From faf1e44ea9d001535f228ce570e56e18d3dece06 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 7 Nov 2019 15:39:42 +0900
Subject: [PATCH] cgroup2: ebpf: increase RLIM_MEMLOCK to avoid BPF_PROG_LOAD
 error

Fix #2167

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 libcontainer/cgroups/ebpf/ebpf.go | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libcontainer/cgroups/ebpf/ebpf.go b/libcontainer/cgroups/ebpf/ebpf.go
index b4a769cd9..4795e0aa3 100644
--- a/libcontainer/cgroups/ebpf/ebpf.go
+++ b/libcontainer/cgroups/ebpf/ebpf.go
@@ -16,6 +16,13 @@ func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFD
 	nilCloser := func() error {
 		return nil
 	}
+	// Increase `ulimit -l` limit to avoid BPF_PROG_LOAD error (#2167).
+	// This limit is not inherited into the container.
+	memlockLimit := &unix.Rlimit{
+		Cur: unix.RLIM_INFINITY,
+		Max: unix.RLIM_INFINITY,
+	}
+	_ = unix.Setrlimit(unix.RLIMIT_MEMLOCK, memlockLimit)
 	spec := &ebpf.ProgramSpec{
 		Type:         ebpf.CGroupDevice,
 		Instructions: insts,