Kir Kolyshkin 6462e9de67 runc update: implement memory.checkBeforeUpdate ...

This is aimed at solving the problem of cgroup v2 memory controller
behavior which is not compatible with that of cgroup v1.

In cgroup v1, if the new memory limit being set is lower than the
current usage, setting the new limit fails.

In cgroup v2, same operation succeeds, and the container is OOM killed.

Introduce a new setting, memory.checkBeforeUpdate, and use it to mimic
cgroup v1 behavior.

Note that this is not 100% reliable because of TOCTOU, but this is the
best we can do.

Add some test cases.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2022-11-02 17:15:26 -07:00

..

example.go

runc: do not set inheritable capabilities

2022-05-12 08:14:50 +10:00

spec_linux_test.go

libct/seccomp/config: add missing KillThread, KillProcess

2022-05-04 16:22:09 +02:00

spec_linux.go

runc update: implement memory.checkBeforeUpdate

2022-11-02 17:15:26 -07:00