netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Join subcontainer cgroup in cgroupfs instead of parent if it exists.

Browse Source 
This is a no-op for most workloads; limits set on the parent affect
the child, and resource accounting of a child shows up in the parent.

Fixes #8269

PiperOrigin-RevId: 493643530
This commit is contained in:
Lucas Manning
2022-12-07 10:33:43 -08:00
committed by gVisor bot
parent 6fb2a265a1
commit f4fb010ef4
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/container/container.go
+9 -2
View File
@@ -244,7 +244,7 @@ func New(conf *config.Config, args Args) (*Container, error) {
if args.Spec.Linux.CgroupsPath == "" && !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot {
args.Spec.Linux.CgroupsPath = "/" + args.ID
}
var subCgroup, parentCgroup cgroup.Cgroup
var subCgroup, parentCgroup, containerCgroup cgroup.Cgroup
if !conf.IgnoreCgroups {
var err error
@@ -254,13 +254,20 @@ func New(conf *config.Config, args Args) (*Container, error) {
if err != nil {
return nil, fmt.Errorf("cannot set up cgroup for root: %w", err)
}
// Join the child cgroup when using cgroupfs. Joining non leaf-node
// cgroups is illegal in Linux and will return EBUSY.
if subCgroup != nil && !conf.SystemdCgroup {
containerCgroup = subCgroup
} else {
containerCgroup = parentCgroup
}
}
c.CompatCgroup = cgroup.CgroupJSON{Cgroup: subCgroup}
overlayFilestoreFile, err := createOverlayFilestore(conf.GetOverlay2())
if err != nil {
return nil, err
}
if err := runInCgroup(parentCgroup, func() error {
if err := runInCgroup(containerCgroup, func() error {
ioFiles, specFile, err := c.createGoferProcess(args.Spec, conf, args.BundleDir, args.Attached)
if err != nil {
return fmt.Errorf("cannot create gofer process: %w", err)