From 38ef778d2922d4da5fedba5878702f645138a192 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Thu, 16 Sep 2021 14:55:40 -0700 Subject: [PATCH] runsc: Add the --ignore-cgroups option If it is specified, runsc doesn't configure cgroups and starts a container in a current cgroup set. This can be used as a workaround for hosts with cgroupv2. Signed-off-by: Andrei Vagin --- runsc/config/config.go | 3 +++ runsc/config/flags.go | 1 + runsc/container/container.go | 15 ++++++++++----- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/runsc/config/config.go b/runsc/config/config.go index 91142888f..a07eab92a 100644 --- a/runsc/config/config.go +++ b/runsc/config/config.go @@ -208,6 +208,9 @@ type Config struct { // Mounts the cgroup filesystem backed by the sentry's cgroupfs. Cgroupfs bool `flag:"cgroupfs"` + // Don't configure cgroups. + IgnoreCgroups bool `flag:"ignore-cgroups"` + // TestOnlyAllowRunAsCurrentUserWithoutChroot should only be used in // tests. It allows runsc to start the sandbox process as the current // user, and without chrooting the sandbox process. This can be diff --git a/runsc/config/flags.go b/runsc/config/flags.go index f63bd11c1..5678cd6b6 100644 --- a/runsc/config/flags.go +++ b/runsc/config/flags.go @@ -84,6 +84,7 @@ func RegisterFlags() { flag.Bool("fuse", false, "TEST ONLY; use while FUSE in VFSv2 is landing. This allows the use of the new experimental FUSE filesystem.") flag.Bool("lisafs", false, "Enables lisafs protocol instead of 9P. This is only effective with VFS2.") flag.Bool("cgroupfs", false, "Automatically mount cgroupfs.") + flag.Bool("ignore-cgroups", false, "don't configure cgroups.") // Flags that control sandbox runtime behavior: network related. flag.Var(networkTypePtr(NetworkSandbox), "network", "specifies which network to use: sandbox (default), host, none. Using network inside the sandbox is more secure because it's isolated from the host network.") diff --git a/runsc/container/container.go b/runsc/container/container.go index 58e95c53b..1977a16e7 100644 --- a/runsc/container/container.go +++ b/runsc/container/container.go @@ -243,11 +243,16 @@ func New(conf *config.Config, args Args) (*Container, error) { if args.Spec.Linux.CgroupsPath == "" && !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot { args.Spec.Linux.CgroupsPath = "/" + args.ID } - // Create and join cgroup before processes are created to ensure they are - // part of the cgroup from the start (and all their children processes). - parentCgroup, subCgroup, err := c.setupCgroupForRoot(conf, args.Spec) - if err != nil { - return nil, err + var subCgroup, parentCgroup cgroup.Cgroup + if !conf.IgnoreCgroups { + var err error + + // Create and join cgroup before processes are created to ensure they are + // part of the cgroup from the start (and all their children processes). + parentCgroup, subCgroup, err = c.setupCgroupForRoot(conf, args.Spec) + if err != nil { + return nil, err + } } c.CompatCgroup = cgroup.CgroupJSON{Cgroup: subCgroup} if err := runInCgroup(parentCgroup, func() error {