Standardize on capatalized Cgroups

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2022-01-13 14:51:06 -05:00
parent ec2b213ab6
commit a15dfb3648
41 changed files with 98 additions and 97 deletions

View File

@ -97,7 +97,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
cgroupsFlagName := "cgroups" cgroupsFlagName := "cgroups"
createFlags.StringVar( createFlags.StringVar(
&cf.CGroupsMode, &cf.CgroupsMode,
cgroupsFlagName, cgroupConfig(), cgroupsFlagName, cgroupConfig(),
`control container cgroup configuration ("enabled"|"disabled"|"no-conmon"|"split")`, `control container cgroup configuration ("enabled"|"disabled"|"no-conmon"|"split")`,
) )
@ -159,7 +159,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
deviceCgroupRuleFlagName := "device-cgroup-rule" deviceCgroupRuleFlagName := "device-cgroup-rule"
createFlags.StringSliceVar( createFlags.StringSliceVar(
&cf.DeviceCGroupRule, &cf.DeviceCgroupRule,
deviceCgroupRuleFlagName, []string{}, deviceCgroupRuleFlagName, []string{},
"Add a rule to the cgroup allowed devices list", "Add a rule to the cgroup allowed devices list",
) )
@ -762,7 +762,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
cgroupParentFlagName := "cgroup-parent" cgroupParentFlagName := "cgroup-parent"
createFlags.StringVar( createFlags.StringVar(
&cf.CGroupParent, &cf.CgroupParent,
cgroupParentFlagName, "", cgroupParentFlagName, "",
"Optional parent cgroup for the container", "Optional parent cgroup for the container",
) )

View File

@ -246,7 +246,7 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
Authfile: "", Authfile: "",
CapAdd: append(capAdd, cc.HostConfig.CapAdd...), CapAdd: append(capAdd, cc.HostConfig.CapAdd...),
CapDrop: append(cappDrop, cc.HostConfig.CapDrop...), CapDrop: append(cappDrop, cc.HostConfig.CapDrop...),
CGroupParent: cc.HostConfig.CgroupParent, CgroupParent: cc.HostConfig.CgroupParent,
CIDFile: cc.HostConfig.ContainerIDFile, CIDFile: cc.HostConfig.ContainerIDFile,
CPUPeriod: uint64(cc.HostConfig.CPUPeriod), CPUPeriod: uint64(cc.HostConfig.CPUPeriod),
CPUQuota: cc.HostConfig.CPUQuota, CPUQuota: cc.HostConfig.CPUQuota,
@ -259,7 +259,7 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
// Detach: false, // don't need // Detach: false, // don't need
// DetachKeys: "", // don't need // DetachKeys: "", // don't need
Devices: devices, Devices: devices,
DeviceCGroupRule: nil, DeviceCgroupRule: nil,
DeviceReadBPs: readBps, DeviceReadBPs: readBps,
DeviceReadIOPs: readIops, DeviceReadIOPs: readIops,
DeviceWriteBPs: writeBps, DeviceWriteBPs: writeBps,

View File

@ -257,8 +257,8 @@ func CreateInit(c *cobra.Command, vals entities.ContainerCreateOptions, isInfra
} }
vals.Env = env vals.Env = env
} }
if c.Flag("cgroups").Changed && vals.CGroupsMode == "split" && registry.IsRemote() { if c.Flag("cgroups").Changed && vals.CgroupsMode == "split" && registry.IsRemote() {
return vals, errors.Errorf("the option --cgroups=%q is not supported in remote mode", vals.CGroupsMode) return vals, errors.Errorf("the option --cgroups=%q is not supported in remote mode", vals.CgroupsMode)
} }
if c.Flag("pod").Changed && !strings.HasPrefix(c.Flag("pod").Value.String(), "new:") && c.Flag("userns").Changed { if c.Flag("pod").Changed && !strings.HasPrefix(c.Flag("pod").Value.String(), "new:") && c.Flag("userns").Changed {

View File

@ -215,7 +215,7 @@ func (s *BoltState) Refresh() error {
return errors.Wrapf(err, "error unmarshalling state for pod %s", string(id)) return errors.Wrapf(err, "error unmarshalling state for pod %s", string(id))
} }
// Clear the CGroup path // Clear the Cgroup path
state.CgroupPath = "" state.CgroupPath = ""
newStateBytes, err := json.Marshal(state) newStateBytes, err := json.Marshal(state)

View File

@ -23,7 +23,7 @@ import (
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
) )
// CgroupfsDefaultCgroupParent is the cgroup parent for CGroupFS in libpod // CgroupfsDefaultCgroupParent is the cgroup parent for CgroupFS in libpod
const CgroupfsDefaultCgroupParent = "/libpod_parent" const CgroupfsDefaultCgroupParent = "/libpod_parent"
// SystemdDefaultCgroupParent is the cgroup parent for the systemd cgroup // SystemdDefaultCgroupParent is the cgroup parent for the systemd cgroup
@ -56,7 +56,7 @@ const (
UserNS LinuxNS = iota UserNS LinuxNS = iota
// UTSNS is the UTS namespace // UTSNS is the UTS namespace
UTSNS LinuxNS = iota UTSNS LinuxNS = iota
// CgroupNS is the CGroup namespace // CgroupNS is the Cgroup namespace
CgroupNS LinuxNS = iota CgroupNS LinuxNS = iota
) )
@ -575,7 +575,7 @@ func (c *Container) CreatedTime() time.Time {
return c.config.CreatedTime return c.config.CreatedTime
} }
// CgroupParent gets the container's CGroup parent // CgroupParent gets the container's Cgroup parent
func (c *Container) CgroupParent() string { func (c *Container) CgroupParent() string {
return c.config.CgroupParent return c.config.CgroupParent
} }
@ -907,10 +907,10 @@ func (c *Container) CgroupManager() string {
return cgroupManager return cgroupManager
} }
// CGroupPath returns a cgroups "path" for the given container. // CgroupPath returns a cgroups "path" for the given container.
// Note that the container must be running. Otherwise, an error // Note that the container must be running. Otherwise, an error
// is returned. // is returned.
func (c *Container) CGroupPath() (string, error) { func (c *Container) CgroupPath() (string, error) {
if !c.batched { if !c.batched {
c.lock.Lock() c.lock.Lock()
defer c.lock.Unlock() defer c.lock.Unlock()

View File

@ -334,7 +334,7 @@ type ContainerMiscConfig struct {
// CgroupManager is the cgroup manager used to create this container. // CgroupManager is the cgroup manager used to create this container.
// If empty, the runtime default will be used. // If empty, the runtime default will be used.
CgroupManager string `json:"cgroupManager,omitempty"` CgroupManager string `json:"cgroupManager,omitempty"`
// NoCgroups indicates that the container will not create CGroups. It is // NoCgroups indicates that the container will not create Cgroups. It is
// incompatible with CgroupParent. Deprecated in favor of CgroupsMode. // incompatible with CgroupParent. Deprecated in favor of CgroupsMode.
NoCgroups bool `json:"noCgroups,omitempty"` NoCgroups bool `json:"noCgroups,omitempty"`
// CgroupsMode indicates how the container will create cgroups // CgroupsMode indicates how the container will create cgroups

View File

@ -730,7 +730,7 @@ func (c *Container) generateInspectContainerHostConfig(ctrSpec *spec.Spec, named
} }
hostConfig.CgroupMode = cgroupMode hostConfig.CgroupMode = cgroupMode
// CGroup parent // Cgroup parent
// Need to check if it's the default, and not print if so. // Need to check if it's the default, and not print if so.
defaultCgroupParent := "" defaultCgroupParent := ""
switch c.CgroupManager() { switch c.CgroupManager() {

View File

@ -1092,7 +1092,7 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error {
// upstream in any OCI runtime. // upstream in any OCI runtime.
// TODO: Remove once runc supports cgroupsv2 // TODO: Remove once runc supports cgroupsv2
if strings.Contains(err.Error(), "this version of runc doesn't work on cgroups v2") { if strings.Contains(err.Error(), "this version of runc doesn't work on cgroups v2") {
logrus.Errorf("Oci runtime %q does not support CGroups V2: use system migrate to mitigate", c.ociRuntime.Name()) logrus.Errorf("Oci runtime %q does not support Cgroups V2: use system migrate to mitigate", c.ociRuntime.Name())
} }
return err return err
} }
@ -1291,8 +1291,8 @@ func (c *Container) stop(timeout uint) error {
// a pid namespace then the OCI Runtime needs to kill ALL processes in // a pid namespace then the OCI Runtime needs to kill ALL processes in
// the containers cgroup in order to make sure the container is stopped. // the containers cgroup in order to make sure the container is stopped.
all := !c.hasNamespace(spec.PIDNamespace) all := !c.hasNamespace(spec.PIDNamespace)
// We can't use --all if CGroups aren't present. // We can't use --all if Cgroups aren't present.
// Rootless containers with CGroups v1 and NoCgroups are both cases // Rootless containers with Cgroups v1 and NoCgroups are both cases
// where this can happen. // where this can happen.
if all { if all {
if c.config.NoCgroups { if c.config.NoCgroups {
@ -1400,7 +1400,7 @@ func (c *Container) stop(timeout uint) error {
// Internal, non-locking function to pause a container // Internal, non-locking function to pause a container
func (c *Container) pause() error { func (c *Container) pause() error {
if c.config.NoCgroups { if c.config.NoCgroups {
return errors.Wrapf(define.ErrNoCgroups, "cannot pause without using CGroups") return errors.Wrapf(define.ErrNoCgroups, "cannot pause without using Cgroups")
} }
if rootless.IsRootless() { if rootless.IsRootless() {
@ -1428,7 +1428,7 @@ func (c *Container) pause() error {
// Internal, non-locking function to unpause a container // Internal, non-locking function to unpause a container
func (c *Container) unpause() error { func (c *Container) unpause() error {
if c.config.NoCgroups { if c.config.NoCgroups {
return errors.Wrapf(define.ErrNoCgroups, "cannot unpause without using CGroups") return errors.Wrapf(define.ErrNoCgroups, "cannot unpause without using Cgroups")
} }
if err := c.ociRuntime.UnpauseContainer(c); err != nil { if err := c.ociRuntime.UnpauseContainer(c); err != nil {

View File

@ -2772,7 +2772,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
// expects cgroups to be passed as follows: // expects cgroups to be passed as follows:
// slice:prefix:name // slice:prefix:name
systemdCgroups := fmt.Sprintf("%s:libpod:%s", path.Base(c.config.CgroupParent), c.ID()) systemdCgroups := fmt.Sprintf("%s:libpod:%s", path.Base(c.config.CgroupParent), c.ID())
logrus.Debugf("Setting CGroups for container %s to %s", c.ID(), systemdCgroups) logrus.Debugf("Setting Cgroups for container %s to %s", c.ID(), systemdCgroups)
return systemdCgroups, nil return systemdCgroups, nil
case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)): case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)):
if c.config.CgroupParent == "" || !isRootlessCgroupSet(c.config.CgroupParent) { if c.config.CgroupParent == "" || !isRootlessCgroupSet(c.config.CgroupParent) {
@ -2781,7 +2781,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
fallthrough fallthrough
case cgroupManager == config.CgroupfsCgroupsManager: case cgroupManager == config.CgroupfsCgroupsManager:
cgroupPath := filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-%s", c.ID())) cgroupPath := filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-%s", c.ID()))
logrus.Debugf("Setting CGroup path for container %s to %s", c.ID(), cgroupPath) logrus.Debugf("Setting Cgroup path for container %s to %s", c.ID(), cgroupPath)
return cgroupPath, nil return cgroupPath, nil
default: default:
return "", errors.Wrapf(define.ErrInvalidArg, "invalid cgroup manager %s requested", cgroupManager) return "", errors.Wrapf(define.ErrInvalidArg, "invalid cgroup manager %s requested", cgroupManager)

View File

@ -57,13 +57,13 @@ func (c *Container) validate() error {
if ns.Type == spec.PIDNamespace { if ns.Type == spec.PIDNamespace {
foundPid = true foundPid = true
if ns.Path != "" { if ns.Path != "" {
return errors.Wrapf(define.ErrInvalidArg, "containers not creating CGroups must create a private PID namespace - cannot use another") return errors.Wrapf(define.ErrInvalidArg, "containers not creating Cgroups must create a private PID namespace - cannot use another")
} }
break break
} }
} }
if !foundPid { if !foundPid {
return errors.Wrapf(define.ErrInvalidArg, "containers not creating CGroups must create a private PID namespace") return errors.Wrapf(define.ErrInvalidArg, "containers not creating Cgroups must create a private PID namespace")
} }
} }

View File

@ -345,9 +345,9 @@ type InspectContainerHostConfig struct {
// populated. // populated.
// TODO. // TODO.
Cgroup string `json:"Cgroup"` Cgroup string `json:"Cgroup"`
// Cgroups contains the container's CGroup mode. // Cgroups contains the container's Cgroup mode.
// Allowed values are "default" (container is creating CGroups) and // Allowed values are "default" (container is creating Cgroups) and
// "disabled" (container is not creating CGroups). // "disabled" (container is not creating Cgroups).
// This is Libpod-specific and not included in `docker inspect`. // This is Libpod-specific and not included in `docker inspect`.
Cgroups string `json:"Cgroups"` Cgroups string `json:"Cgroups"`
// Links is unused, and provided purely for Docker compatibility. // Links is unused, and provided purely for Docker compatibility.
@ -417,7 +417,7 @@ type InspectContainerHostConfig struct {
Isolation string `json:"Isolation"` Isolation string `json:"Isolation"`
// CpuShares indicates the CPU resources allocated to the container. // CpuShares indicates the CPU resources allocated to the container.
// It is a relative weight in the scheduler for assigning CPU time // It is a relative weight in the scheduler for assigning CPU time
// versus other CGroups. // versus other Cgroups.
CpuShares uint64 `json:"CpuShares"` CpuShares uint64 `json:"CpuShares"`
// Memory indicates the memory resources allocated to the container. // Memory indicates the memory resources allocated to the container.
// This is the limit (in bytes) of RAM the container may use. // This is the limit (in bytes) of RAM the container may use.
@ -434,12 +434,12 @@ type InspectContainerHostConfig struct {
// 100000, we will set both CpuQuota, CpuPeriod, and NanoCpus. If // 100000, we will set both CpuQuota, CpuPeriod, and NanoCpus. If
// CpuQuota is not the default, we will not set NanoCpus. // CpuQuota is not the default, we will not set NanoCpus.
NanoCpus int64 `json:"NanoCpus"` NanoCpus int64 `json:"NanoCpus"`
// CgroupParent is the CGroup parent of the container. // CgroupParent is the Cgroup parent of the container.
// Only set if not default. // Only set if not default.
CgroupParent string `json:"CgroupParent"` CgroupParent string `json:"CgroupParent"`
// BlkioWeight indicates the I/O resources allocated to the container. // BlkioWeight indicates the I/O resources allocated to the container.
// It is a relative weight in the scheduler for assigning I/O time // It is a relative weight in the scheduler for assigning I/O time
// versus other CGroups. // versus other Cgroups.
BlkioWeight uint16 `json:"BlkioWeight"` BlkioWeight uint16 `json:"BlkioWeight"`
// BlkioWeightDevice is an array of I/O resource priorities for // BlkioWeightDevice is an array of I/O resource priorities for
// individual device nodes. // individual device nodes.

View File

@ -96,7 +96,7 @@ var (
ErrWillDeadlock = errors.New("deadlock due to lock mismatch") ErrWillDeadlock = errors.New("deadlock due to lock mismatch")
// ErrNoCgroups indicates that the container does not have its own // ErrNoCgroups indicates that the container does not have its own
// CGroup. // Cgroup.
ErrNoCgroups = errors.New("this container does not have a cgroup") ErrNoCgroups = errors.New("this container does not have a cgroup")
// ErrNoLogs indicates that this container is not creating a log so log // ErrNoLogs indicates that this container is not creating a log so log
// operations cannot be performed on it // operations cannot be performed on it

View File

@ -27,7 +27,7 @@ type HostInfo struct {
Arch string `json:"arch"` Arch string `json:"arch"`
BuildahVersion string `json:"buildahVersion"` BuildahVersion string `json:"buildahVersion"`
CgroupManager string `json:"cgroupManager"` CgroupManager string `json:"cgroupManager"`
CGroupsVersion string `json:"cgroupVersion"` CgroupsVersion string `json:"cgroupVersion"`
CgroupControllers []string `json:"cgroupControllers"` CgroupControllers []string `json:"cgroupControllers"`
Conmon *ConmonInfo `json:"conmon"` Conmon *ConmonInfo `json:"conmon"`
CPUs int `json:"cpus"` CPUs int `json:"cpus"`

View File

@ -26,12 +26,12 @@ type InspectPodData struct {
// Labels is a set of key-value labels that have been applied to the // Labels is a set of key-value labels that have been applied to the
// pod. // pod.
Labels map[string]string `json:"Labels,omitempty"` Labels map[string]string `json:"Labels,omitempty"`
// CreateCgroup is whether this pod will create its own CGroup to group // CreateCgroup is whether this pod will create its own Cgroup to group
// containers under. // containers under.
CreateCgroup bool CreateCgroup bool
// CgroupParent is the parent of the pod's CGroup. // CgroupParent is the parent of the pod's Cgroup.
CgroupParent string `json:"CgroupParent,omitempty"` CgroupParent string `json:"CgroupParent,omitempty"`
// CgroupPath is the path to the pod's CGroup. // CgroupPath is the path to the pod's Cgroup.
CgroupPath string `json:"CgroupPath,omitempty"` CgroupPath string `json:"CgroupPath,omitempty"`
// CreateInfra is whether this pod will create an infra container to // CreateInfra is whether this pod will create an infra container to
// share namespaces. // share namespaces.

View File

@ -104,7 +104,7 @@ func (r *Runtime) hostInfo() (*define.HostInfo, error) {
return nil, errors.Wrapf(err, "error getting Seccomp profile path") return nil, errors.Wrapf(err, "error getting Seccomp profile path")
} }
// CGroups version // Cgroups version
unified, err := cgroups.IsCgroup2UnifiedMode() unified, err := cgroups.IsCgroup2UnifiedMode()
if err != nil { if err != nil {
return nil, errors.Wrapf(err, "error reading cgroups mode") return nil, errors.Wrapf(err, "error reading cgroups mode")
@ -150,7 +150,7 @@ func (r *Runtime) hostInfo() (*define.HostInfo, error) {
if unified { if unified {
cgroupVersion = "v2" cgroupVersion = "v2"
} }
info.CGroupsVersion = cgroupVersion info.CgroupsVersion = cgroupVersion
slirp4netnsPath := r.config.Engine.NetworkCmdPath slirp4netnsPath := r.config.Engine.NetworkCmdPath
if slirp4netnsPath == "" { if slirp4netnsPath == "" {

View File

@ -1402,7 +1402,7 @@ func (r *ConmonOCIRuntime) sharedConmonArgs(ctr *Container, cuuid, bundlePath, p
args = append(args, "--log-tag", logTag) args = append(args, "--log-tag", logTag)
} }
if ctr.config.NoCgroups { if ctr.config.NoCgroups {
logrus.Debugf("Running with no CGroups") logrus.Debugf("Running with no Cgroups")
args = append(args, "--runtime-arg", "--cgroup-manager", "--runtime-arg", "disabled") args = append(args, "--runtime-arg", "--cgroup-manager", "--runtime-arg", "disabled")
} }
return args return args

View File

@ -217,7 +217,7 @@ func WithCgroupManager(manager string) RuntimeOption {
} }
if manager != config.CgroupfsCgroupsManager && manager != config.SystemdCgroupsManager { if manager != config.CgroupfsCgroupsManager && manager != config.SystemdCgroupsManager {
return errors.Wrapf(define.ErrInvalidArg, "CGroup manager must be one of %s and %s", return errors.Wrapf(define.ErrInvalidArg, "Cgroup manager must be one of %s and %s",
config.CgroupfsCgroupsManager, config.SystemdCgroupsManager) config.CgroupfsCgroupsManager, config.SystemdCgroupsManager)
} }
@ -945,7 +945,7 @@ func WithUTSNSFrom(nsCtr *Container) CtrCreateOption {
} }
} }
// WithCgroupNSFrom indicates the the container should join the CGroup namespace // WithCgroupNSFrom indicates the the container should join the Cgroup namespace
// of the given container. // of the given container.
// If the container has joined a pod, it can only join the namespaces of // If the container has joined a pod, it can only join the namespaces of
// containers in the same pod. // containers in the same pod.
@ -1080,7 +1080,7 @@ func WithLogTag(tag string) CtrCreateOption {
} }
} }
// WithCgroupsMode disables the creation of CGroups for the conmon process. // WithCgroupsMode disables the creation of Cgroups for the conmon process.
func WithCgroupsMode(mode string) CtrCreateOption { func WithCgroupsMode(mode string) CtrCreateOption {
return func(ctr *Container) error { return func(ctr *Container) error {
if ctr.valid { if ctr.valid {
@ -1864,7 +1864,7 @@ func WithPodCgroupParent(path string) PodCreateOption {
// WithPodCgroups tells containers in this pod to use the cgroup created for // WithPodCgroups tells containers in this pod to use the cgroup created for
// this pod. // this pod.
// This can still be overridden at the container level by explicitly specifying // This can still be overridden at the container level by explicitly specifying
// a CGroup parent. // a Cgroup parent.
func WithPodCgroups() PodCreateOption { func WithPodCgroups() PodCreateOption {
return func(pod *Pod) error { return func(pod *Pod) error {
if pod.valid { if pod.valid {

View File

@ -44,9 +44,9 @@ type PodConfig struct {
// Labels contains labels applied to the pod // Labels contains labels applied to the pod
Labels map[string]string `json:"labels"` Labels map[string]string `json:"labels"`
// CgroupParent contains the pod's CGroup parent // CgroupParent contains the pod's Cgroup parent
CgroupParent string `json:"cgroupParent"` CgroupParent string `json:"cgroupParent"`
// UsePodCgroup indicates whether the pod will create its own CGroup and // UsePodCgroup indicates whether the pod will create its own Cgroup and
// join containers to it. // join containers to it.
// If true, all containers joined to the pod will use the pod cgroup as // If true, all containers joined to the pod will use the pod cgroup as
// their cgroup parent, and cannot set a different cgroup parent // their cgroup parent, and cannot set a different cgroup parent
@ -77,7 +77,7 @@ type PodConfig struct {
// podState represents a pod's state // podState represents a pod's state
type podState struct { type podState struct {
// CgroupPath is the path to the pod's CGroup // CgroupPath is the path to the pod's Cgroup
CgroupPath string `json:"cgroupPath"` CgroupPath string `json:"cgroupPath"`
// InfraContainerID is the container that holds pod namespace information // InfraContainerID is the container that holds pod namespace information
// Most often an infra container // Most often an infra container
@ -237,7 +237,7 @@ func (p *Pod) CreateCommand() []string {
return p.config.CreateCommand return p.config.CreateCommand
} }
// CgroupParent returns the pod's CGroup parent // CgroupParent returns the pod's Cgroup parent
func (p *Pod) CgroupParent() string { func (p *Pod) CgroupParent() string {
return p.config.CgroupParent return p.config.CgroupParent
} }
@ -289,7 +289,7 @@ func (p *Pod) Hostname() string {
return p.config.Hostname return p.config.Hostname
} }
// CgroupPath returns the path to the pod's CGroup // CgroupPath returns the path to the pod's Cgroup
func (p *Pod) CgroupPath() (string, error) { func (p *Pod) CgroupPath() (string, error) {
p.lock.Lock() p.lock.Lock()
defer p.lock.Unlock() defer p.lock.Unlock()
@ -315,7 +315,7 @@ func (p *Pod) CgroupPath() (string, error) {
} }
if ctr != nil { if ctr != nil {
ctr.Start(context.Background(), true) ctr.Start(context.Background(), true)
cgroupPath, err := ctr.CGroupPath() cgroupPath, err := ctr.CgroupPath()
fmt.Println(cgroupPath) fmt.Println(cgroupPath)
if err != nil { if err != nil {
return "", errors.Wrapf(err, "could not get container cgroup") return "", errors.Wrapf(err, "could not get container cgroup")

View File

@ -71,7 +71,7 @@ func (p *Pod) refresh() error {
case config.SystemdCgroupsManager: case config.SystemdCgroupsManager:
cgroupPath, err := systemdSliceFromPath(p.config.CgroupParent, fmt.Sprintf("libpod_pod_%s", p.ID())) cgroupPath, err := systemdSliceFromPath(p.config.CgroupParent, fmt.Sprintf("libpod_pod_%s", p.ID()))
if err != nil { if err != nil {
logrus.Errorf("Creating CGroup for pod %s: %v", p.ID(), err) logrus.Errorf("Creating Cgroup for pod %s: %v", p.ID(), err)
} }
p.state.CgroupPath = cgroupPath p.state.CgroupPath = cgroupPath
case config.CgroupfsCgroupsManager: case config.CgroupfsCgroupsManager:

View File

@ -344,8 +344,8 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
} }
} }
// Check CGroup parent sanity, and set it if it was not set. // Check Cgroup parent sanity, and set it if it was not set.
// Only if we're actually configuring CGroups. // Only if we're actually configuring Cgroups.
if !ctr.config.NoCgroups { if !ctr.config.NoCgroups {
ctr.config.CgroupManager = r.config.Engine.CgroupManager ctr.config.CgroupManager = r.config.Engine.CgroupManager
switch r.config.Engine.CgroupManager { switch r.config.Engine.CgroupManager {
@ -391,7 +391,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
return nil, errors.Wrapf(define.ErrInvalidArg, "did not receive systemd slice as cgroup parent when using systemd to manage cgroups") return nil, errors.Wrapf(define.ErrInvalidArg, "did not receive systemd slice as cgroup parent when using systemd to manage cgroups")
} }
default: default:
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager) return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported Cgroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
} }
} }
@ -411,7 +411,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
g.RemoveMount("/run/.containerenv") g.RemoveMount("/run/.containerenv")
g.RemoveMount("/run/secrets") g.RemoveMount("/run/secrets")
// Regenerate CGroup paths so they don't point to the old // Regenerate Cgroup paths so they don't point to the old
// container ID. // container ID.
cgroupPath, err := ctr.getOCICgroupPath() cgroupPath, err := ctr.getOCICgroupPath()
if err != nil { if err != nil {

View File

@ -61,7 +61,7 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
pod.valid = true pod.valid = true
// Check CGroup parent sanity, and set it if it was not set // Check Cgroup parent sanity, and set it if it was not set
switch r.config.Engine.CgroupManager { switch r.config.Engine.CgroupManager {
case config.CgroupfsCgroupsManager: case config.CgroupfsCgroupsManager:
canUseCgroup := !rootless.IsRootless() || isRootlessCgroupSet(pod.config.CgroupParent) canUseCgroup := !rootless.IsRootless() || isRootlessCgroupSet(pod.config.CgroupParent)
@ -105,7 +105,7 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
} }
} }
default: default:
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager) return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported Cgroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
} }
if pod.config.UsePodCgroup { if pod.config.UsePodCgroup {
@ -226,12 +226,12 @@ func (r *Runtime) removePod(ctx context.Context, p *Pod, removeCtrs, force bool,
} }
// We're going to be removing containers. // We're going to be removing containers.
// If we are CGroupfs cgroup driver, to avoid races, we need to hit // If we are Cgroupfs cgroup driver, to avoid races, we need to hit
// the pod and conmon CGroups with a PID limit to prevent them from // the pod and conmon Cgroups with a PID limit to prevent them from
// spawning any further processes (particularly cleanup processes) which // spawning any further processes (particularly cleanup processes) which
// would prevent removing the CGroups. // would prevent removing the Cgroups.
if p.runtime.config.Engine.CgroupManager == config.CgroupfsCgroupsManager { if p.runtime.config.Engine.CgroupManager == config.CgroupfsCgroupsManager {
// Get the conmon CGroup // Get the conmon Cgroup
conmonCgroupPath := filepath.Join(p.state.CgroupPath, "conmon") conmonCgroupPath := filepath.Join(p.state.CgroupPath, "conmon")
conmonCgroup, err := cgroups.Load(conmonCgroupPath) conmonCgroup, err := cgroups.Load(conmonCgroupPath)
if err != nil && err != cgroups.ErrCgroupDeleted && err != cgroups.ErrCgroupV1Rootless { if err != nil && err != cgroups.ErrCgroupDeleted && err != cgroups.ErrCgroupV1Rootless {

View File

@ -43,7 +43,7 @@ func getDefaultSystemdCgroup() string {
return SystemdDefaultCgroupParent return SystemdDefaultCgroupParent
} }
// makeSystemdCgroup creates a systemd CGroup at the given location. // makeSystemdCgroup creates a systemd Cgroup at the given location.
func makeSystemdCgroup(path string) error { func makeSystemdCgroup(path string) error {
controller, err := cgroups.NewSystemd(getDefaultSystemdCgroup()) controller, err := cgroups.NewSystemd(getDefaultSystemdCgroup())
if err != nil { if err != nil {

View File

@ -109,7 +109,7 @@ streamLabel: // A label to flatten the scope
return return
} }
// Cgroup stats // Cgroup stats
cgroupPath, err := ctnr.CGroupPath() cgroupPath, err := ctnr.CgroupPath()
if err != nil { if err != nil {
logrus.Errorf("Unable to get cgroup path of container: %v", err) logrus.Errorf("Unable to get cgroup path of container: %v", err)
return return

View File

@ -124,7 +124,7 @@ func GetInfo(w http.ResponseWriter, r *http.Request) {
BuildahVersion: infoData.Host.BuildahVersion, BuildahVersion: infoData.Host.BuildahVersion,
CPURealtimePeriod: sysInfo.CPURealtimePeriod, CPURealtimePeriod: sysInfo.CPURealtimePeriod,
CPURealtimeRuntime: sysInfo.CPURealtimeRuntime, CPURealtimeRuntime: sysInfo.CPURealtimeRuntime,
CgroupVersion: strings.TrimPrefix(infoData.Host.CGroupsVersion, "v"), CgroupVersion: strings.TrimPrefix(infoData.Host.CgroupsVersion, "v"),
Rootless: rootless.IsRootless(), Rootless: rootless.IsRootless(),
SwapFree: infoData.Host.SwapFree, SwapFree: infoData.Host.SwapFree,
SwapTotal: infoData.Host.SwapTotal, SwapTotal: infoData.Host.SwapTotal,

View File

@ -148,7 +148,7 @@ type PodTopOKBody struct {
// swagger:model PodCreateConfig // swagger:model PodCreateConfig
type PodCreateConfig struct { type PodCreateConfig struct {
Name string `json:"name"` Name string `json:"name"`
CGroupParent string `json:"cgroup-parent"` CgroupParent string `json:"cgroup-parent"`
Hostname string `json:"hostname"` Hostname string `json:"hostname"`
Infra bool `json:"infra"` Infra bool `json:"infra"`
InfraCommand string `json:"infra-command"` InfraCommand string `json:"infra-command"`

View File

@ -33,7 +33,7 @@ type PodmanConfig struct {
*config.Config *config.Config
*pflag.FlagSet *pflag.FlagSet
CGroupUsage string // rootless code determines Usage message CgroupUsage string // rootless code determines Usage message
ConmonPath string // --conmon flag will set Engine.ConmonPath ConmonPath string // --conmon flag will set Engine.ConmonPath
CPUProfile string // Hidden: Should CPU profile be taken CPUProfile string // Hidden: Should CPU profile be taken
EngineMode EngineMode // ABI or Tunneling mode EngineMode EngineMode // ABI or Tunneling mode

View File

@ -118,7 +118,7 @@ type PodSpec struct {
// The JSON tags below are made to match the respective field in ContainerCreateOptions for the purpose of mapping. // The JSON tags below are made to match the respective field in ContainerCreateOptions for the purpose of mapping.
// swagger:model PodCreateOptions // swagger:model PodCreateOptions
type PodCreateOptions struct { type PodCreateOptions struct {
CGroupParent string `json:"cgroup_parent,omitempty"` CgroupParent string `json:"cgroup_parent,omitempty"`
CreateCommand []string `json:"create_command,omitempty"` CreateCommand []string `json:"create_command,omitempty"`
Devices []string `json:"devices,omitempty"` Devices []string `json:"devices,omitempty"`
DeviceReadBPs []string `json:"device_read_bps,omitempty"` DeviceReadBPs []string `json:"device_read_bps,omitempty"`
@ -159,8 +159,8 @@ type ContainerCreateOptions struct {
CapAdd []string CapAdd []string
CapDrop []string CapDrop []string
CgroupNS string CgroupNS string
CGroupsMode string CgroupsMode string
CGroupParent string `json:"cgroup_parent,omitempty"` CgroupParent string `json:"cgroup_parent,omitempty"`
CIDFile string CIDFile string
ConmonPIDFile string `json:"container_conmon_pidfile,omitempty"` ConmonPIDFile string `json:"container_conmon_pidfile,omitempty"`
CPUPeriod uint64 CPUPeriod uint64
@ -172,7 +172,7 @@ type ContainerCreateOptions struct {
CPUSetCPUs string `json:"cpuset_cpus,omitempty"` CPUSetCPUs string `json:"cpuset_cpus,omitempty"`
CPUSetMems string CPUSetMems string
Devices []string `json:"devices,omitempty"` Devices []string `json:"devices,omitempty"`
DeviceCGroupRule []string DeviceCgroupRule []string
DeviceReadBPs []string `json:"device_read_bps,omitempty"` DeviceReadBPs []string `json:"device_read_bps,omitempty"`
DeviceReadIOPs []string DeviceReadIOPs []string
DeviceWriteBPs []string DeviceWriteBPs []string
@ -345,7 +345,7 @@ func ToPodSpecGen(s specgen.PodSpecGenerator, p *PodCreateOptions) (*specgen.Pod
} }
// Cgroup // Cgroup
s.CgroupParent = p.CGroupParent s.CgroupParent = p.CgroupParent
// Resource config // Resource config
cpuDat := p.CPULimits() cpuDat := p.CPULimits()

View File

@ -989,7 +989,7 @@ func (ic *ContainerEngine) ContainerRun(ctx context.Context, opts entities.Conta
report := entities.ContainerRunReport{Id: ctr.ID()} report := entities.ContainerRunReport{Id: ctr.ID()}
if logrus.GetLevel() == logrus.DebugLevel { if logrus.GetLevel() == logrus.DebugLevel {
cgroupPath, err := ctr.CGroupPath() cgroupPath, err := ctr.CgroupPath()
if err == nil { if err == nil {
logrus.Debugf("container %q has CgroupParent %q", ctr.ID(), cgroupPath) logrus.Debugf("container %q has CgroupParent %q", ctr.ID(), cgroupPath)
} }

View File

@ -152,7 +152,7 @@ func canMountSys(isRootless, isNewUserns bool, s *specgen.SpecGenerator) bool {
return true return true
} }
func getCGroupPermissons(unmask []string) string { func getCgroupPermissons(unmask []string) string {
ro := "ro" ro := "ro"
rw := "rw" rw := "rw"
cgroup := "/sys/fs/cgroup" cgroup := "/sys/fs/cgroup"
@ -176,7 +176,7 @@ func getCGroupPermissons(unmask []string) string {
// SpecGenToOCI returns the base configuration for the container. // SpecGenToOCI returns the base configuration for the container.
func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *libimage.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string, compatibleOptions *libpod.InfraInherit) (*spec.Spec, error) { func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *libimage.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string, compatibleOptions *libpod.InfraInherit) (*spec.Spec, error) {
cgroupPerm := getCGroupPermissons(s.Unmask) cgroupPerm := getCgroupPermissons(s.Unmask)
g, err := generate.New("linux") g, err := generate.New("linux")
if err != nil { if err != nil {
@ -357,7 +357,7 @@ func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runt
// set the devices cgroup when not running in a user namespace // set the devices cgroup when not running in a user namespace
if !inUserNS && !s.Privileged { if !inUserNS && !s.Privileged {
g.AddLinuxResourcesDevice(false, "", nil, nil, "rwm") g.AddLinuxResourcesDevice(false, "", nil, nil, "rwm")
for _, dev := range s.DeviceCGroupRule { for _, dev := range s.DeviceCgroupRule {
g.AddLinuxResourcesDevice(true, dev.Type, dev.Major, dev.Minor, dev.Access) g.AddLinuxResourcesDevice(true, dev.Type, dev.Major, dev.Minor, dev.Access)
} }
} }

View File

@ -183,7 +183,7 @@ type PodStorageConfig struct {
// PodCgroupConfig contains configuration options about a pod's cgroups. // PodCgroupConfig contains configuration options about a pod's cgroups.
// This will be expanded in future updates to pods. // This will be expanded in future updates to pods.
type PodCgroupConfig struct { type PodCgroupConfig struct {
// CgroupParent is the parent for the CGroup that the pod will create. // CgroupParent is the parent for the Cgroup that the pod will create.
// This pod cgroup will, in turn, be the default cgroup parent for all // This pod cgroup will, in turn, be the default cgroup parent for all
// containers in the pod. // containers in the pod.
// Optional. // Optional.

View File

@ -264,9 +264,9 @@ type ContainerStorageConfig struct {
// Devices are devices that will be added to the container. // Devices are devices that will be added to the container.
// Optional. // Optional.
Devices []spec.LinuxDevice `json:"devices,omitempty"` Devices []spec.LinuxDevice `json:"devices,omitempty"`
// DeviceCGroupRule are device cgroup rules that allow containers // DeviceCgroupRule are device cgroup rules that allow containers
// to use additional types of devices. // to use additional types of devices.
DeviceCGroupRule []spec.LinuxDeviceCgroup `json:"device_cgroup_rule,omitempty"` DeviceCgroupRule []spec.LinuxDeviceCgroup `json:"device_cgroup_rule,omitempty"`
// DevicesFrom is a way to ensure your container inherits device specific information from another container // DevicesFrom is a way to ensure your container inherits device specific information from another container
DevicesFrom []string `json:"devices_from,omitempty"` DevicesFrom []string `json:"devices_from,omitempty"`
// HostDeviceList is used to recreate the mounted device on inherited containers // HostDeviceList is used to recreate the mounted device on inherited containers
@ -390,7 +390,7 @@ type ContainerCgroupConfig struct {
// CgroupsMode sets a policy for how cgroups will be created in the // CgroupsMode sets a policy for how cgroups will be created in the
// container, including the ability to disable creation entirely. // container, including the ability to disable creation entirely.
CgroupsMode string `json:"cgroups_mode,omitempty"` CgroupsMode string `json:"cgroups_mode,omitempty"`
// CgroupParent is the container's CGroup parent. // CgroupParent is the container's Cgroup parent.
// If not set, the default for the current cgroup driver will be used. // If not set, the default for the current cgroup driver will be used.
// Optional. // Optional.
CgroupParent string `json:"cgroup_parent,omitempty"` CgroupParent string `json:"cgroup_parent,omitempty"`

View File

@ -488,8 +488,9 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
if ld := c.LogDriver; len(ld) > 0 { if ld := c.LogDriver; len(ld) > 0 {
s.LogConfiguration.Driver = ld s.LogConfiguration.Driver = ld
} }
s.CgroupParent = c.CGroupParent s.CgroupParent = c.CgroupParent
s.CgroupsMode = c.CGroupsMode s.CgroupsMode = c.CgroupsMode
s.Groups = c.GroupAdd s.Groups = c.GroupAdd
s.Hostname = c.Hostname s.Hostname = c.Hostname
@ -587,12 +588,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
s.Devices = append(s.Devices, specs.LinuxDevice{Path: dev}) s.Devices = append(s.Devices, specs.LinuxDevice{Path: dev})
} }
for _, rule := range c.DeviceCGroupRule { for _, rule := range c.DeviceCgroupRule {
dev, err := parseLinuxResourcesDeviceAccess(rule) dev, err := parseLinuxResourcesDeviceAccess(rule)
if err != nil { if err != nil {
return err return err
} }
s.DeviceCGroupRule = append(s.DeviceCGroupRule, dev) s.DeviceCgroupRule = append(s.DeviceCgroupRule, dev)
} }
s.Init = c.Init s.Init = c.Init

View File

@ -83,7 +83,7 @@ var _ = Describe("Podman run", func() {
}) })
It("podman Capabilities in containers.conf", func() { It("podman Capabilities in containers.conf", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
cap := podmanTest.Podman([]string{"run", ALPINE, "grep", "CapEff", "/proc/self/status"}) cap := podmanTest.Podman([]string{"run", ALPINE, "grep", "CapEff", "/proc/self/status"})
cap.WaitWithDefaultTimeout() cap.WaitWithDefaultTimeout()
Expect(cap).Should(Exit(0)) Expect(cap).Should(Exit(0))
@ -123,7 +123,7 @@ var _ = Describe("Podman run", func() {
}) })
verifyNSHandling := func(nspath, option string) { verifyNSHandling := func(nspath, option string) {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
os.Setenv("CONTAINERS_CONF", "config/containers-ns.conf") os.Setenv("CONTAINERS_CONF", "config/containers-ns.conf")
if IsRemote() { if IsRemote() {
podmanTest.RestartRemoteService() podmanTest.RestartRemoteService()

View File

@ -94,7 +94,7 @@ var _ = Describe("Podman cp", func() {
// Copy a file to the container, then back to the host in --pid=host // Copy a file to the container, then back to the host in --pid=host
It("podman cp --pid=host file", func() { It("podman cp --pid=host file", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
srcFile, err := ioutil.TempFile("", "") srcFile, err := ioutil.TempFile("", "")
Expect(err).To(BeNil()) Expect(err).To(BeNil())
defer srcFile.Close() defer srcFile.Close()

View File

@ -225,7 +225,7 @@ var _ = Describe("Podman pod create", func() {
}) })
It("podman pod container can override pod pid NS", func() { It("podman pod container can override pod pid NS", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
session := podmanTest.Podman([]string{"pod", "create", "--share", "pid"}) session := podmanTest.Podman([]string{"pod", "create", "--share", "pid"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))

View File

@ -128,7 +128,7 @@ var _ = Describe("Podman pod kill", func() {
}) })
It("podman pod kill all", func() { It("podman pod kill all", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
_, ec, podid := podmanTest.CreatePod(nil) _, ec, podid := podmanTest.CreatePod(nil)
Expect(ec).To(Equal(0)) Expect(ec).To(Equal(0))

View File

@ -174,7 +174,7 @@ var _ = Describe("Podman ps", func() {
}) })
It("podman pod ps --ctr-names", func() { It("podman pod ps --ctr-names", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
_, ec, podid := podmanTest.CreatePod(nil) _, ec, podid := podmanTest.CreatePod(nil)
Expect(ec).To(Equal(0)) Expect(ec).To(Equal(0))

View File

@ -36,7 +36,7 @@ var _ = Describe("Podman run ns", func() {
}) })
It("podman run pidns test", func() { It("podman run pidns test", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
session := podmanTest.Podman([]string{"run", fedoraMinimal, "bash", "-c", "echo $$"}) session := podmanTest.Podman([]string{"run", fedoraMinimal, "bash", "-c", "echo $$"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))
@ -115,7 +115,7 @@ var _ = Describe("Podman run ns", func() {
}) })
It("podman run --ipc=host --pid=host", func() { It("podman run --ipc=host --pid=host", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
cmd := exec.Command("ls", "-l", "/proc/self/ns/pid") cmd := exec.Command("ls", "-l", "/proc/self/ns/pid")
res, err := cmd.Output() res, err := cmd.Output()
Expect(err).To(BeNil()) Expect(err).To(BeNil())

View File

@ -260,7 +260,7 @@ var _ = Describe("Podman run", func() {
}) })
It("podman test --pid=host", func() { It("podman test --pid=host", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
session := podmanTest.Podman([]string{"run", "--pid=host", ALPINE, "cat", "/proc/self/attr/current"}) session := podmanTest.Podman([]string{"run", "--pid=host", ALPINE, "cat", "/proc/self/attr/current"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))

View File

@ -386,31 +386,31 @@ var _ = Describe("Podman run", func() {
SkipIfCgroupV1("podman umask on /sys/fs/cgroup will fail with cgroups V1") SkipIfCgroupV1("podman umask on /sys/fs/cgroup will fail with cgroups V1")
SkipIfRootless("/sys/fs/cgroup rw access is needed") SkipIfRootless("/sys/fs/cgroup rw access is needed")
rwOnCGroups := "/sys/fs/cgroup cgroup2 rw" rwOnCgroups := "/sys/fs/cgroup cgroup2 rw"
session := podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"}) session := podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups)) Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"}) session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups)) Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup///", ALPINE, "cat", "/proc/mounts"}) session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup///", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups)) Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", ALPINE, "cat", "/proc/mounts"}) session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups)) Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"}) session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0)) Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups)) Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "ls", "/sys/fs/cgroup"}) session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "ls", "/sys/fs/cgroup"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()

View File

@ -118,7 +118,7 @@ var _ = Describe("Toolbox-specific testing", func() {
if podmanTest.RemoteTest { if podmanTest.RemoteTest {
Skip("Shm size check does not work with a remote client") Skip("Shm size check does not work with a remote client")
} }
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1") SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
var session *PodmanSessionIntegration var session *PodmanSessionIntegration
var cmd *exec.Cmd var cmd *exec.Cmd
var hostShmSize, containerShmSize int var hostShmSize, containerShmSize int