opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-23 02:18:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

service: do not run under the root cgroup

Browse Source 
at startup, when running on a cgroup v2 system, check if the current
process is running in the root cgroup and move it to a sub-cgroup,
otherwise Podman is not able to create cgroups and move processes
there.

Closes: https://github.com/containers/podman/issues/14573

[NO NEW TESTS NEEDED] it needs nested podman

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2022-06-30 14:36:53 +02:00
parent 5c39797624
commit bd51410b8d
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
cmd/podman/system/service_abi.go
View File

@ -10,11 +10,13 @@ import (
"os" "os"
"path/filepath" "path/filepath"
"github.com/containers/common/pkg/cgroups"
"github.com/containers/podman/v4/cmd/podman/registry" "github.com/containers/podman/v4/cmd/podman/registry"
api "github.com/containers/podman/v4/pkg/api/server" api "github.com/containers/podman/v4/pkg/api/server"
"github.com/containers/podman/v4/pkg/domain/entities" "github.com/containers/podman/v4/pkg/domain/entities"
"github.com/containers/podman/v4/pkg/domain/infra" "github.com/containers/podman/v4/pkg/domain/infra"
"github.com/containers/podman/v4/pkg/servicereaper" "github.com/containers/podman/v4/pkg/servicereaper"
"github.com/containers/podman/v4/utils"
"github.com/coreos/go-systemd/v22/activation" "github.com/coreos/go-systemd/v22/activation"
"github.com/pkg/errors" "github.com/pkg/errors"
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
@ -22,6 +24,26 @@ import (
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
) )
// maybeMoveToSubCgroup moves the current process in a sub cgroup when
// it is running in the root cgroup on a system that uses cgroupv2.
func maybeMoveToSubCgroup() error {
unifiedMode, err := cgroups.IsCgroup2UnifiedMode()
if err != nil {
return err
}
if !unifiedMode {
return nil
}
cgroup, err := utils.GetOwnCgroup()
if err != nil {
return err
}
if cgroup == "/" {
return utils.MoveUnderCgroupSubtree("init")
}
return nil
}
func restService(flags *pflag.FlagSet, cfg *entities.PodmanConfig, opts entities.ServiceOptions) error { func restService(flags *pflag.FlagSet, cfg *entities.PodmanConfig, opts entities.ServiceOptions) error {
var ( var (
listener net.Listener listener net.Listener
@ -103,6 +125,10 @@ func restService(flags *pflag.FlagSet, cfg *entities.PodmanConfig, opts entities
return err return err
} }
if err := maybeMoveToSubCgroup(); err != nil {
return err
}
servicereaper.Start() servicereaper.Start()
infra.StartWatcher(libpodRuntime) infra.StartWatcher(libpodRuntime)
server, err := api.NewServerWithSettings(libpodRuntime, listener, opts) server, err := api.NewServerWithSettings(libpodRuntime, listener, opts)