netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6986 from avagin:runsc-ignore-cgroups

Browse Source 
PiperOrigin-RevId: 417932797
This commit is contained in:
gVisor bot
2021-12-22 20:38:27 -08:00
parent db3d9988c8 38ef778d29
commit 4ba8b0dabb
3 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/config/config.go
+3
View File
@@ -208,6 +208,9 @@ type Config struct {
// Mounts the cgroup filesystem backed by the sentry's cgroupfs.
Cgroupfs bool `flag:"cgroupfs"`
// Don't configure cgroups.
IgnoreCgroups bool `flag:"ignore-cgroups"`
// TestOnlyAllowRunAsCurrentUserWithoutChroot should only be used in
// tests. It allows runsc to start the sandbox process as the current
// user, and without chrooting the sandbox process. This can be
runsc/config/flags.go
+1
View File
@@ -84,6 +84,7 @@ func RegisterFlags() {
flag.Bool("fuse", false, "TEST ONLY; use while FUSE in VFSv2 is landing. This allows the use of the new experimental FUSE filesystem.")
flag.Bool("lisafs", false, "Enables lisafs protocol instead of 9P. This is only effective with VFS2.")
flag.Bool("cgroupfs", false, "Automatically mount cgroupfs.")
flag.Bool("ignore-cgroups", false, "don't configure cgroups.")
// Flags that control sandbox runtime behavior: network related.
flag.Var(networkTypePtr(NetworkSandbox), "network", "specifies which network to use: sandbox (default), host, none. Using network inside the sandbox is more secure because it's isolated from the host network.")
runsc/container/container.go
+10 -5
View File
@@ -243,11 +243,16 @@ func New(conf *config.Config, args Args) (*Container, error) {
if args.Spec.Linux.CgroupsPath == "" && !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot {
args.Spec.Linux.CgroupsPath = "/" + args.ID
}
// Create and join cgroup before processes are created to ensure they are
// part of the cgroup from the start (and all their children processes).
parentCgroup, subCgroup, err := c.setupCgroupForRoot(conf, args.Spec)
if err != nil {
return nil, err
var subCgroup, parentCgroup cgroup.Cgroup
if !conf.IgnoreCgroups {
var err error
// Create and join cgroup before processes are created to ensure they are
// part of the cgroup from the start (and all their children processes).
parentCgroup, subCgroup, err = c.setupCgroupForRoot(conf, args.Spec)
if err != nil {
return nil, err
}
}
c.CompatCgroup = cgroup.CgroupJSON{Cgroup: subCgroup}
if err := runInCgroup(parentCgroup, func() error {