From bf7492ee5d022cd99a9dbe71c5c4f965041552e9 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 3 Jun 2021 10:40:55 -0700 Subject: [PATCH] runc update: skip devices The runc update CLI is not able to modify devices, so let's set SkipDevices (so that a cgroup controller won't try to update devices cgroup). This helps use cases when some other device management (NVIDIA GPUs) applies its configuration on top of what runc does. Make sure we do not save SkipDevices into state.json. Signed-off-by: Kir Kolyshkin --- libcontainer/configs/cgroup_linux.go | 4 ++-- update.go | 7 +++++++ 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/libcontainer/configs/cgroup_linux.go b/libcontainer/configs/cgroup_linux.go index 715ec1cb9..a1e7f0afd 100644 --- a/libcontainer/configs/cgroup_linux.go +++ b/libcontainer/configs/cgroup_linux.go @@ -127,8 +127,8 @@ type Resources struct { // SkipDevices allows to skip configuring device permissions. // Used by e.g. kubelet while creating a parent cgroup (kubepods) - // common for many containers. + // common for many containers, and by runc update. // // NOTE it is impossible to start a container which has this flag set. - SkipDevices bool `json:"skip_devices"` + SkipDevices bool `json:"-"` } diff --git a/update.go b/update.go index ce89de083..253c086be 100644 --- a/update.go +++ b/update.go @@ -329,6 +329,13 @@ other options are ignored. config.IntelRdt.MemBwSchema = memBwSchema } + // XXX(kolyshkin@): currently "runc update" is unable to change + // device configuration, so add this to skip device update. + // This helps in case an extra plugin (nvidia GPU) applies some + // configuration on top of what runc does. + // Note this field is not saved into container's state.json. + config.Cgroups.SkipDevices = true + return container.Set(config) }, }