mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

runc run: refuse a non-empty cgroup

Browse Source 
Commit d08bc0c1b3 ("runc run: warn on non-empty cgroup") introduced
a warning when a container is started in a non-empty cgroup. Such
configuration has lots of issues.

In addition to that, such configuration is not possible at all when
using the systemd cgroup driver.

As planned, let's promote this warning to an error, and fix the test
case accordingly.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2023-03-23 11:57:46 -07:00
parent 1d18743f9e
commit 82bc89cd10
2 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/factory_linux.go
+1 -3
View File
@@ -77,9 +77,7 @@ func Create(root, id string, config *configs.Config) (*Container, error) {
return nil, fmt.Errorf("unable to get cgroup PIDs: %w", err)
}
if len(pids) != 0 {
// TODO: return an error.
logrus.Warnf("container's cgroup is not empty: %d process(es) found", len(pids))
logrus.Warn("DEPRECATED: running container in a non-empty cgroup won't be supported in runc 1.2; https://github.com/opencontainers/runc/issues/3132")
return nil, fmt.Errorf("container's cgroup is not empty: %d process(es) found", len(pids))
}
}
tests/integration/cgroups.bats
+3 -3
View File
@@ -356,7 +356,7 @@ function setup() {
[ "$output" = "ok" ]
}
@test "runc run/create should warn about a non-empty cgroup" {
@test "runc run/create should error for a non-empty cgroup" {
[ $EUID -ne 0 ] && requires rootless_cgroup
set_cgroups_path
@@ -366,12 +366,12 @@ function setup() {
# Run a second container sharing the cgroup with the first one.
runc --debug run -d --console-socket "$CONSOLE_SOCKET" ct2
[ "$status" -eq 0 ]
[ "$status" -ne 0 ]
[[ "$output" == *"container's cgroup is not empty"* ]]
# Same but using runc create.
runc create --console-socket "$CONSOLE_SOCKET" ct3
[ "$status" -eq 0 ]
[ "$status" -ne 0 ]
[[ "$output" == *"container's cgroup is not empty"* ]]
}