mirror of
https://github.com/containers/podman.git
synced 2025-06-19 16:33:24 +08:00
Standardize on capatalized Cgroups
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
@ -97,7 +97,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
|
|||||||
|
|
||||||
cgroupsFlagName := "cgroups"
|
cgroupsFlagName := "cgroups"
|
||||||
createFlags.StringVar(
|
createFlags.StringVar(
|
||||||
&cf.CGroupsMode,
|
&cf.CgroupsMode,
|
||||||
cgroupsFlagName, cgroupConfig(),
|
cgroupsFlagName, cgroupConfig(),
|
||||||
`control container cgroup configuration ("enabled"|"disabled"|"no-conmon"|"split")`,
|
`control container cgroup configuration ("enabled"|"disabled"|"no-conmon"|"split")`,
|
||||||
)
|
)
|
||||||
@ -159,7 +159,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
|
|||||||
|
|
||||||
deviceCgroupRuleFlagName := "device-cgroup-rule"
|
deviceCgroupRuleFlagName := "device-cgroup-rule"
|
||||||
createFlags.StringSliceVar(
|
createFlags.StringSliceVar(
|
||||||
&cf.DeviceCGroupRule,
|
&cf.DeviceCgroupRule,
|
||||||
deviceCgroupRuleFlagName, []string{},
|
deviceCgroupRuleFlagName, []string{},
|
||||||
"Add a rule to the cgroup allowed devices list",
|
"Add a rule to the cgroup allowed devices list",
|
||||||
)
|
)
|
||||||
@ -762,7 +762,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
|
|||||||
|
|
||||||
cgroupParentFlagName := "cgroup-parent"
|
cgroupParentFlagName := "cgroup-parent"
|
||||||
createFlags.StringVar(
|
createFlags.StringVar(
|
||||||
&cf.CGroupParent,
|
&cf.CgroupParent,
|
||||||
cgroupParentFlagName, "",
|
cgroupParentFlagName, "",
|
||||||
"Optional parent cgroup for the container",
|
"Optional parent cgroup for the container",
|
||||||
)
|
)
|
||||||
|
@ -246,7 +246,7 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
|
|||||||
Authfile: "",
|
Authfile: "",
|
||||||
CapAdd: append(capAdd, cc.HostConfig.CapAdd...),
|
CapAdd: append(capAdd, cc.HostConfig.CapAdd...),
|
||||||
CapDrop: append(cappDrop, cc.HostConfig.CapDrop...),
|
CapDrop: append(cappDrop, cc.HostConfig.CapDrop...),
|
||||||
CGroupParent: cc.HostConfig.CgroupParent,
|
CgroupParent: cc.HostConfig.CgroupParent,
|
||||||
CIDFile: cc.HostConfig.ContainerIDFile,
|
CIDFile: cc.HostConfig.ContainerIDFile,
|
||||||
CPUPeriod: uint64(cc.HostConfig.CPUPeriod),
|
CPUPeriod: uint64(cc.HostConfig.CPUPeriod),
|
||||||
CPUQuota: cc.HostConfig.CPUQuota,
|
CPUQuota: cc.HostConfig.CPUQuota,
|
||||||
@ -259,7 +259,7 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
|
|||||||
// Detach: false, // don't need
|
// Detach: false, // don't need
|
||||||
// DetachKeys: "", // don't need
|
// DetachKeys: "", // don't need
|
||||||
Devices: devices,
|
Devices: devices,
|
||||||
DeviceCGroupRule: nil,
|
DeviceCgroupRule: nil,
|
||||||
DeviceReadBPs: readBps,
|
DeviceReadBPs: readBps,
|
||||||
DeviceReadIOPs: readIops,
|
DeviceReadIOPs: readIops,
|
||||||
DeviceWriteBPs: writeBps,
|
DeviceWriteBPs: writeBps,
|
||||||
|
@ -257,8 +257,8 @@ func CreateInit(c *cobra.Command, vals entities.ContainerCreateOptions, isInfra
|
|||||||
}
|
}
|
||||||
vals.Env = env
|
vals.Env = env
|
||||||
}
|
}
|
||||||
if c.Flag("cgroups").Changed && vals.CGroupsMode == "split" && registry.IsRemote() {
|
if c.Flag("cgroups").Changed && vals.CgroupsMode == "split" && registry.IsRemote() {
|
||||||
return vals, errors.Errorf("the option --cgroups=%q is not supported in remote mode", vals.CGroupsMode)
|
return vals, errors.Errorf("the option --cgroups=%q is not supported in remote mode", vals.CgroupsMode)
|
||||||
}
|
}
|
||||||
|
|
||||||
if c.Flag("pod").Changed && !strings.HasPrefix(c.Flag("pod").Value.String(), "new:") && c.Flag("userns").Changed {
|
if c.Flag("pod").Changed && !strings.HasPrefix(c.Flag("pod").Value.String(), "new:") && c.Flag("userns").Changed {
|
||||||
|
@ -215,7 +215,7 @@ func (s *BoltState) Refresh() error {
|
|||||||
return errors.Wrapf(err, "error unmarshalling state for pod %s", string(id))
|
return errors.Wrapf(err, "error unmarshalling state for pod %s", string(id))
|
||||||
}
|
}
|
||||||
|
|
||||||
// Clear the CGroup path
|
// Clear the Cgroup path
|
||||||
state.CgroupPath = ""
|
state.CgroupPath = ""
|
||||||
|
|
||||||
newStateBytes, err := json.Marshal(state)
|
newStateBytes, err := json.Marshal(state)
|
||||||
|
@ -23,7 +23,7 @@ import (
|
|||||||
"github.com/sirupsen/logrus"
|
"github.com/sirupsen/logrus"
|
||||||
)
|
)
|
||||||
|
|
||||||
// CgroupfsDefaultCgroupParent is the cgroup parent for CGroupFS in libpod
|
// CgroupfsDefaultCgroupParent is the cgroup parent for CgroupFS in libpod
|
||||||
const CgroupfsDefaultCgroupParent = "/libpod_parent"
|
const CgroupfsDefaultCgroupParent = "/libpod_parent"
|
||||||
|
|
||||||
// SystemdDefaultCgroupParent is the cgroup parent for the systemd cgroup
|
// SystemdDefaultCgroupParent is the cgroup parent for the systemd cgroup
|
||||||
@ -56,7 +56,7 @@ const (
|
|||||||
UserNS LinuxNS = iota
|
UserNS LinuxNS = iota
|
||||||
// UTSNS is the UTS namespace
|
// UTSNS is the UTS namespace
|
||||||
UTSNS LinuxNS = iota
|
UTSNS LinuxNS = iota
|
||||||
// CgroupNS is the CGroup namespace
|
// CgroupNS is the Cgroup namespace
|
||||||
CgroupNS LinuxNS = iota
|
CgroupNS LinuxNS = iota
|
||||||
)
|
)
|
||||||
|
|
||||||
@ -575,7 +575,7 @@ func (c *Container) CreatedTime() time.Time {
|
|||||||
return c.config.CreatedTime
|
return c.config.CreatedTime
|
||||||
}
|
}
|
||||||
|
|
||||||
// CgroupParent gets the container's CGroup parent
|
// CgroupParent gets the container's Cgroup parent
|
||||||
func (c *Container) CgroupParent() string {
|
func (c *Container) CgroupParent() string {
|
||||||
return c.config.CgroupParent
|
return c.config.CgroupParent
|
||||||
}
|
}
|
||||||
@ -907,10 +907,10 @@ func (c *Container) CgroupManager() string {
|
|||||||
return cgroupManager
|
return cgroupManager
|
||||||
}
|
}
|
||||||
|
|
||||||
// CGroupPath returns a cgroups "path" for the given container.
|
// CgroupPath returns a cgroups "path" for the given container.
|
||||||
// Note that the container must be running. Otherwise, an error
|
// Note that the container must be running. Otherwise, an error
|
||||||
// is returned.
|
// is returned.
|
||||||
func (c *Container) CGroupPath() (string, error) {
|
func (c *Container) CgroupPath() (string, error) {
|
||||||
if !c.batched {
|
if !c.batched {
|
||||||
c.lock.Lock()
|
c.lock.Lock()
|
||||||
defer c.lock.Unlock()
|
defer c.lock.Unlock()
|
||||||
|
@ -334,7 +334,7 @@ type ContainerMiscConfig struct {
|
|||||||
// CgroupManager is the cgroup manager used to create this container.
|
// CgroupManager is the cgroup manager used to create this container.
|
||||||
// If empty, the runtime default will be used.
|
// If empty, the runtime default will be used.
|
||||||
CgroupManager string `json:"cgroupManager,omitempty"`
|
CgroupManager string `json:"cgroupManager,omitempty"`
|
||||||
// NoCgroups indicates that the container will not create CGroups. It is
|
// NoCgroups indicates that the container will not create Cgroups. It is
|
||||||
// incompatible with CgroupParent. Deprecated in favor of CgroupsMode.
|
// incompatible with CgroupParent. Deprecated in favor of CgroupsMode.
|
||||||
NoCgroups bool `json:"noCgroups,omitempty"`
|
NoCgroups bool `json:"noCgroups,omitempty"`
|
||||||
// CgroupsMode indicates how the container will create cgroups
|
// CgroupsMode indicates how the container will create cgroups
|
||||||
|
@ -730,7 +730,7 @@ func (c *Container) generateInspectContainerHostConfig(ctrSpec *spec.Spec, named
|
|||||||
}
|
}
|
||||||
hostConfig.CgroupMode = cgroupMode
|
hostConfig.CgroupMode = cgroupMode
|
||||||
|
|
||||||
// CGroup parent
|
// Cgroup parent
|
||||||
// Need to check if it's the default, and not print if so.
|
// Need to check if it's the default, and not print if so.
|
||||||
defaultCgroupParent := ""
|
defaultCgroupParent := ""
|
||||||
switch c.CgroupManager() {
|
switch c.CgroupManager() {
|
||||||
|
@ -1092,7 +1092,7 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error {
|
|||||||
// upstream in any OCI runtime.
|
// upstream in any OCI runtime.
|
||||||
// TODO: Remove once runc supports cgroupsv2
|
// TODO: Remove once runc supports cgroupsv2
|
||||||
if strings.Contains(err.Error(), "this version of runc doesn't work on cgroups v2") {
|
if strings.Contains(err.Error(), "this version of runc doesn't work on cgroups v2") {
|
||||||
logrus.Errorf("Oci runtime %q does not support CGroups V2: use system migrate to mitigate", c.ociRuntime.Name())
|
logrus.Errorf("Oci runtime %q does not support Cgroups V2: use system migrate to mitigate", c.ociRuntime.Name())
|
||||||
}
|
}
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
@ -1291,8 +1291,8 @@ func (c *Container) stop(timeout uint) error {
|
|||||||
// a pid namespace then the OCI Runtime needs to kill ALL processes in
|
// a pid namespace then the OCI Runtime needs to kill ALL processes in
|
||||||
// the containers cgroup in order to make sure the container is stopped.
|
// the containers cgroup in order to make sure the container is stopped.
|
||||||
all := !c.hasNamespace(spec.PIDNamespace)
|
all := !c.hasNamespace(spec.PIDNamespace)
|
||||||
// We can't use --all if CGroups aren't present.
|
// We can't use --all if Cgroups aren't present.
|
||||||
// Rootless containers with CGroups v1 and NoCgroups are both cases
|
// Rootless containers with Cgroups v1 and NoCgroups are both cases
|
||||||
// where this can happen.
|
// where this can happen.
|
||||||
if all {
|
if all {
|
||||||
if c.config.NoCgroups {
|
if c.config.NoCgroups {
|
||||||
@ -1400,7 +1400,7 @@ func (c *Container) stop(timeout uint) error {
|
|||||||
// Internal, non-locking function to pause a container
|
// Internal, non-locking function to pause a container
|
||||||
func (c *Container) pause() error {
|
func (c *Container) pause() error {
|
||||||
if c.config.NoCgroups {
|
if c.config.NoCgroups {
|
||||||
return errors.Wrapf(define.ErrNoCgroups, "cannot pause without using CGroups")
|
return errors.Wrapf(define.ErrNoCgroups, "cannot pause without using Cgroups")
|
||||||
}
|
}
|
||||||
|
|
||||||
if rootless.IsRootless() {
|
if rootless.IsRootless() {
|
||||||
@ -1428,7 +1428,7 @@ func (c *Container) pause() error {
|
|||||||
// Internal, non-locking function to unpause a container
|
// Internal, non-locking function to unpause a container
|
||||||
func (c *Container) unpause() error {
|
func (c *Container) unpause() error {
|
||||||
if c.config.NoCgroups {
|
if c.config.NoCgroups {
|
||||||
return errors.Wrapf(define.ErrNoCgroups, "cannot unpause without using CGroups")
|
return errors.Wrapf(define.ErrNoCgroups, "cannot unpause without using Cgroups")
|
||||||
}
|
}
|
||||||
|
|
||||||
if err := c.ociRuntime.UnpauseContainer(c); err != nil {
|
if err := c.ociRuntime.UnpauseContainer(c); err != nil {
|
||||||
|
@ -2772,7 +2772,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
|
|||||||
// expects cgroups to be passed as follows:
|
// expects cgroups to be passed as follows:
|
||||||
// slice:prefix:name
|
// slice:prefix:name
|
||||||
systemdCgroups := fmt.Sprintf("%s:libpod:%s", path.Base(c.config.CgroupParent), c.ID())
|
systemdCgroups := fmt.Sprintf("%s:libpod:%s", path.Base(c.config.CgroupParent), c.ID())
|
||||||
logrus.Debugf("Setting CGroups for container %s to %s", c.ID(), systemdCgroups)
|
logrus.Debugf("Setting Cgroups for container %s to %s", c.ID(), systemdCgroups)
|
||||||
return systemdCgroups, nil
|
return systemdCgroups, nil
|
||||||
case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)):
|
case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)):
|
||||||
if c.config.CgroupParent == "" || !isRootlessCgroupSet(c.config.CgroupParent) {
|
if c.config.CgroupParent == "" || !isRootlessCgroupSet(c.config.CgroupParent) {
|
||||||
@ -2781,7 +2781,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
|
|||||||
fallthrough
|
fallthrough
|
||||||
case cgroupManager == config.CgroupfsCgroupsManager:
|
case cgroupManager == config.CgroupfsCgroupsManager:
|
||||||
cgroupPath := filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-%s", c.ID()))
|
cgroupPath := filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-%s", c.ID()))
|
||||||
logrus.Debugf("Setting CGroup path for container %s to %s", c.ID(), cgroupPath)
|
logrus.Debugf("Setting Cgroup path for container %s to %s", c.ID(), cgroupPath)
|
||||||
return cgroupPath, nil
|
return cgroupPath, nil
|
||||||
default:
|
default:
|
||||||
return "", errors.Wrapf(define.ErrInvalidArg, "invalid cgroup manager %s requested", cgroupManager)
|
return "", errors.Wrapf(define.ErrInvalidArg, "invalid cgroup manager %s requested", cgroupManager)
|
||||||
|
@ -57,13 +57,13 @@ func (c *Container) validate() error {
|
|||||||
if ns.Type == spec.PIDNamespace {
|
if ns.Type == spec.PIDNamespace {
|
||||||
foundPid = true
|
foundPid = true
|
||||||
if ns.Path != "" {
|
if ns.Path != "" {
|
||||||
return errors.Wrapf(define.ErrInvalidArg, "containers not creating CGroups must create a private PID namespace - cannot use another")
|
return errors.Wrapf(define.ErrInvalidArg, "containers not creating Cgroups must create a private PID namespace - cannot use another")
|
||||||
}
|
}
|
||||||
break
|
break
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
if !foundPid {
|
if !foundPid {
|
||||||
return errors.Wrapf(define.ErrInvalidArg, "containers not creating CGroups must create a private PID namespace")
|
return errors.Wrapf(define.ErrInvalidArg, "containers not creating Cgroups must create a private PID namespace")
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -345,9 +345,9 @@ type InspectContainerHostConfig struct {
|
|||||||
// populated.
|
// populated.
|
||||||
// TODO.
|
// TODO.
|
||||||
Cgroup string `json:"Cgroup"`
|
Cgroup string `json:"Cgroup"`
|
||||||
// Cgroups contains the container's CGroup mode.
|
// Cgroups contains the container's Cgroup mode.
|
||||||
// Allowed values are "default" (container is creating CGroups) and
|
// Allowed values are "default" (container is creating Cgroups) and
|
||||||
// "disabled" (container is not creating CGroups).
|
// "disabled" (container is not creating Cgroups).
|
||||||
// This is Libpod-specific and not included in `docker inspect`.
|
// This is Libpod-specific and not included in `docker inspect`.
|
||||||
Cgroups string `json:"Cgroups"`
|
Cgroups string `json:"Cgroups"`
|
||||||
// Links is unused, and provided purely for Docker compatibility.
|
// Links is unused, and provided purely for Docker compatibility.
|
||||||
@ -417,7 +417,7 @@ type InspectContainerHostConfig struct {
|
|||||||
Isolation string `json:"Isolation"`
|
Isolation string `json:"Isolation"`
|
||||||
// CpuShares indicates the CPU resources allocated to the container.
|
// CpuShares indicates the CPU resources allocated to the container.
|
||||||
// It is a relative weight in the scheduler for assigning CPU time
|
// It is a relative weight in the scheduler for assigning CPU time
|
||||||
// versus other CGroups.
|
// versus other Cgroups.
|
||||||
CpuShares uint64 `json:"CpuShares"`
|
CpuShares uint64 `json:"CpuShares"`
|
||||||
// Memory indicates the memory resources allocated to the container.
|
// Memory indicates the memory resources allocated to the container.
|
||||||
// This is the limit (in bytes) of RAM the container may use.
|
// This is the limit (in bytes) of RAM the container may use.
|
||||||
@ -434,12 +434,12 @@ type InspectContainerHostConfig struct {
|
|||||||
// 100000, we will set both CpuQuota, CpuPeriod, and NanoCpus. If
|
// 100000, we will set both CpuQuota, CpuPeriod, and NanoCpus. If
|
||||||
// CpuQuota is not the default, we will not set NanoCpus.
|
// CpuQuota is not the default, we will not set NanoCpus.
|
||||||
NanoCpus int64 `json:"NanoCpus"`
|
NanoCpus int64 `json:"NanoCpus"`
|
||||||
// CgroupParent is the CGroup parent of the container.
|
// CgroupParent is the Cgroup parent of the container.
|
||||||
// Only set if not default.
|
// Only set if not default.
|
||||||
CgroupParent string `json:"CgroupParent"`
|
CgroupParent string `json:"CgroupParent"`
|
||||||
// BlkioWeight indicates the I/O resources allocated to the container.
|
// BlkioWeight indicates the I/O resources allocated to the container.
|
||||||
// It is a relative weight in the scheduler for assigning I/O time
|
// It is a relative weight in the scheduler for assigning I/O time
|
||||||
// versus other CGroups.
|
// versus other Cgroups.
|
||||||
BlkioWeight uint16 `json:"BlkioWeight"`
|
BlkioWeight uint16 `json:"BlkioWeight"`
|
||||||
// BlkioWeightDevice is an array of I/O resource priorities for
|
// BlkioWeightDevice is an array of I/O resource priorities for
|
||||||
// individual device nodes.
|
// individual device nodes.
|
||||||
|
@ -96,7 +96,7 @@ var (
|
|||||||
ErrWillDeadlock = errors.New("deadlock due to lock mismatch")
|
ErrWillDeadlock = errors.New("deadlock due to lock mismatch")
|
||||||
|
|
||||||
// ErrNoCgroups indicates that the container does not have its own
|
// ErrNoCgroups indicates that the container does not have its own
|
||||||
// CGroup.
|
// Cgroup.
|
||||||
ErrNoCgroups = errors.New("this container does not have a cgroup")
|
ErrNoCgroups = errors.New("this container does not have a cgroup")
|
||||||
// ErrNoLogs indicates that this container is not creating a log so log
|
// ErrNoLogs indicates that this container is not creating a log so log
|
||||||
// operations cannot be performed on it
|
// operations cannot be performed on it
|
||||||
|
@ -27,7 +27,7 @@ type HostInfo struct {
|
|||||||
Arch string `json:"arch"`
|
Arch string `json:"arch"`
|
||||||
BuildahVersion string `json:"buildahVersion"`
|
BuildahVersion string `json:"buildahVersion"`
|
||||||
CgroupManager string `json:"cgroupManager"`
|
CgroupManager string `json:"cgroupManager"`
|
||||||
CGroupsVersion string `json:"cgroupVersion"`
|
CgroupsVersion string `json:"cgroupVersion"`
|
||||||
CgroupControllers []string `json:"cgroupControllers"`
|
CgroupControllers []string `json:"cgroupControllers"`
|
||||||
Conmon *ConmonInfo `json:"conmon"`
|
Conmon *ConmonInfo `json:"conmon"`
|
||||||
CPUs int `json:"cpus"`
|
CPUs int `json:"cpus"`
|
||||||
|
@ -26,12 +26,12 @@ type InspectPodData struct {
|
|||||||
// Labels is a set of key-value labels that have been applied to the
|
// Labels is a set of key-value labels that have been applied to the
|
||||||
// pod.
|
// pod.
|
||||||
Labels map[string]string `json:"Labels,omitempty"`
|
Labels map[string]string `json:"Labels,omitempty"`
|
||||||
// CreateCgroup is whether this pod will create its own CGroup to group
|
// CreateCgroup is whether this pod will create its own Cgroup to group
|
||||||
// containers under.
|
// containers under.
|
||||||
CreateCgroup bool
|
CreateCgroup bool
|
||||||
// CgroupParent is the parent of the pod's CGroup.
|
// CgroupParent is the parent of the pod's Cgroup.
|
||||||
CgroupParent string `json:"CgroupParent,omitempty"`
|
CgroupParent string `json:"CgroupParent,omitempty"`
|
||||||
// CgroupPath is the path to the pod's CGroup.
|
// CgroupPath is the path to the pod's Cgroup.
|
||||||
CgroupPath string `json:"CgroupPath,omitempty"`
|
CgroupPath string `json:"CgroupPath,omitempty"`
|
||||||
// CreateInfra is whether this pod will create an infra container to
|
// CreateInfra is whether this pod will create an infra container to
|
||||||
// share namespaces.
|
// share namespaces.
|
||||||
|
@ -104,7 +104,7 @@ func (r *Runtime) hostInfo() (*define.HostInfo, error) {
|
|||||||
return nil, errors.Wrapf(err, "error getting Seccomp profile path")
|
return nil, errors.Wrapf(err, "error getting Seccomp profile path")
|
||||||
}
|
}
|
||||||
|
|
||||||
// CGroups version
|
// Cgroups version
|
||||||
unified, err := cgroups.IsCgroup2UnifiedMode()
|
unified, err := cgroups.IsCgroup2UnifiedMode()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, errors.Wrapf(err, "error reading cgroups mode")
|
return nil, errors.Wrapf(err, "error reading cgroups mode")
|
||||||
@ -150,7 +150,7 @@ func (r *Runtime) hostInfo() (*define.HostInfo, error) {
|
|||||||
if unified {
|
if unified {
|
||||||
cgroupVersion = "v2"
|
cgroupVersion = "v2"
|
||||||
}
|
}
|
||||||
info.CGroupsVersion = cgroupVersion
|
info.CgroupsVersion = cgroupVersion
|
||||||
|
|
||||||
slirp4netnsPath := r.config.Engine.NetworkCmdPath
|
slirp4netnsPath := r.config.Engine.NetworkCmdPath
|
||||||
if slirp4netnsPath == "" {
|
if slirp4netnsPath == "" {
|
||||||
|
@ -1402,7 +1402,7 @@ func (r *ConmonOCIRuntime) sharedConmonArgs(ctr *Container, cuuid, bundlePath, p
|
|||||||
args = append(args, "--log-tag", logTag)
|
args = append(args, "--log-tag", logTag)
|
||||||
}
|
}
|
||||||
if ctr.config.NoCgroups {
|
if ctr.config.NoCgroups {
|
||||||
logrus.Debugf("Running with no CGroups")
|
logrus.Debugf("Running with no Cgroups")
|
||||||
args = append(args, "--runtime-arg", "--cgroup-manager", "--runtime-arg", "disabled")
|
args = append(args, "--runtime-arg", "--cgroup-manager", "--runtime-arg", "disabled")
|
||||||
}
|
}
|
||||||
return args
|
return args
|
||||||
|
@ -217,7 +217,7 @@ func WithCgroupManager(manager string) RuntimeOption {
|
|||||||
}
|
}
|
||||||
|
|
||||||
if manager != config.CgroupfsCgroupsManager && manager != config.SystemdCgroupsManager {
|
if manager != config.CgroupfsCgroupsManager && manager != config.SystemdCgroupsManager {
|
||||||
return errors.Wrapf(define.ErrInvalidArg, "CGroup manager must be one of %s and %s",
|
return errors.Wrapf(define.ErrInvalidArg, "Cgroup manager must be one of %s and %s",
|
||||||
config.CgroupfsCgroupsManager, config.SystemdCgroupsManager)
|
config.CgroupfsCgroupsManager, config.SystemdCgroupsManager)
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -945,7 +945,7 @@ func WithUTSNSFrom(nsCtr *Container) CtrCreateOption {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// WithCgroupNSFrom indicates the the container should join the CGroup namespace
|
// WithCgroupNSFrom indicates the the container should join the Cgroup namespace
|
||||||
// of the given container.
|
// of the given container.
|
||||||
// If the container has joined a pod, it can only join the namespaces of
|
// If the container has joined a pod, it can only join the namespaces of
|
||||||
// containers in the same pod.
|
// containers in the same pod.
|
||||||
@ -1080,7 +1080,7 @@ func WithLogTag(tag string) CtrCreateOption {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// WithCgroupsMode disables the creation of CGroups for the conmon process.
|
// WithCgroupsMode disables the creation of Cgroups for the conmon process.
|
||||||
func WithCgroupsMode(mode string) CtrCreateOption {
|
func WithCgroupsMode(mode string) CtrCreateOption {
|
||||||
return func(ctr *Container) error {
|
return func(ctr *Container) error {
|
||||||
if ctr.valid {
|
if ctr.valid {
|
||||||
@ -1864,7 +1864,7 @@ func WithPodCgroupParent(path string) PodCreateOption {
|
|||||||
// WithPodCgroups tells containers in this pod to use the cgroup created for
|
// WithPodCgroups tells containers in this pod to use the cgroup created for
|
||||||
// this pod.
|
// this pod.
|
||||||
// This can still be overridden at the container level by explicitly specifying
|
// This can still be overridden at the container level by explicitly specifying
|
||||||
// a CGroup parent.
|
// a Cgroup parent.
|
||||||
func WithPodCgroups() PodCreateOption {
|
func WithPodCgroups() PodCreateOption {
|
||||||
return func(pod *Pod) error {
|
return func(pod *Pod) error {
|
||||||
if pod.valid {
|
if pod.valid {
|
||||||
|
@ -44,9 +44,9 @@ type PodConfig struct {
|
|||||||
|
|
||||||
// Labels contains labels applied to the pod
|
// Labels contains labels applied to the pod
|
||||||
Labels map[string]string `json:"labels"`
|
Labels map[string]string `json:"labels"`
|
||||||
// CgroupParent contains the pod's CGroup parent
|
// CgroupParent contains the pod's Cgroup parent
|
||||||
CgroupParent string `json:"cgroupParent"`
|
CgroupParent string `json:"cgroupParent"`
|
||||||
// UsePodCgroup indicates whether the pod will create its own CGroup and
|
// UsePodCgroup indicates whether the pod will create its own Cgroup and
|
||||||
// join containers to it.
|
// join containers to it.
|
||||||
// If true, all containers joined to the pod will use the pod cgroup as
|
// If true, all containers joined to the pod will use the pod cgroup as
|
||||||
// their cgroup parent, and cannot set a different cgroup parent
|
// their cgroup parent, and cannot set a different cgroup parent
|
||||||
@ -77,7 +77,7 @@ type PodConfig struct {
|
|||||||
|
|
||||||
// podState represents a pod's state
|
// podState represents a pod's state
|
||||||
type podState struct {
|
type podState struct {
|
||||||
// CgroupPath is the path to the pod's CGroup
|
// CgroupPath is the path to the pod's Cgroup
|
||||||
CgroupPath string `json:"cgroupPath"`
|
CgroupPath string `json:"cgroupPath"`
|
||||||
// InfraContainerID is the container that holds pod namespace information
|
// InfraContainerID is the container that holds pod namespace information
|
||||||
// Most often an infra container
|
// Most often an infra container
|
||||||
@ -237,7 +237,7 @@ func (p *Pod) CreateCommand() []string {
|
|||||||
return p.config.CreateCommand
|
return p.config.CreateCommand
|
||||||
}
|
}
|
||||||
|
|
||||||
// CgroupParent returns the pod's CGroup parent
|
// CgroupParent returns the pod's Cgroup parent
|
||||||
func (p *Pod) CgroupParent() string {
|
func (p *Pod) CgroupParent() string {
|
||||||
return p.config.CgroupParent
|
return p.config.CgroupParent
|
||||||
}
|
}
|
||||||
@ -289,7 +289,7 @@ func (p *Pod) Hostname() string {
|
|||||||
return p.config.Hostname
|
return p.config.Hostname
|
||||||
}
|
}
|
||||||
|
|
||||||
// CgroupPath returns the path to the pod's CGroup
|
// CgroupPath returns the path to the pod's Cgroup
|
||||||
func (p *Pod) CgroupPath() (string, error) {
|
func (p *Pod) CgroupPath() (string, error) {
|
||||||
p.lock.Lock()
|
p.lock.Lock()
|
||||||
defer p.lock.Unlock()
|
defer p.lock.Unlock()
|
||||||
@ -315,7 +315,7 @@ func (p *Pod) CgroupPath() (string, error) {
|
|||||||
}
|
}
|
||||||
if ctr != nil {
|
if ctr != nil {
|
||||||
ctr.Start(context.Background(), true)
|
ctr.Start(context.Background(), true)
|
||||||
cgroupPath, err := ctr.CGroupPath()
|
cgroupPath, err := ctr.CgroupPath()
|
||||||
fmt.Println(cgroupPath)
|
fmt.Println(cgroupPath)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return "", errors.Wrapf(err, "could not get container cgroup")
|
return "", errors.Wrapf(err, "could not get container cgroup")
|
||||||
|
@ -71,7 +71,7 @@ func (p *Pod) refresh() error {
|
|||||||
case config.SystemdCgroupsManager:
|
case config.SystemdCgroupsManager:
|
||||||
cgroupPath, err := systemdSliceFromPath(p.config.CgroupParent, fmt.Sprintf("libpod_pod_%s", p.ID()))
|
cgroupPath, err := systemdSliceFromPath(p.config.CgroupParent, fmt.Sprintf("libpod_pod_%s", p.ID()))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
logrus.Errorf("Creating CGroup for pod %s: %v", p.ID(), err)
|
logrus.Errorf("Creating Cgroup for pod %s: %v", p.ID(), err)
|
||||||
}
|
}
|
||||||
p.state.CgroupPath = cgroupPath
|
p.state.CgroupPath = cgroupPath
|
||||||
case config.CgroupfsCgroupsManager:
|
case config.CgroupfsCgroupsManager:
|
||||||
|
@ -344,8 +344,8 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Check CGroup parent sanity, and set it if it was not set.
|
// Check Cgroup parent sanity, and set it if it was not set.
|
||||||
// Only if we're actually configuring CGroups.
|
// Only if we're actually configuring Cgroups.
|
||||||
if !ctr.config.NoCgroups {
|
if !ctr.config.NoCgroups {
|
||||||
ctr.config.CgroupManager = r.config.Engine.CgroupManager
|
ctr.config.CgroupManager = r.config.Engine.CgroupManager
|
||||||
switch r.config.Engine.CgroupManager {
|
switch r.config.Engine.CgroupManager {
|
||||||
@ -391,7 +391,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
|
|||||||
return nil, errors.Wrapf(define.ErrInvalidArg, "did not receive systemd slice as cgroup parent when using systemd to manage cgroups")
|
return nil, errors.Wrapf(define.ErrInvalidArg, "did not receive systemd slice as cgroup parent when using systemd to manage cgroups")
|
||||||
}
|
}
|
||||||
default:
|
default:
|
||||||
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
|
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported Cgroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -411,7 +411,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
|
|||||||
g.RemoveMount("/run/.containerenv")
|
g.RemoveMount("/run/.containerenv")
|
||||||
g.RemoveMount("/run/secrets")
|
g.RemoveMount("/run/secrets")
|
||||||
|
|
||||||
// Regenerate CGroup paths so they don't point to the old
|
// Regenerate Cgroup paths so they don't point to the old
|
||||||
// container ID.
|
// container ID.
|
||||||
cgroupPath, err := ctr.getOCICgroupPath()
|
cgroupPath, err := ctr.getOCICgroupPath()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
@ -61,7 +61,7 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
|
|||||||
|
|
||||||
pod.valid = true
|
pod.valid = true
|
||||||
|
|
||||||
// Check CGroup parent sanity, and set it if it was not set
|
// Check Cgroup parent sanity, and set it if it was not set
|
||||||
switch r.config.Engine.CgroupManager {
|
switch r.config.Engine.CgroupManager {
|
||||||
case config.CgroupfsCgroupsManager:
|
case config.CgroupfsCgroupsManager:
|
||||||
canUseCgroup := !rootless.IsRootless() || isRootlessCgroupSet(pod.config.CgroupParent)
|
canUseCgroup := !rootless.IsRootless() || isRootlessCgroupSet(pod.config.CgroupParent)
|
||||||
@ -105,7 +105,7 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
default:
|
default:
|
||||||
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
|
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported Cgroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
|
||||||
}
|
}
|
||||||
|
|
||||||
if pod.config.UsePodCgroup {
|
if pod.config.UsePodCgroup {
|
||||||
@ -226,12 +226,12 @@ func (r *Runtime) removePod(ctx context.Context, p *Pod, removeCtrs, force bool,
|
|||||||
}
|
}
|
||||||
|
|
||||||
// We're going to be removing containers.
|
// We're going to be removing containers.
|
||||||
// If we are CGroupfs cgroup driver, to avoid races, we need to hit
|
// If we are Cgroupfs cgroup driver, to avoid races, we need to hit
|
||||||
// the pod and conmon CGroups with a PID limit to prevent them from
|
// the pod and conmon Cgroups with a PID limit to prevent them from
|
||||||
// spawning any further processes (particularly cleanup processes) which
|
// spawning any further processes (particularly cleanup processes) which
|
||||||
// would prevent removing the CGroups.
|
// would prevent removing the Cgroups.
|
||||||
if p.runtime.config.Engine.CgroupManager == config.CgroupfsCgroupsManager {
|
if p.runtime.config.Engine.CgroupManager == config.CgroupfsCgroupsManager {
|
||||||
// Get the conmon CGroup
|
// Get the conmon Cgroup
|
||||||
conmonCgroupPath := filepath.Join(p.state.CgroupPath, "conmon")
|
conmonCgroupPath := filepath.Join(p.state.CgroupPath, "conmon")
|
||||||
conmonCgroup, err := cgroups.Load(conmonCgroupPath)
|
conmonCgroup, err := cgroups.Load(conmonCgroupPath)
|
||||||
if err != nil && err != cgroups.ErrCgroupDeleted && err != cgroups.ErrCgroupV1Rootless {
|
if err != nil && err != cgroups.ErrCgroupDeleted && err != cgroups.ErrCgroupV1Rootless {
|
||||||
|
@ -43,7 +43,7 @@ func getDefaultSystemdCgroup() string {
|
|||||||
return SystemdDefaultCgroupParent
|
return SystemdDefaultCgroupParent
|
||||||
}
|
}
|
||||||
|
|
||||||
// makeSystemdCgroup creates a systemd CGroup at the given location.
|
// makeSystemdCgroup creates a systemd Cgroup at the given location.
|
||||||
func makeSystemdCgroup(path string) error {
|
func makeSystemdCgroup(path string) error {
|
||||||
controller, err := cgroups.NewSystemd(getDefaultSystemdCgroup())
|
controller, err := cgroups.NewSystemd(getDefaultSystemdCgroup())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
@ -109,7 +109,7 @@ streamLabel: // A label to flatten the scope
|
|||||||
return
|
return
|
||||||
}
|
}
|
||||||
// Cgroup stats
|
// Cgroup stats
|
||||||
cgroupPath, err := ctnr.CGroupPath()
|
cgroupPath, err := ctnr.CgroupPath()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
logrus.Errorf("Unable to get cgroup path of container: %v", err)
|
logrus.Errorf("Unable to get cgroup path of container: %v", err)
|
||||||
return
|
return
|
||||||
|
@ -124,7 +124,7 @@ func GetInfo(w http.ResponseWriter, r *http.Request) {
|
|||||||
BuildahVersion: infoData.Host.BuildahVersion,
|
BuildahVersion: infoData.Host.BuildahVersion,
|
||||||
CPURealtimePeriod: sysInfo.CPURealtimePeriod,
|
CPURealtimePeriod: sysInfo.CPURealtimePeriod,
|
||||||
CPURealtimeRuntime: sysInfo.CPURealtimeRuntime,
|
CPURealtimeRuntime: sysInfo.CPURealtimeRuntime,
|
||||||
CgroupVersion: strings.TrimPrefix(infoData.Host.CGroupsVersion, "v"),
|
CgroupVersion: strings.TrimPrefix(infoData.Host.CgroupsVersion, "v"),
|
||||||
Rootless: rootless.IsRootless(),
|
Rootless: rootless.IsRootless(),
|
||||||
SwapFree: infoData.Host.SwapFree,
|
SwapFree: infoData.Host.SwapFree,
|
||||||
SwapTotal: infoData.Host.SwapTotal,
|
SwapTotal: infoData.Host.SwapTotal,
|
||||||
|
@ -148,7 +148,7 @@ type PodTopOKBody struct {
|
|||||||
// swagger:model PodCreateConfig
|
// swagger:model PodCreateConfig
|
||||||
type PodCreateConfig struct {
|
type PodCreateConfig struct {
|
||||||
Name string `json:"name"`
|
Name string `json:"name"`
|
||||||
CGroupParent string `json:"cgroup-parent"`
|
CgroupParent string `json:"cgroup-parent"`
|
||||||
Hostname string `json:"hostname"`
|
Hostname string `json:"hostname"`
|
||||||
Infra bool `json:"infra"`
|
Infra bool `json:"infra"`
|
||||||
InfraCommand string `json:"infra-command"`
|
InfraCommand string `json:"infra-command"`
|
||||||
|
@ -33,7 +33,7 @@ type PodmanConfig struct {
|
|||||||
*config.Config
|
*config.Config
|
||||||
*pflag.FlagSet
|
*pflag.FlagSet
|
||||||
|
|
||||||
CGroupUsage string // rootless code determines Usage message
|
CgroupUsage string // rootless code determines Usage message
|
||||||
ConmonPath string // --conmon flag will set Engine.ConmonPath
|
ConmonPath string // --conmon flag will set Engine.ConmonPath
|
||||||
CPUProfile string // Hidden: Should CPU profile be taken
|
CPUProfile string // Hidden: Should CPU profile be taken
|
||||||
EngineMode EngineMode // ABI or Tunneling mode
|
EngineMode EngineMode // ABI or Tunneling mode
|
||||||
|
@ -118,7 +118,7 @@ type PodSpec struct {
|
|||||||
// The JSON tags below are made to match the respective field in ContainerCreateOptions for the purpose of mapping.
|
// The JSON tags below are made to match the respective field in ContainerCreateOptions for the purpose of mapping.
|
||||||
// swagger:model PodCreateOptions
|
// swagger:model PodCreateOptions
|
||||||
type PodCreateOptions struct {
|
type PodCreateOptions struct {
|
||||||
CGroupParent string `json:"cgroup_parent,omitempty"`
|
CgroupParent string `json:"cgroup_parent,omitempty"`
|
||||||
CreateCommand []string `json:"create_command,omitempty"`
|
CreateCommand []string `json:"create_command,omitempty"`
|
||||||
Devices []string `json:"devices,omitempty"`
|
Devices []string `json:"devices,omitempty"`
|
||||||
DeviceReadBPs []string `json:"device_read_bps,omitempty"`
|
DeviceReadBPs []string `json:"device_read_bps,omitempty"`
|
||||||
@ -159,8 +159,8 @@ type ContainerCreateOptions struct {
|
|||||||
CapAdd []string
|
CapAdd []string
|
||||||
CapDrop []string
|
CapDrop []string
|
||||||
CgroupNS string
|
CgroupNS string
|
||||||
CGroupsMode string
|
CgroupsMode string
|
||||||
CGroupParent string `json:"cgroup_parent,omitempty"`
|
CgroupParent string `json:"cgroup_parent,omitempty"`
|
||||||
CIDFile string
|
CIDFile string
|
||||||
ConmonPIDFile string `json:"container_conmon_pidfile,omitempty"`
|
ConmonPIDFile string `json:"container_conmon_pidfile,omitempty"`
|
||||||
CPUPeriod uint64
|
CPUPeriod uint64
|
||||||
@ -172,7 +172,7 @@ type ContainerCreateOptions struct {
|
|||||||
CPUSetCPUs string `json:"cpuset_cpus,omitempty"`
|
CPUSetCPUs string `json:"cpuset_cpus,omitempty"`
|
||||||
CPUSetMems string
|
CPUSetMems string
|
||||||
Devices []string `json:"devices,omitempty"`
|
Devices []string `json:"devices,omitempty"`
|
||||||
DeviceCGroupRule []string
|
DeviceCgroupRule []string
|
||||||
DeviceReadBPs []string `json:"device_read_bps,omitempty"`
|
DeviceReadBPs []string `json:"device_read_bps,omitempty"`
|
||||||
DeviceReadIOPs []string
|
DeviceReadIOPs []string
|
||||||
DeviceWriteBPs []string
|
DeviceWriteBPs []string
|
||||||
@ -345,7 +345,7 @@ func ToPodSpecGen(s specgen.PodSpecGenerator, p *PodCreateOptions) (*specgen.Pod
|
|||||||
}
|
}
|
||||||
|
|
||||||
// Cgroup
|
// Cgroup
|
||||||
s.CgroupParent = p.CGroupParent
|
s.CgroupParent = p.CgroupParent
|
||||||
|
|
||||||
// Resource config
|
// Resource config
|
||||||
cpuDat := p.CPULimits()
|
cpuDat := p.CPULimits()
|
||||||
|
@ -989,7 +989,7 @@ func (ic *ContainerEngine) ContainerRun(ctx context.Context, opts entities.Conta
|
|||||||
report := entities.ContainerRunReport{Id: ctr.ID()}
|
report := entities.ContainerRunReport{Id: ctr.ID()}
|
||||||
|
|
||||||
if logrus.GetLevel() == logrus.DebugLevel {
|
if logrus.GetLevel() == logrus.DebugLevel {
|
||||||
cgroupPath, err := ctr.CGroupPath()
|
cgroupPath, err := ctr.CgroupPath()
|
||||||
if err == nil {
|
if err == nil {
|
||||||
logrus.Debugf("container %q has CgroupParent %q", ctr.ID(), cgroupPath)
|
logrus.Debugf("container %q has CgroupParent %q", ctr.ID(), cgroupPath)
|
||||||
}
|
}
|
||||||
|
@ -152,7 +152,7 @@ func canMountSys(isRootless, isNewUserns bool, s *specgen.SpecGenerator) bool {
|
|||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
||||||
func getCGroupPermissons(unmask []string) string {
|
func getCgroupPermissons(unmask []string) string {
|
||||||
ro := "ro"
|
ro := "ro"
|
||||||
rw := "rw"
|
rw := "rw"
|
||||||
cgroup := "/sys/fs/cgroup"
|
cgroup := "/sys/fs/cgroup"
|
||||||
@ -176,7 +176,7 @@ func getCGroupPermissons(unmask []string) string {
|
|||||||
|
|
||||||
// SpecGenToOCI returns the base configuration for the container.
|
// SpecGenToOCI returns the base configuration for the container.
|
||||||
func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *libimage.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string, compatibleOptions *libpod.InfraInherit) (*spec.Spec, error) {
|
func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *libimage.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string, compatibleOptions *libpod.InfraInherit) (*spec.Spec, error) {
|
||||||
cgroupPerm := getCGroupPermissons(s.Unmask)
|
cgroupPerm := getCgroupPermissons(s.Unmask)
|
||||||
|
|
||||||
g, err := generate.New("linux")
|
g, err := generate.New("linux")
|
||||||
if err != nil {
|
if err != nil {
|
||||||
@ -357,7 +357,7 @@ func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runt
|
|||||||
// set the devices cgroup when not running in a user namespace
|
// set the devices cgroup when not running in a user namespace
|
||||||
if !inUserNS && !s.Privileged {
|
if !inUserNS && !s.Privileged {
|
||||||
g.AddLinuxResourcesDevice(false, "", nil, nil, "rwm")
|
g.AddLinuxResourcesDevice(false, "", nil, nil, "rwm")
|
||||||
for _, dev := range s.DeviceCGroupRule {
|
for _, dev := range s.DeviceCgroupRule {
|
||||||
g.AddLinuxResourcesDevice(true, dev.Type, dev.Major, dev.Minor, dev.Access)
|
g.AddLinuxResourcesDevice(true, dev.Type, dev.Major, dev.Minor, dev.Access)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -183,7 +183,7 @@ type PodStorageConfig struct {
|
|||||||
// PodCgroupConfig contains configuration options about a pod's cgroups.
|
// PodCgroupConfig contains configuration options about a pod's cgroups.
|
||||||
// This will be expanded in future updates to pods.
|
// This will be expanded in future updates to pods.
|
||||||
type PodCgroupConfig struct {
|
type PodCgroupConfig struct {
|
||||||
// CgroupParent is the parent for the CGroup that the pod will create.
|
// CgroupParent is the parent for the Cgroup that the pod will create.
|
||||||
// This pod cgroup will, in turn, be the default cgroup parent for all
|
// This pod cgroup will, in turn, be the default cgroup parent for all
|
||||||
// containers in the pod.
|
// containers in the pod.
|
||||||
// Optional.
|
// Optional.
|
||||||
|
@ -264,9 +264,9 @@ type ContainerStorageConfig struct {
|
|||||||
// Devices are devices that will be added to the container.
|
// Devices are devices that will be added to the container.
|
||||||
// Optional.
|
// Optional.
|
||||||
Devices []spec.LinuxDevice `json:"devices,omitempty"`
|
Devices []spec.LinuxDevice `json:"devices,omitempty"`
|
||||||
// DeviceCGroupRule are device cgroup rules that allow containers
|
// DeviceCgroupRule are device cgroup rules that allow containers
|
||||||
// to use additional types of devices.
|
// to use additional types of devices.
|
||||||
DeviceCGroupRule []spec.LinuxDeviceCgroup `json:"device_cgroup_rule,omitempty"`
|
DeviceCgroupRule []spec.LinuxDeviceCgroup `json:"device_cgroup_rule,omitempty"`
|
||||||
// DevicesFrom is a way to ensure your container inherits device specific information from another container
|
// DevicesFrom is a way to ensure your container inherits device specific information from another container
|
||||||
DevicesFrom []string `json:"devices_from,omitempty"`
|
DevicesFrom []string `json:"devices_from,omitempty"`
|
||||||
// HostDeviceList is used to recreate the mounted device on inherited containers
|
// HostDeviceList is used to recreate the mounted device on inherited containers
|
||||||
@ -390,7 +390,7 @@ type ContainerCgroupConfig struct {
|
|||||||
// CgroupsMode sets a policy for how cgroups will be created in the
|
// CgroupsMode sets a policy for how cgroups will be created in the
|
||||||
// container, including the ability to disable creation entirely.
|
// container, including the ability to disable creation entirely.
|
||||||
CgroupsMode string `json:"cgroups_mode,omitempty"`
|
CgroupsMode string `json:"cgroups_mode,omitempty"`
|
||||||
// CgroupParent is the container's CGroup parent.
|
// CgroupParent is the container's Cgroup parent.
|
||||||
// If not set, the default for the current cgroup driver will be used.
|
// If not set, the default for the current cgroup driver will be used.
|
||||||
// Optional.
|
// Optional.
|
||||||
CgroupParent string `json:"cgroup_parent,omitempty"`
|
CgroupParent string `json:"cgroup_parent,omitempty"`
|
||||||
|
@ -488,8 +488,9 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
|
|||||||
if ld := c.LogDriver; len(ld) > 0 {
|
if ld := c.LogDriver; len(ld) > 0 {
|
||||||
s.LogConfiguration.Driver = ld
|
s.LogConfiguration.Driver = ld
|
||||||
}
|
}
|
||||||
s.CgroupParent = c.CGroupParent
|
s.CgroupParent = c.CgroupParent
|
||||||
s.CgroupsMode = c.CGroupsMode
|
s.CgroupsMode = c.CgroupsMode
|
||||||
|
|
||||||
s.Groups = c.GroupAdd
|
s.Groups = c.GroupAdd
|
||||||
|
|
||||||
s.Hostname = c.Hostname
|
s.Hostname = c.Hostname
|
||||||
@ -587,12 +588,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
|
|||||||
s.Devices = append(s.Devices, specs.LinuxDevice{Path: dev})
|
s.Devices = append(s.Devices, specs.LinuxDevice{Path: dev})
|
||||||
}
|
}
|
||||||
|
|
||||||
for _, rule := range c.DeviceCGroupRule {
|
for _, rule := range c.DeviceCgroupRule {
|
||||||
dev, err := parseLinuxResourcesDeviceAccess(rule)
|
dev, err := parseLinuxResourcesDeviceAccess(rule)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
s.DeviceCGroupRule = append(s.DeviceCGroupRule, dev)
|
s.DeviceCgroupRule = append(s.DeviceCgroupRule, dev)
|
||||||
}
|
}
|
||||||
|
|
||||||
s.Init = c.Init
|
s.Init = c.Init
|
||||||
|
@ -83,7 +83,7 @@ var _ = Describe("Podman run", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman Capabilities in containers.conf", func() {
|
It("podman Capabilities in containers.conf", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
cap := podmanTest.Podman([]string{"run", ALPINE, "grep", "CapEff", "/proc/self/status"})
|
cap := podmanTest.Podman([]string{"run", ALPINE, "grep", "CapEff", "/proc/self/status"})
|
||||||
cap.WaitWithDefaultTimeout()
|
cap.WaitWithDefaultTimeout()
|
||||||
Expect(cap).Should(Exit(0))
|
Expect(cap).Should(Exit(0))
|
||||||
@ -123,7 +123,7 @@ var _ = Describe("Podman run", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
verifyNSHandling := func(nspath, option string) {
|
verifyNSHandling := func(nspath, option string) {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
os.Setenv("CONTAINERS_CONF", "config/containers-ns.conf")
|
os.Setenv("CONTAINERS_CONF", "config/containers-ns.conf")
|
||||||
if IsRemote() {
|
if IsRemote() {
|
||||||
podmanTest.RestartRemoteService()
|
podmanTest.RestartRemoteService()
|
||||||
|
@ -94,7 +94,7 @@ var _ = Describe("Podman cp", func() {
|
|||||||
|
|
||||||
// Copy a file to the container, then back to the host in --pid=host
|
// Copy a file to the container, then back to the host in --pid=host
|
||||||
It("podman cp --pid=host file", func() {
|
It("podman cp --pid=host file", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
srcFile, err := ioutil.TempFile("", "")
|
srcFile, err := ioutil.TempFile("", "")
|
||||||
Expect(err).To(BeNil())
|
Expect(err).To(BeNil())
|
||||||
defer srcFile.Close()
|
defer srcFile.Close()
|
||||||
|
@ -225,7 +225,7 @@ var _ = Describe("Podman pod create", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman pod container can override pod pid NS", func() {
|
It("podman pod container can override pod pid NS", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
session := podmanTest.Podman([]string{"pod", "create", "--share", "pid"})
|
session := podmanTest.Podman([]string{"pod", "create", "--share", "pid"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
|
@ -128,7 +128,7 @@ var _ = Describe("Podman pod kill", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman pod kill all", func() {
|
It("podman pod kill all", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
_, ec, podid := podmanTest.CreatePod(nil)
|
_, ec, podid := podmanTest.CreatePod(nil)
|
||||||
Expect(ec).To(Equal(0))
|
Expect(ec).To(Equal(0))
|
||||||
|
|
||||||
|
@ -174,7 +174,7 @@ var _ = Describe("Podman ps", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman pod ps --ctr-names", func() {
|
It("podman pod ps --ctr-names", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
_, ec, podid := podmanTest.CreatePod(nil)
|
_, ec, podid := podmanTest.CreatePod(nil)
|
||||||
Expect(ec).To(Equal(0))
|
Expect(ec).To(Equal(0))
|
||||||
|
|
||||||
|
@ -36,7 +36,7 @@ var _ = Describe("Podman run ns", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman run pidns test", func() {
|
It("podman run pidns test", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
session := podmanTest.Podman([]string{"run", fedoraMinimal, "bash", "-c", "echo $$"})
|
session := podmanTest.Podman([]string{"run", fedoraMinimal, "bash", "-c", "echo $$"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
@ -115,7 +115,7 @@ var _ = Describe("Podman run ns", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman run --ipc=host --pid=host", func() {
|
It("podman run --ipc=host --pid=host", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
cmd := exec.Command("ls", "-l", "/proc/self/ns/pid")
|
cmd := exec.Command("ls", "-l", "/proc/self/ns/pid")
|
||||||
res, err := cmd.Output()
|
res, err := cmd.Output()
|
||||||
Expect(err).To(BeNil())
|
Expect(err).To(BeNil())
|
||||||
|
@ -260,7 +260,7 @@ var _ = Describe("Podman run", func() {
|
|||||||
})
|
})
|
||||||
|
|
||||||
It("podman test --pid=host", func() {
|
It("podman test --pid=host", func() {
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
session := podmanTest.Podman([]string{"run", "--pid=host", ALPINE, "cat", "/proc/self/attr/current"})
|
session := podmanTest.Podman([]string{"run", "--pid=host", ALPINE, "cat", "/proc/self/attr/current"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
|
@ -386,31 +386,31 @@ var _ = Describe("Podman run", func() {
|
|||||||
|
|
||||||
SkipIfCgroupV1("podman umask on /sys/fs/cgroup will fail with cgroups V1")
|
SkipIfCgroupV1("podman umask on /sys/fs/cgroup will fail with cgroups V1")
|
||||||
SkipIfRootless("/sys/fs/cgroup rw access is needed")
|
SkipIfRootless("/sys/fs/cgroup rw access is needed")
|
||||||
rwOnCGroups := "/sys/fs/cgroup cgroup2 rw"
|
rwOnCgroups := "/sys/fs/cgroup cgroup2 rw"
|
||||||
session := podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
|
session := podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
|
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
|
||||||
|
|
||||||
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
|
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
|
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
|
||||||
|
|
||||||
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup///", ALPINE, "cat", "/proc/mounts"})
|
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup///", ALPINE, "cat", "/proc/mounts"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
|
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
|
||||||
|
|
||||||
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", ALPINE, "cat", "/proc/mounts"})
|
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", ALPINE, "cat", "/proc/mounts"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
|
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
|
||||||
|
|
||||||
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
|
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
Expect(session).Should(Exit(0))
|
Expect(session).Should(Exit(0))
|
||||||
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
|
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
|
||||||
|
|
||||||
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "ls", "/sys/fs/cgroup"})
|
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "ls", "/sys/fs/cgroup"})
|
||||||
session.WaitWithDefaultTimeout()
|
session.WaitWithDefaultTimeout()
|
||||||
|
@ -118,7 +118,7 @@ var _ = Describe("Toolbox-specific testing", func() {
|
|||||||
if podmanTest.RemoteTest {
|
if podmanTest.RemoteTest {
|
||||||
Skip("Shm size check does not work with a remote client")
|
Skip("Shm size check does not work with a remote client")
|
||||||
}
|
}
|
||||||
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
|
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
|
||||||
var session *PodmanSessionIntegration
|
var session *PodmanSessionIntegration
|
||||||
var cmd *exec.Cmd
|
var cmd *exec.Cmd
|
||||||
var hostShmSize, containerShmSize int
|
var hostShmSize, containerShmSize int
|
||||||
|
Reference in New Issue
Block a user