mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

[1.1] runc run: refuse a non-empty cgroup for systemd driver

Browse Source 
As this is currently not possible to add a PID into an existing systemd
unit, plus this feature will be deprected in runc 1.2 (see commit
d08bc0c1b3 ("runc run: warn on non-empty cgroup"), let's reject
sharing a systemd unit between two containers, and fix the test case
accordingly.

We still allow this to happen in case cgroupfs driver is used, to
minimize the potential compatibility issues in a stable branch.

This is an adaptation of main branch commit 82bc89cd10 for 1.1.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2023-03-23 11:57:46 -07:00
parent e618ec36cd
commit 12f2f03fd2
2 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/factory_linux.go
+6
View File
@@ -179,6 +179,12 @@ func (l *LinuxFactory) Create(id string, config *configs.Config) (Container, err
return nil, fmt.Errorf("unable to get cgroup PIDs: %w", err)
}
if len(pids) != 0 {
if config.Cgroups.Systemd {
// systemd cgroup driver can't add a pid to an
// existing systemd unit and will return an
// error anyway, so let's error out early.
return nil, fmt.Errorf("container's cgroup is not empty: %d process(es) found", len(pids))
}
// TODO: return an error.
logrus.Warnf("container's cgroup is not empty: %d process(es) found", len(pids))
logrus.Warn("DEPRECATED: running container in a non-empty cgroup won't be supported in runc 1.2; https://github.com/opencontainers/runc/issues/3132")
tests/integration/cgroups.bats
+10 -3
View File
@@ -348,7 +348,7 @@ function setup() {
[ "$output" = "ok" ]
}
@test "runc run/create should warn about a non-empty cgroup" {
@test "runc run/create should error/warn about a non-empty cgroup" {
if [[ "$ROOTLESS" -ne 0 ]]; then
requires rootless_cgroup
fi
@@ -358,14 +358,21 @@ function setup() {
runc run -d --console-socket "$CONSOLE_SOCKET" ct1
[ "$status" -eq 0 ]
# When systemd driver is used, runc can't add PID to an existing unit,
# so runc returns an error. For backward compatibility, we still allow
# such configuration in 1.1, but only when systemd driver is NOT used.
# See https://github.com/opencontainers/runc/issues/3780.
local exp=0
[[ -n "${RUNC_USE_SYSTEMD}" ]] && exp=1
# Run a second container sharing the cgroup with the first one.
runc --debug run -d --console-socket "$CONSOLE_SOCKET" ct2
[ "$status" -eq 0 ]
[ "$status" -eq "$exp" ]
[[ "$output" == *"container's cgroup is not empty"* ]]
# Same but using runc create.
runc create --console-socket "$CONSOLE_SOCKET" ct3
[ "$status" -eq 0 ]
[ "$status" -eq "$exp" ]
[[ "$output" == *"container's cgroup is not empty"* ]]
}