Fraser Tweedale 35d20c4e0b chown cgroup to process uid in container namespace ...

Delegating cgroups to the container enables more complex workloads,
including systemd-based workloads.  The OCI runtime-spec was
recently updated to explicitly admit such delegation, through
specification of cgroup ownership semantics:

  https://github.com/opencontainers/runtime-spec/pull/1123

Pursuant to the updated OCI runtime-spec, change the ownership of
the container's cgroup directory and particular files therein, when
using cgroups v2 and when the cgroupfs is to be mounted read/write.

As a result of this change, systemd workloads can run in isolated
user namespaces on OpenShift when the sandbox's cgroupfs is mounted
read/write.

It might be possible to implement this feature in other cgroup
managers, but that work is deferred.

Signed-off-by: Fraser Tweedale <ftweedal@redhat.com>

2021-11-30 08:52:59 +10:00

..

fuzzing

Fix oss-fuzz build

2021-03-23 11:22:09 +00:00

integration

chown cgroup to process uid in container namespace

2021-11-30 08:52:59 +10:00

rootless.sh

Do not use Vagrant for CentOS 7/8

2021-07-23 09:23:23 +02:00