From 2ff7a2750a771c24e87249e4c7bf8111bc00b7a0 Mon Sep 17 00:00:00 2001 From: Lucas Manning Date: Thu, 8 Dec 2022 14:13:36 -0800 Subject: [PATCH] Only run sandbox in child cgroup if using cgroupv2 Joining a non-leaf node cgroup is only illegal in hierarchical cgroup accounting. PiperOrigin-RevId: 493992577 --- runsc/container/container.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/runsc/container/container.go b/runsc/container/container.go index 8a3c78212..2ea21e90f 100644 --- a/runsc/container/container.go +++ b/runsc/container/container.go @@ -255,8 +255,8 @@ func New(conf *config.Config, args Args) (*Container, error) { return nil, fmt.Errorf("cannot set up cgroup for root: %w", err) } // Join the child cgroup when using cgroupfs. Joining non leaf-node - // cgroups is illegal in Linux and will return EBUSY. - if subCgroup != nil && !conf.SystemdCgroup { + // cgroups is illegal in cgroupsv2 and will return EBUSY. + if subCgroup != nil && !conf.SystemdCgroup && cgroup.IsOnlyV2() { containerCgroup = subCgroup } else { containerCgroup = parentCgroup