From 7cba29ca3bf12f15b505d1b1b5bdda6e87cd5ca0 Mon Sep 17 00:00:00 2001
From: Etienne Perot <eperot@google.com>
Date: Mon, 27 Jun 2022 18:12:36 -0700
Subject: [PATCH] gVisor Makefile: Add `--cgroupns=host` only when supported by
 Docker.

Docker doesn't support the `--cgroupns` option until API version 1.41.
This change prevents the addition of the `--cgroupns=host` option
(which is only necessary for `cgroup_test` to pass, not necessary
for any build) unless Docker supports it.

PiperOrigin-RevId: 457612257
---
 tools/bazel.mk | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/tools/bazel.mk b/tools/bazel.mk
index 2ae9d8843..e5bc1ab0c 100644
--- a/tools/bazel.mk
+++ b/tools/bazel.mk
@@ -161,6 +161,21 @@ ifneq ($(DEVICE_FILE),)
 DOCKER_RUN_OPTIONS += --device "$(DEVICE_FILE):$(DEVICE_FILE)"
 endif
 
+# Check if Docker API version supports cgroupns (supported in >=1.41).
+# If not, don't include it in options.
+ifeq ($(DOCKER_BUILD),true)
+DOCKER_API_VERSION := $(shell docker version --format='{{.Server.APIVersion}}')
+ifeq ($(shell echo $(DOCKER_API_VERSION) | tr '.' '\n' | wc -l),2)
+ifeq ($(shell test $(shell echo $(DOCKER_API_VERSION) | cut -d. -f1) -gt 1 && echo true),true)
+DOCKER_RUN_OPTIONS += --cgroupns=host
+else  # If API version 1, check second version component.
+ifeq ($(shell test $(shell echo $(DOCKER_API_VERSION) | cut -d. -f2) -ge 41 && echo true),true)
+DOCKER_RUN_OPTIONS += --cgroupns=host
+endif
+endif
+endif
+endif
+
 # Top-level functions.
 #
 # This command runs a bazel server, and the container sticks around
@@ -205,7 +220,7 @@ endif
 	@docker run -d --name $(DOCKER_NAME) --hostname $(DOCKER_HOSTNAME) \
 	  -v "$(CURDIR):$(CURDIR)" \
 	  --workdir "$(CURDIR)" \
-	  --pid=host --cgroupns=host \
+	  --pid=host \
 	  $(DOCKER_RUN_OPTIONS) \
 	  gvisor.dev/images/builder \
 	  bash -c "set -x; tail -f --pid=\$$($(BAZEL) info server_pid) /dev/null"