From 00119c85a9232700a27d9f80d67a1c7e947e124f Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Tue, 18 May 2021 16:44:24 +1000 Subject: [PATCH] integration: add repeated "runc update" test This is to ensure that we aren't leaking eBPF programs after "runc update". Unfortunately we cannot directly test the behaviour of cgroup program updates in an integration test because "runc update" doesn't support that behaviour at the moment. So instead we rely on the fact that each "runc update" implicitly triggers the devices rules to be updated. Without the previous patches applied, this new test will fail with errors (on cgroupv2 systems). Signed-off-by: Aleksa Sarai --- tests/integration/update.bats | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tests/integration/update.bats b/tests/integration/update.bats index e204ea495..41344a9dc 100644 --- a/tests/integration/update.bats +++ b/tests/integration/update.bats @@ -648,3 +648,29 @@ EOF runc resume test_update [ "$status" -eq 0 ] } + +@test "runc update replaces devices cgroup program" { + [[ "$ROOTLESS" -ne 0 ]] && requires rootless_cgroup + + # Unfortunately we can't update device rules directly with runc ("runc + # update" doesn't support it, and adding support would require ironing out + # some long-standing design issues with device configuration). So instead + # we just run "runc update" many times, relying on the fact that runc will + # re-apply devices cgroup rules on each runc update. + # + # In the past runc would not delete old cgroupv2 eBPF programs, so this + # test ensures that once we go past the program limit (64 stacked programs + # at time of writing) you can still run "runc" update. + + # Run the container in the background. + runc run -d --console-socket "$CONSOLE_SOCKET" test_update + [ "$status" -eq 0 ] + + for new_limit in $(seq 300); do + runc update --pids-limit "$((2 * new_limit))" test_update + [ "$status" -eq 0 ] + done + + # The container should still be running. + testcontainer test_update running +}