opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-19 16:33:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Standardize on capatalized Cgroups

Browse Source 
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2022-01-13 14:51:06 -05:00
parent ec2b213ab6
commit a15dfb3648
41 changed files with 98 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cmd/podman/common/create.go
View File

@ -97,7 +97,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
cgroupsFlagName := "cgroups"
createFlags.StringVar(
&cf.CGroupsMode,
&cf.CgroupsMode,
cgroupsFlagName, cgroupConfig(),
`control container cgroup configuration ("enabled"|"disabled"|"no-conmon"|"split")`,
)
@ -159,7 +159,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
deviceCgroupRuleFlagName := "device-cgroup-rule"
createFlags.StringSliceVar(
&cf.DeviceCGroupRule,
&cf.DeviceCgroupRule,
deviceCgroupRuleFlagName, []string{},
"Add a rule to the cgroup allowed devices list",
)
@ -762,7 +762,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
cgroupParentFlagName := "cgroup-parent"
createFlags.StringVar(
&cf.CGroupParent,
&cf.CgroupParent,
cgroupParentFlagName, "",
"Optional parent cgroup for the container",
)

4
cmd/podman/common/create_opts.go
View File

@ -246,7 +246,7 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
Authfile: "",
CapAdd: append(capAdd, cc.HostConfig.CapAdd...),
CapDrop: append(cappDrop, cc.HostConfig.CapDrop...),
CGroupParent: cc.HostConfig.CgroupParent,
CgroupParent: cc.HostConfig.CgroupParent,
CIDFile: cc.HostConfig.ContainerIDFile,
CPUPeriod: uint64(cc.HostConfig.CPUPeriod),
CPUQuota: cc.HostConfig.CPUQuota,
@ -259,7 +259,7 @@ func ContainerCreateToContainerCLIOpts(cc handlers.CreateContainerConfig, rtc *c
// Detach: false, // don't need
// DetachKeys: "", // don't need
Devices: devices,
DeviceCGroupRule: nil,
DeviceCgroupRule: nil,
DeviceReadBPs: readBps,
DeviceReadIOPs: readIops,
DeviceWriteBPs: writeBps,

4
cmd/podman/containers/create.go
View File

@ -257,8 +257,8 @@ func CreateInit(c *cobra.Command, vals entities.ContainerCreateOptions, isInfra
}
vals.Env = env
}
if c.Flag("cgroups").Changed && vals.CGroupsMode == "split" && registry.IsRemote() {
return vals, errors.Errorf("the option --cgroups=%q is not supported in remote mode", vals.CGroupsMode)
if c.Flag("cgroups").Changed && vals.CgroupsMode == "split" && registry.IsRemote() {
return vals, errors.Errorf("the option --cgroups=%q is not supported in remote mode", vals.CgroupsMode)
}
if c.Flag("pod").Changed && !strings.HasPrefix(c.Flag("pod").Value.String(), "new:") && c.Flag("userns").Changed {

2
libpod/boltdb_state.go
View File

@ -215,7 +215,7 @@ func (s *BoltState) Refresh() error {
return errors.Wrapf(err, "error unmarshalling state for pod %s", string(id))
}
// Clear the CGroup path
// Clear the Cgroup path
state.CgroupPath = ""
newStateBytes, err := json.Marshal(state)

10
libpod/container.go
View File

@ -23,7 +23,7 @@ import (
"github.com/sirupsen/logrus"
)
// CgroupfsDefaultCgroupParent is the cgroup parent for CGroupFS in libpod
// CgroupfsDefaultCgroupParent is the cgroup parent for CgroupFS in libpod
const CgroupfsDefaultCgroupParent = "/libpod_parent"
// SystemdDefaultCgroupParent is the cgroup parent for the systemd cgroup
@ -56,7 +56,7 @@ const (
UserNS LinuxNS = iota
// UTSNS is the UTS namespace
UTSNS LinuxNS = iota
// CgroupNS is the CGroup namespace
// CgroupNS is the Cgroup namespace
CgroupNS LinuxNS = iota
)
@ -575,7 +575,7 @@ func (c *Container) CreatedTime() time.Time {
return c.config.CreatedTime
}
// CgroupParent gets the container's CGroup parent
// CgroupParent gets the container's Cgroup parent
func (c *Container) CgroupParent() string {
return c.config.CgroupParent
}
@ -907,10 +907,10 @@ func (c *Container) CgroupManager() string {
return cgroupManager
}
// CGroupPath returns a cgroups "path" for the given container.
// CgroupPath returns a cgroups "path" for the given container.
// Note that the container must be running. Otherwise, an error
// is returned.
func (c *Container) CGroupPath() (string, error) {
func (c *Container) CgroupPath() (string, error) {
if !c.batched {
c.lock.Lock()
defer c.lock.Unlock()

2
libpod/container_config.go
View File

@ -334,7 +334,7 @@ type ContainerMiscConfig struct {
// CgroupManager is the cgroup manager used to create this container.
// If empty, the runtime default will be used.
CgroupManager string `json:"cgroupManager,omitempty"`
// NoCgroups indicates that the container will not create CGroups. It is
// NoCgroups indicates that the container will not create Cgroups. It is
// incompatible with CgroupParent. Deprecated in favor of CgroupsMode.
NoCgroups bool `json:"noCgroups,omitempty"`
// CgroupsMode indicates how the container will create cgroups

2
libpod/container_inspect.go
View File

@ -730,7 +730,7 @@ func (c *Container) generateInspectContainerHostConfig(ctrSpec *spec.Spec, named
}
hostConfig.CgroupMode = cgroupMode
// CGroup parent
// Cgroup parent
// Need to check if it's the default, and not print if so.
defaultCgroupParent := ""
switch c.CgroupManager() {

10
libpod/container_internal.go
View File

@ -1092,7 +1092,7 @@ func (c *Container) init(ctx context.Context, retainRetries bool) error {
// upstream in any OCI runtime.
// TODO: Remove once runc supports cgroupsv2
if strings.Contains(err.Error(), "this version of runc doesn't work on cgroups v2") {
logrus.Errorf("Oci runtime %q does not support CGroups V2: use system migrate to mitigate", c.ociRuntime.Name())
logrus.Errorf("Oci runtime %q does not support Cgroups V2: use system migrate to mitigate", c.ociRuntime.Name())
}
return err
}
@ -1291,8 +1291,8 @@ func (c *Container) stop(timeout uint) error {
// a pid namespace then the OCI Runtime needs to kill ALL processes in
// the containers cgroup in order to make sure the container is stopped.
all := !c.hasNamespace(spec.PIDNamespace)
// We can't use --all if CGroups aren't present.
// Rootless containers with CGroups v1 and NoCgroups are both cases
// We can't use --all if Cgroups aren't present.
// Rootless containers with Cgroups v1 and NoCgroups are both cases
// where this can happen.
if all {
if c.config.NoCgroups {
@ -1400,7 +1400,7 @@ func (c *Container) stop(timeout uint) error {
// Internal, non-locking function to pause a container
func (c *Container) pause() error {
if c.config.NoCgroups {
return errors.Wrapf(define.ErrNoCgroups, "cannot pause without using CGroups")
return errors.Wrapf(define.ErrNoCgroups, "cannot pause without using Cgroups")
}
if rootless.IsRootless() {
@ -1428,7 +1428,7 @@ func (c *Container) pause() error {
// Internal, non-locking function to unpause a container
func (c *Container) unpause() error {
if c.config.NoCgroups {
return errors.Wrapf(define.ErrNoCgroups, "cannot unpause without using CGroups")
return errors.Wrapf(define.ErrNoCgroups, "cannot unpause without using Cgroups")
}
if err := c.ociRuntime.UnpauseContainer(c); err != nil {

4
libpod/container_internal_linux.go
View File

@ -2772,7 +2772,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
// expects cgroups to be passed as follows:
// slice:prefix:name
systemdCgroups := fmt.Sprintf("%s:libpod:%s", path.Base(c.config.CgroupParent), c.ID())
logrus.Debugf("Setting CGroups for container %s to %s", c.ID(), systemdCgroups)
logrus.Debugf("Setting Cgroups for container %s to %s", c.ID(), systemdCgroups)
return systemdCgroups, nil
case (rootless.IsRootless() && (cgroupManager == config.CgroupfsCgroupsManager || !unified)):
if c.config.CgroupParent == "" || !isRootlessCgroupSet(c.config.CgroupParent) {
@ -2781,7 +2781,7 @@ func (c *Container) getOCICgroupPath() (string, error) {
fallthrough
case cgroupManager == config.CgroupfsCgroupsManager:
cgroupPath := filepath.Join(c.config.CgroupParent, fmt.Sprintf("libpod-%s", c.ID()))
logrus.Debugf("Setting CGroup path for container %s to %s", c.ID(), cgroupPath)
logrus.Debugf("Setting Cgroup path for container %s to %s", c.ID(), cgroupPath)
return cgroupPath, nil
default:
return "", errors.Wrapf(define.ErrInvalidArg, "invalid cgroup manager %s requested", cgroupManager)

4
libpod/container_validate.go
View File

@ -57,13 +57,13 @@ func (c *Container) validate() error {
if ns.Type == spec.PIDNamespace {
foundPid = true
if ns.Path != "" {
return errors.Wrapf(define.ErrInvalidArg, "containers not creating CGroups must create a private PID namespace - cannot use another")
return errors.Wrapf(define.ErrInvalidArg, "containers not creating Cgroups must create a private PID namespace - cannot use another")
}
break
}
}
if !foundPid {
return errors.Wrapf(define.ErrInvalidArg, "containers not creating CGroups must create a private PID namespace")
return errors.Wrapf(define.ErrInvalidArg, "containers not creating Cgroups must create a private PID namespace")
}
}

12
libpod/define/container_inspect.go
View File

@ -345,9 +345,9 @@ type InspectContainerHostConfig struct {
// populated.
// TODO.
Cgroup string `json:"Cgroup"`
// Cgroups contains the container's CGroup mode.
// Allowed values are "default" (container is creating CGroups) and
// "disabled" (container is not creating CGroups).
// Cgroups contains the container's Cgroup mode.
// Allowed values are "default" (container is creating Cgroups) and
// "disabled" (container is not creating Cgroups).
// This is Libpod-specific and not included in `docker inspect`.
Cgroups string `json:"Cgroups"`
// Links is unused, and provided purely for Docker compatibility.
@ -417,7 +417,7 @@ type InspectContainerHostConfig struct {
Isolation string `json:"Isolation"`
// CpuShares indicates the CPU resources allocated to the container.
// It is a relative weight in the scheduler for assigning CPU time
// versus other CGroups.
// versus other Cgroups.
CpuShares uint64 `json:"CpuShares"`
// Memory indicates the memory resources allocated to the container.
// This is the limit (in bytes) of RAM the container may use.
@ -434,12 +434,12 @@ type InspectContainerHostConfig struct {
// 100000, we will set both CpuQuota, CpuPeriod, and NanoCpus. If
// CpuQuota is not the default, we will not set NanoCpus.
NanoCpus int64 `json:"NanoCpus"`
// CgroupParent is the CGroup parent of the container.
// CgroupParent is the Cgroup parent of the container.
// Only set if not default.
CgroupParent string `json:"CgroupParent"`
// BlkioWeight indicates the I/O resources allocated to the container.
// It is a relative weight in the scheduler for assigning I/O time
// versus other CGroups.
// versus other Cgroups.
BlkioWeight uint16 `json:"BlkioWeight"`
// BlkioWeightDevice is an array of I/O resource priorities for
// individual device nodes.

2
libpod/define/errors.go
View File

@ -96,7 +96,7 @@ var (
ErrWillDeadlock = errors.New("deadlock due to lock mismatch")
// ErrNoCgroups indicates that the container does not have its own
// CGroup.
// Cgroup.
ErrNoCgroups = errors.New("this container does not have a cgroup")
// ErrNoLogs indicates that this container is not creating a log so log
// operations cannot be performed on it

2
libpod/define/info.go
View File

@ -27,7 +27,7 @@ type HostInfo struct {
Arch string `json:"arch"`
BuildahVersion string `json:"buildahVersion"`
CgroupManager string `json:"cgroupManager"`
CGroupsVersion string `json:"cgroupVersion"`
CgroupsVersion string `json:"cgroupVersion"`
CgroupControllers []string `json:"cgroupControllers"`
Conmon *ConmonInfo `json:"conmon"`
CPUs int `json:"cpus"`

6
libpod/define/pod_inspect.go
View File

@ -26,12 +26,12 @@ type InspectPodData struct {
// Labels is a set of key-value labels that have been applied to the
// pod.
Labels map[string]string `json:"Labels,omitempty"`
// CreateCgroup is whether this pod will create its own CGroup to group
// CreateCgroup is whether this pod will create its own Cgroup to group
// containers under.
CreateCgroup bool
// CgroupParent is the parent of the pod's CGroup.
// CgroupParent is the parent of the pod's Cgroup.
CgroupParent string `json:"CgroupParent,omitempty"`
// CgroupPath is the path to the pod's CGroup.
// CgroupPath is the path to the pod's Cgroup.
CgroupPath string `json:"CgroupPath,omitempty"`
// CreateInfra is whether this pod will create an infra container to
// share namespaces.

4
libpod/info.go
View File

@ -104,7 +104,7 @@ func (r *Runtime) hostInfo() (*define.HostInfo, error) {
return nil, errors.Wrapf(err, "error getting Seccomp profile path")
}
// CGroups version
// Cgroups version
unified, err := cgroups.IsCgroup2UnifiedMode()
if err != nil {
return nil, errors.Wrapf(err, "error reading cgroups mode")
@ -150,7 +150,7 @@ func (r *Runtime) hostInfo() (*define.HostInfo, error) {
if unified {
cgroupVersion = "v2"
}
info.CGroupsVersion = cgroupVersion
info.CgroupsVersion = cgroupVersion
slirp4netnsPath := r.config.Engine.NetworkCmdPath
if slirp4netnsPath == "" {

2
libpod/oci_conmon_linux.go
View File

@ -1402,7 +1402,7 @@ func (r *ConmonOCIRuntime) sharedConmonArgs(ctr *Container, cuuid, bundlePath, p
args = append(args, "--log-tag", logTag)
}
if ctr.config.NoCgroups {
logrus.Debugf("Running with no CGroups")
logrus.Debugf("Running with no Cgroups")
args = append(args, "--runtime-arg", "--cgroup-manager", "--runtime-arg", "disabled")
}
return args

8
libpod/options.go
View File

@ -217,7 +217,7 @@ func WithCgroupManager(manager string) RuntimeOption {
}
if manager != config.CgroupfsCgroupsManager && manager != config.SystemdCgroupsManager {
return errors.Wrapf(define.ErrInvalidArg, "CGroup manager must be one of %s and %s",
return errors.Wrapf(define.ErrInvalidArg, "Cgroup manager must be one of %s and %s",
config.CgroupfsCgroupsManager, config.SystemdCgroupsManager)
}
@ -945,7 +945,7 @@ func WithUTSNSFrom(nsCtr *Container) CtrCreateOption {
}
}
// WithCgroupNSFrom indicates the the container should join the CGroup namespace
// WithCgroupNSFrom indicates the the container should join the Cgroup namespace
// of the given container.
// If the container has joined a pod, it can only join the namespaces of
// containers in the same pod.
@ -1080,7 +1080,7 @@ func WithLogTag(tag string) CtrCreateOption {
}
}
// WithCgroupsMode disables the creation of CGroups for the conmon process.
// WithCgroupsMode disables the creation of Cgroups for the conmon process.
func WithCgroupsMode(mode string) CtrCreateOption {
return func(ctr *Container) error {
if ctr.valid {
@ -1864,7 +1864,7 @@ func WithPodCgroupParent(path string) PodCreateOption {
// WithPodCgroups tells containers in this pod to use the cgroup created for
// this pod.
// This can still be overridden at the container level by explicitly specifying
// a CGroup parent.
// a Cgroup parent.
func WithPodCgroups() PodCreateOption {
return func(pod *Pod) error {
if pod.valid {

12
libpod/pod.go
View File

@ -44,9 +44,9 @@ type PodConfig struct {
// Labels contains labels applied to the pod
Labels map[string]string `json:"labels"`
// CgroupParent contains the pod's CGroup parent
// CgroupParent contains the pod's Cgroup parent
CgroupParent string `json:"cgroupParent"`
// UsePodCgroup indicates whether the pod will create its own CGroup and
// UsePodCgroup indicates whether the pod will create its own Cgroup and
// join containers to it.
// If true, all containers joined to the pod will use the pod cgroup as
// their cgroup parent, and cannot set a different cgroup parent
@ -77,7 +77,7 @@ type PodConfig struct {
// podState represents a pod's state
type podState struct {
// CgroupPath is the path to the pod's CGroup
// CgroupPath is the path to the pod's Cgroup
CgroupPath string `json:"cgroupPath"`
// InfraContainerID is the container that holds pod namespace information
// Most often an infra container
@ -237,7 +237,7 @@ func (p *Pod) CreateCommand() []string {
return p.config.CreateCommand
}
// CgroupParent returns the pod's CGroup parent
// CgroupParent returns the pod's Cgroup parent
func (p *Pod) CgroupParent() string {
return p.config.CgroupParent
}
@ -289,7 +289,7 @@ func (p *Pod) Hostname() string {
return p.config.Hostname
}
// CgroupPath returns the path to the pod's CGroup
// CgroupPath returns the path to the pod's Cgroup
func (p *Pod) CgroupPath() (string, error) {
p.lock.Lock()
defer p.lock.Unlock()
@ -315,7 +315,7 @@ func (p *Pod) CgroupPath() (string, error) {
}
if ctr != nil {
ctr.Start(context.Background(), true)
cgroupPath, err := ctr.CGroupPath()
cgroupPath, err := ctr.CgroupPath()
fmt.Println(cgroupPath)
if err != nil {
return "", errors.Wrapf(err, "could not get container cgroup")

2
libpod/pod_internal.go
View File

@ -71,7 +71,7 @@ func (p *Pod) refresh() error {
case config.SystemdCgroupsManager:
cgroupPath, err := systemdSliceFromPath(p.config.CgroupParent, fmt.Sprintf("libpod_pod_%s", p.ID()))
if err != nil {
logrus.Errorf("Creating CGroup for pod %s: %v", p.ID(), err)
logrus.Errorf("Creating Cgroup for pod %s: %v", p.ID(), err)
}
p.state.CgroupPath = cgroupPath
case config.CgroupfsCgroupsManager:

8
libpod/runtime_ctr.go
View File

@ -344,8 +344,8 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
}
}
// Check CGroup parent sanity, and set it if it was not set.
// Only if we're actually configuring CGroups.
// Check Cgroup parent sanity, and set it if it was not set.
// Only if we're actually configuring Cgroups.
if !ctr.config.NoCgroups {
ctr.config.CgroupManager = r.config.Engine.CgroupManager
switch r.config.Engine.CgroupManager {
@ -391,7 +391,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
return nil, errors.Wrapf(define.ErrInvalidArg, "did not receive systemd slice as cgroup parent when using systemd to manage cgroups")
}
default:
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported Cgroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
}
}
@ -411,7 +411,7 @@ func (r *Runtime) setupContainer(ctx context.Context, ctr *Container) (_ *Contai
g.RemoveMount("/run/.containerenv")
g.RemoveMount("/run/secrets")
// Regenerate CGroup paths so they don't point to the old
// Regenerate Cgroup paths so they don't point to the old
// container ID.
cgroupPath, err := ctr.getOCICgroupPath()
if err != nil {

12
libpod/runtime_pod_linux.go
View File

@ -61,7 +61,7 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
pod.valid = true
// Check CGroup parent sanity, and set it if it was not set
// Check Cgroup parent sanity, and set it if it was not set
switch r.config.Engine.CgroupManager {
case config.CgroupfsCgroupsManager:
canUseCgroup := !rootless.IsRootless() || isRootlessCgroupSet(pod.config.CgroupParent)
@ -105,7 +105,7 @@ func (r *Runtime) NewPod(ctx context.Context, p specgen.PodSpecGenerator, option
}
}
default:
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported CGroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
return nil, errors.Wrapf(define.ErrInvalidArg, "unsupported Cgroup manager: %s - cannot validate cgroup parent", r.config.Engine.CgroupManager)
}
if pod.config.UsePodCgroup {
@ -226,12 +226,12 @@ func (r *Runtime) removePod(ctx context.Context, p *Pod, removeCtrs, force bool,
}
// We're going to be removing containers.
// If we are CGroupfs cgroup driver, to avoid races, we need to hit
// the pod and conmon CGroups with a PID limit to prevent them from
// If we are Cgroupfs cgroup driver, to avoid races, we need to hit
// the pod and conmon Cgroups with a PID limit to prevent them from
// spawning any further processes (particularly cleanup processes) which
// would prevent removing the CGroups.
// would prevent removing the Cgroups.
if p.runtime.config.Engine.CgroupManager == config.CgroupfsCgroupsManager {
// Get the conmon CGroup
// Get the conmon Cgroup
conmonCgroupPath := filepath.Join(p.state.CgroupPath, "conmon")
conmonCgroup, err := cgroups.Load(conmonCgroupPath)
if err != nil && err != cgroups.ErrCgroupDeleted && err != cgroups.ErrCgroupV1Rootless {

2
libpod/util_linux.go
View File

@ -43,7 +43,7 @@ func getDefaultSystemdCgroup() string {
return SystemdDefaultCgroupParent
}
// makeSystemdCgroup creates a systemd CGroup at the given location.
// makeSystemdCgroup creates a systemd Cgroup at the given location.
func makeSystemdCgroup(path string) error {
controller, err := cgroups.NewSystemd(getDefaultSystemdCgroup())
if err != nil {

2
pkg/api/handlers/compat/containers_stats.go
View File

@ -109,7 +109,7 @@ streamLabel: // A label to flatten the scope
return
}
// Cgroup stats
cgroupPath, err := ctnr.CGroupPath()
cgroupPath, err := ctnr.CgroupPath()
if err != nil {
logrus.Errorf("Unable to get cgroup path of container: %v", err)
return

2
pkg/api/handlers/compat/info.go
View File

@ -124,7 +124,7 @@ func GetInfo(w http.ResponseWriter, r *http.Request) {
BuildahVersion: infoData.Host.BuildahVersion,
CPURealtimePeriod: sysInfo.CPURealtimePeriod,
CPURealtimeRuntime: sysInfo.CPURealtimeRuntime,
CgroupVersion: strings.TrimPrefix(infoData.Host.CGroupsVersion, "v"),
CgroupVersion: strings.TrimPrefix(infoData.Host.CgroupsVersion, "v"),
Rootless: rootless.IsRootless(),
SwapFree: infoData.Host.SwapFree,
SwapTotal: infoData.Host.SwapTotal,

2
pkg/api/handlers/types.go
View File

@ -148,7 +148,7 @@ type PodTopOKBody struct {
// swagger:model PodCreateConfig
type PodCreateConfig struct {
Name string `json:"name"`
CGroupParent string `json:"cgroup-parent"`
CgroupParent string `json:"cgroup-parent"`
Hostname string `json:"hostname"`
Infra bool `json:"infra"`
InfraCommand string `json:"infra-command"`

2
pkg/domain/entities/engine.go
View File

@ -33,7 +33,7 @@ type PodmanConfig struct {
*config.Config
*pflag.FlagSet
CGroupUsage string // rootless code determines Usage message
CgroupUsage string // rootless code determines Usage message
ConmonPath string // --conmon flag will set Engine.ConmonPath
CPUProfile string // Hidden: Should CPU profile be taken
EngineMode EngineMode // ABI or Tunneling mode

10
pkg/domain/entities/pods.go
View File

@ -118,7 +118,7 @@ type PodSpec struct {
// The JSON tags below are made to match the respective field in ContainerCreateOptions for the purpose of mapping.
// swagger:model PodCreateOptions
type PodCreateOptions struct {
CGroupParent string `json:"cgroup_parent,omitempty"`
CgroupParent string `json:"cgroup_parent,omitempty"`
CreateCommand []string `json:"create_command,omitempty"`
Devices []string `json:"devices,omitempty"`
DeviceReadBPs []string `json:"device_read_bps,omitempty"`
@ -159,8 +159,8 @@ type ContainerCreateOptions struct {
CapAdd []string
CapDrop []string
CgroupNS string
CGroupsMode string
CGroupParent string `json:"cgroup_parent,omitempty"`
CgroupsMode string
CgroupParent string `json:"cgroup_parent,omitempty"`
CIDFile string
ConmonPIDFile string `json:"container_conmon_pidfile,omitempty"`
CPUPeriod uint64
@ -172,7 +172,7 @@ type ContainerCreateOptions struct {
CPUSetCPUs string `json:"cpuset_cpus,omitempty"`
CPUSetMems string
Devices []string `json:"devices,omitempty"`
DeviceCGroupRule []string
DeviceCgroupRule []string
DeviceReadBPs []string `json:"device_read_bps,omitempty"`
DeviceReadIOPs []string
DeviceWriteBPs []string
@ -345,7 +345,7 @@ func ToPodSpecGen(s specgen.PodSpecGenerator, p *PodCreateOptions) (*specgen.Pod
}
// Cgroup
s.CgroupParent = p.CGroupParent
s.CgroupParent = p.CgroupParent
// Resource config
cpuDat := p.CPULimits()

2
pkg/domain/infra/abi/containers.go
View File

@ -989,7 +989,7 @@ func (ic *ContainerEngine) ContainerRun(ctx context.Context, opts entities.Conta
report := entities.ContainerRunReport{Id: ctr.ID()}
if logrus.GetLevel() == logrus.DebugLevel {
cgroupPath, err := ctr.CGroupPath()
cgroupPath, err := ctr.CgroupPath()
if err == nil {
logrus.Debugf("container %q has CgroupParent %q", ctr.ID(), cgroupPath)
}

6
pkg/specgen/generate/oci.go
View File

@ -152,7 +152,7 @@ func canMountSys(isRootless, isNewUserns bool, s *specgen.SpecGenerator) bool {
return true
}
func getCGroupPermissons(unmask []string) string {
func getCgroupPermissons(unmask []string) string {
ro := "ro"
rw := "rw"
cgroup := "/sys/fs/cgroup"
@ -176,7 +176,7 @@ func getCGroupPermissons(unmask []string) string {
// SpecGenToOCI returns the base configuration for the container.
func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runtime, rtc *config.Config, newImage *libimage.Image, mounts []spec.Mount, pod *libpod.Pod, finalCmd []string, compatibleOptions *libpod.InfraInherit) (*spec.Spec, error) {
cgroupPerm := getCGroupPermissons(s.Unmask)
cgroupPerm := getCgroupPermissons(s.Unmask)
g, err := generate.New("linux")
if err != nil {
@ -357,7 +357,7 @@ func SpecGenToOCI(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.Runt
// set the devices cgroup when not running in a user namespace
if !inUserNS && !s.Privileged {
g.AddLinuxResourcesDevice(false, "", nil, nil, "rwm")
for _, dev := range s.DeviceCGroupRule {
for _, dev := range s.DeviceCgroupRule {
g.AddLinuxResourcesDevice(true, dev.Type, dev.Major, dev.Minor, dev.Access)
}
}

2
pkg/specgen/podspecgen.go
View File

@ -183,7 +183,7 @@ type PodStorageConfig struct {
// PodCgroupConfig contains configuration options about a pod's cgroups.
// This will be expanded in future updates to pods.
type PodCgroupConfig struct {
// CgroupParent is the parent for the CGroup that the pod will create.
// CgroupParent is the parent for the Cgroup that the pod will create.
// This pod cgroup will, in turn, be the default cgroup parent for all
// containers in the pod.
// Optional.

6
pkg/specgen/specgen.go
View File

@ -264,9 +264,9 @@ type ContainerStorageConfig struct {
// Devices are devices that will be added to the container.
// Optional.
Devices []spec.LinuxDevice `json:"devices,omitempty"`
// DeviceCGroupRule are device cgroup rules that allow containers
// DeviceCgroupRule are device cgroup rules that allow containers
// to use additional types of devices.
DeviceCGroupRule []spec.LinuxDeviceCgroup `json:"device_cgroup_rule,omitempty"`
DeviceCgroupRule []spec.LinuxDeviceCgroup `json:"device_cgroup_rule,omitempty"`
// DevicesFrom is a way to ensure your container inherits device specific information from another container
DevicesFrom []string `json:"devices_from,omitempty"`
// HostDeviceList is used to recreate the mounted device on inherited containers
@ -390,7 +390,7 @@ type ContainerCgroupConfig struct {
// CgroupsMode sets a policy for how cgroups will be created in the
// container, including the ability to disable creation entirely.
CgroupsMode string `json:"cgroups_mode,omitempty"`
// CgroupParent is the container's CGroup parent.
// CgroupParent is the container's Cgroup parent.
// If not set, the default for the current cgroup driver will be used.
// Optional.
CgroupParent string `json:"cgroup_parent,omitempty"`

9
pkg/specgenutil/specgen.go
View File

@ -488,8 +488,9 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
if ld := c.LogDriver; len(ld) > 0 {
s.LogConfiguration.Driver = ld
}
s.CgroupParent = c.CGroupParent
s.CgroupsMode = c.CGroupsMode
s.CgroupParent = c.CgroupParent
s.CgroupsMode = c.CgroupsMode
s.Groups = c.GroupAdd
s.Hostname = c.Hostname
@ -587,12 +588,12 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
s.Devices = append(s.Devices, specs.LinuxDevice{Path: dev})
}
for _, rule := range c.DeviceCGroupRule {
for _, rule := range c.DeviceCgroupRule {
dev, err := parseLinuxResourcesDeviceAccess(rule)
if err != nil {
return err
}
s.DeviceCGroupRule = append(s.DeviceCGroupRule, dev)
s.DeviceCgroupRule = append(s.DeviceCgroupRule, dev)
}
s.Init = c.Init

4
test/e2e/containers_conf_test.go
View File

@ -83,7 +83,7 @@ var _ = Describe("Podman run", func() {
})
It("podman Capabilities in containers.conf", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
cap := podmanTest.Podman([]string{"run", ALPINE, "grep", "CapEff", "/proc/self/status"})
cap.WaitWithDefaultTimeout()
Expect(cap).Should(Exit(0))
@ -123,7 +123,7 @@ var _ = Describe("Podman run", func() {
})
verifyNSHandling := func(nspath, option string) {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
os.Setenv("CONTAINERS_CONF", "config/containers-ns.conf")
if IsRemote() {
podmanTest.RestartRemoteService()

2
test/e2e/cp_test.go
View File

@ -94,7 +94,7 @@ var _ = Describe("Podman cp", func() {
// Copy a file to the container, then back to the host in --pid=host
It("podman cp --pid=host file", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
srcFile, err := ioutil.TempFile("", "")
Expect(err).To(BeNil())
defer srcFile.Close()

2
test/e2e/pod_infra_container_test.go
View File

@ -225,7 +225,7 @@ var _ = Describe("Podman pod create", func() {
})
It("podman pod container can override pod pid NS", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
session := podmanTest.Podman([]string{"pod", "create", "--share", "pid"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))

2
test/e2e/pod_kill_test.go
View File

@ -128,7 +128,7 @@ var _ = Describe("Podman pod kill", func() {
})
It("podman pod kill all", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
_, ec, podid := podmanTest.CreatePod(nil)
Expect(ec).To(Equal(0))

2
test/e2e/pod_ps_test.go
View File

@ -174,7 +174,7 @@ var _ = Describe("Podman ps", func() {
})
It("podman pod ps --ctr-names", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
_, ec, podid := podmanTest.CreatePod(nil)
Expect(ec).To(Equal(0))

4
test/e2e/run_ns_test.go
View File

@ -36,7 +36,7 @@ var _ = Describe("Podman run ns", func() {
})
It("podman run pidns test", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
session := podmanTest.Podman([]string{"run", fedoraMinimal, "bash", "-c", "echo $$"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
@ -115,7 +115,7 @@ var _ = Describe("Podman run ns", func() {
})
It("podman run --ipc=host --pid=host", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
cmd := exec.Command("ls", "-l", "/proc/self/ns/pid")
res, err := cmd.Output()
Expect(err).To(BeNil())

2
test/e2e/run_selinux_test.go
View File

@ -260,7 +260,7 @@ var _ = Describe("Podman run", func() {
})
It("podman test --pid=host", func() {
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
session := podmanTest.Podman([]string{"run", "--pid=host", ALPINE, "cat", "/proc/self/attr/current"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))

12
test/e2e/run_test.go
View File

@ -386,31 +386,31 @@ var _ = Describe("Podman run", func() {
SkipIfCgroupV1("podman umask on /sys/fs/cgroup will fail with cgroups V1")
SkipIfRootless("/sys/fs/cgroup rw access is needed")
rwOnCGroups := "/sys/fs/cgroup cgroup2 rw"
rwOnCgroups := "/sys/fs/cgroup cgroup2 rw"
session := podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup///", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=ALL", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", "--security-opt", "mask=/sys/fs/cgroup", ALPINE, "cat", "/proc/mounts"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCGroups))
Expect(session.OutputToString()).To(ContainSubstring(rwOnCgroups))
session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/sys/fs/cgroup", ALPINE, "ls", "/sys/fs/cgroup"})
session.WaitWithDefaultTimeout()

2
test/e2e/toolbox_test.go
View File

@ -118,7 +118,7 @@ var _ = Describe("Toolbox-specific testing", func() {
if podmanTest.RemoteTest {
Skip("Shm size check does not work with a remote client")
}
SkipIfRootlessCgroupsV1("Not supported for rootless + CGroupsV1")
SkipIfRootlessCgroupsV1("Not supported for rootless + CgroupsV1")
var session *PodmanSessionIntegration
var cmd *exec.Cmd
var hostShmSize, containerShmSize int