From f4fb010ef487086e733fb116dd98e4e87208b544 Mon Sep 17 00:00:00 2001 From: Lucas Manning Date: Wed, 7 Dec 2022 10:30:50 -0800 Subject: [PATCH] Join subcontainer cgroup in cgroupfs instead of parent if it exists. This is a no-op for most workloads; limits set on the parent affect the child, and resource accounting of a child shows up in the parent. Fixes #8269 PiperOrigin-RevId: 493643530 --- runsc/container/container.go | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/runsc/container/container.go b/runsc/container/container.go index 6859a5d0a..8a3c78212 100644 --- a/runsc/container/container.go +++ b/runsc/container/container.go @@ -244,7 +244,7 @@ func New(conf *config.Config, args Args) (*Container, error) { if args.Spec.Linux.CgroupsPath == "" && !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot { args.Spec.Linux.CgroupsPath = "/" + args.ID } - var subCgroup, parentCgroup cgroup.Cgroup + var subCgroup, parentCgroup, containerCgroup cgroup.Cgroup if !conf.IgnoreCgroups { var err error @@ -254,13 +254,20 @@ func New(conf *config.Config, args Args) (*Container, error) { if err != nil { return nil, fmt.Errorf("cannot set up cgroup for root: %w", err) } + // Join the child cgroup when using cgroupfs. Joining non leaf-node + // cgroups is illegal in Linux and will return EBUSY. + if subCgroup != nil && !conf.SystemdCgroup { + containerCgroup = subCgroup + } else { + containerCgroup = parentCgroup + } } c.CompatCgroup = cgroup.CgroupJSON{Cgroup: subCgroup} overlayFilestoreFile, err := createOverlayFilestore(conf.GetOverlay2()) if err != nil { return nil, err } - if err := runInCgroup(parentCgroup, func() error { + if err := runInCgroup(containerCgroup, func() error { ioFiles, specFile, err := c.createGoferProcess(args.Spec, conf, args.BundleDir, args.Attached) if err != nil { return fmt.Errorf("cannot create gofer process: %w", err)