Kir Kolyshkin 30f8f51eab runc create/run: warn on rootless + shared pidns + no cgroup ...

Shared pid namespace means `runc kill` (or `runc delete -f`) have to
kill all container processes, not just init. To do so, it needs a cgroup
to read the PIDs from.

If there is no cgroup, processes will be leaked, and so such
configuration is bad and should not be allowed. To keep backward
compatibility, though, let's merely warn about this for now.

Alas, the only way to know if cgroup access is available is by returning
an error from Manager.Apply. Amend fs cgroup managers to do so (systemd
doesn't need it, since v1 can't work with rootless, and cgroup v2 does
not have a special rootless case).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2024-09-17 22:49:37 -07:00

..

cmd

mv contrib/cmd tests/cmd (except memfd-bind)

2024-08-16 00:55:48 +09:00

fuzzing

tests: Fix fuzzer location in oss-fuzz config

2023-03-23 03:21:17 +08:00

integration

runc create/run: warn on rootless + shared pidns + no cgroup

2024-09-17 22:49:37 -07:00

rootless.sh

tests/rootless.sh: drop set -x

2023-06-08 09:23:29 -07:00