = podmanTest.Podman([]string{"--cgroup-manager=cgroupfs", "run", "-d", fmt.Sprintf("--cgroup-parent=%s", cgroup), fedoraMinimal, "sleep", "100"})
run.WaitWithDefaultTimeout()
Expect(run.ExitCode()).To(Equal(0))
exec = podmanTest.Podman([]string{"exec", cid, "cat", "/proc/self/cgroup"})
exec.WaitWithDefaultTimeout()
Expect(exec.ExitCode()).To(Equal(0))
cgroupEffective := filepath.Dir(strings.TrimRight(strings.Replace(exec.OutputToString(), "0::", "", -1), "\n"))
Expect(cgroupEffective).To(Equal(cgroup))
})
Specify("valid --cgroup-parent using slice", func() {
if Containerized() || podmanTest.CgroupManager == "cgroupfs" {
Skip("Requires Systemd cgroup manager support")