Support running containers without CGroups #3581

mheon · 2019-07-16T13:53:30Z

Presently requires crun to test, but I'm working up patches to runc as well.

Add support for a --no-cgroups flag, which disables container creation of CGroups. This is mainly intended for use with systemd unit files - you'd manage the container from a unit file (for example, one generated by generate systemd), without CGroups set, so systemd has sole control of resource limits, shutdown ordering, etc.

openshift-ci-robot · 2019-07-16T13:53:36Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mheon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [mheon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

AkihiroSuda · 2019-07-16T14:21:36Z

--cgroup-driver=none seems more consistent with Docker

mheon · 2019-07-16T14:42:47Z

Flag change works for me; might be useful to add a cgroupv2 setting to it as well.

giuseppe · 2019-07-16T15:00:15Z

LGTM

mheon · 2019-07-16T18:22:47Z

Few things I want to do here in addition to existing changes:

Remove uses of kill --all in the OCI runtime where we can. That definitely needs CGroups to be working.
Add something to inspect indicating that there are no CGroups for the container

vrothberg · 2019-07-17T07:35:55Z

Flag change works for me; might be useful to add a cgroupv2 setting to it as well.

That could have some positive impact on the code as well since we could introduce a CgroupsManagerNone and use it in the switches.

rh-atomic-bot · 2019-07-18T14:17:52Z

☔ The latest upstream changes (presumably #3509) made this pull request unmergeable. Please resolve the merge conflicts.

rhatdan · 2019-08-19T11:32:36Z

@mheon Needs a rebase.

rhatdan · 2019-08-22T10:27:40Z

@mheon What is the scoop on this. Seems like something we would want?

mheon · 2019-08-22T13:40:24Z

Blocked on runc support right now.

I could get this landed, but restrict it to crun for now (similar to how we do --json for logging for the OCI runtime?)

rhatdan · 2019-08-22T13:42:36Z

Is there a PR opened for runc?
I am fine with crun as an alternative.

mheon · 2019-08-22T13:44:34Z

I got the runc code mostly working, but when Openstack noted that this wouldn't solve their problems, I abandoned pushing it the final bit of the way. Could be done, but would probably be a day or two to polish it up for PR.

rhatdan · 2019-08-22T13:48:46Z

With all of the work on getting podman to run well under a systemd unit file, would this PR help us allow better management of cgroups via systemd commands?

mheon · 2019-08-22T13:50:43Z

Yes - though with limitations (that the Openstack folks found too limiting).

It forces creation of a PID namespace (no --pid=host or --pid=container), completely disables resource limits (systemd solves this by applying its own, so not a really big deal), breaks a lot of commands (top, stats, a few more I'm forgetting).

mheon · 2019-08-26T18:16:14Z

Rebased and updated.

This now only works with OCI runtimes that have been explicitly flagged as supporting it - in this case, crun (runc support is sitting on my hard drive at 80-ish percent complete, waiting for me to find time to finish it).

Should be ready for review now. It's missing tests still, but I need to figure out a good way of doing those.

mheon · 2019-09-05T17:48:29Z

@giuseppe @vrothberg @rhatdan Mind taking a look at the tests here to see if you can figure out what's going on? I've been poking for most of two days without success

rhatdan · 2019-09-05T19:01:47Z

Seems to be tied to crun?

vrothberg · 2019-09-06T10:43:35Z

contrib/cirrus/integration_test.sh

@@ -45,6 +45,7 @@ case "$SPECIALMODE" in
        export OCI_RUNTIME=/usr/bin/crun
        make
        make install PREFIX=/usr ETCDIR=/etc
+	make install.config PREFIX=/usr


Indentation is a bit off

vrothberg · 2019-09-06T10:43:41Z

contrib/cirrus/integration_test.sh

@@ -57,6 +58,7 @@ case "$SPECIALMODE" in
    none)
        make
        make install PREFIX=/usr ETCDIR=/etc
+	make install.config PREFIX=/usr


Indentation is a bit off

vrothberg · 2019-09-06T11:15:38Z

The failing kill tests look like a flake to me. I can't reproduce locally at least. They fail (error below) when trying to run the container (not trying to kill it).

"Error while adding pod to CNI network \"podman\": running [/usr/sbin/iptables -t filter -N CNI-FORWARD --wait]: exit status 1: iptables: Chain already exists.\n"

A funny one is /var/tmp/go/src/github.com/containers/libpod/test/e2e/run_test.go:958:

[+0650s]   Expected
[+0650s]       <string>: 
[+0650s]   not to equal
[+0650s]       <string>:

... rerunning special_testing_cgroupv2 TEST_REMOTE_CLIENT:true

vrothberg · 2019-09-06T11:17:54Z

Restarted all of the three failed jobs

mheon · 2019-09-09T15:38:07Z

Found the failure, squashed down, expecting this to go green now.

mheon · 2019-09-09T16:08:17Z

The crun tests look green, so this is good to go once testing finishes.
@baude @rhatdan @vrothberg @giuseppe @TomSweeneyRedHat PTAL

rhatdan

LGTM

rhatdan · 2019-09-09T19:45:17Z

@vrothberg @giuseppe @baude @TomSweeneyRedHat @QiWang19 PTAL

TomSweeneyRedHat · 2019-09-09T21:25:05Z

LGTM but I'd like @vrothberg to take one last look before merging

vrothberg

Sorry for noticing it that late:

We need changes to man pages that explain what it does along with supported values.
I prefer changing the value from default to enabled. I find it a bit more approachable than default and disabled.

This is mostly used with Systemd, which really wants to manage CGroups itself when managing containers via unit file. Signed-off-by: Matthew Heon <matthew.heon@pm.me>

mheon · 2019-09-10T14:52:52Z

Done

vrothberg

LGTM

mheon · 2019-09-10T19:58:23Z

/retest

baude · 2019-09-10T20:08:04Z

/hold

baude · 2019-09-10T20:08:10Z

/lgtm

mheon · 2019-09-10T22:48:06Z

/hold cancel

openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 16, 2019

openshift-ci-robot requested review from rhatdan and TomSweeneyRedHat July 16, 2019 13:53

openshift-ci-robot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L labels Jul 16, 2019

openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 18, 2019

mheon mentioned this pull request Jul 18, 2019

Add option to not create own cgroups #3542

Closed

mheon added the Release Notes 1.5.1 label Aug 2, 2019

mheon mentioned this pull request Aug 4, 2019

systemd service files as blogged have issues on reboot #3148

Closed

mheon added Release Notes 1.5.2 and removed Release Notes 1.5.1 labels Aug 15, 2019

mheon changed the title ~~[WIP] Support running containers without CGroups~~ Support running containers without CGroups Aug 26, 2019

openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 26, 2019

mheon force-pushed the no_cgroups branch from 9aa234c to eb2ab6a Compare August 26, 2019 18:14

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 26, 2019

vrothberg reviewed Sep 6, 2019

View reviewed changes

mheon force-pushed the no_cgroups branch from 063d285 to 325721c Compare September 9, 2019 15:37

rhatdan reviewed Sep 9, 2019

View reviewed changes

vrothberg reviewed Sep 10, 2019

View reviewed changes

Add support for launching containers without CGroups

c228496

This is mostly used with Systemd, which really wants to manage CGroups itself when managing containers via unit file. Signed-off-by: Matthew Heon <matthew.heon@pm.me>

mheon force-pushed the no_cgroups branch from 325721c to c228496 Compare September 10, 2019 14:52

vrothberg reviewed Sep 10, 2019

View reviewed changes

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 10, 2019

openshift-ci-robot assigned baude Sep 10, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 10, 2019

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 10, 2019

openshift-merge-robot merged commit 7ac6ed3 into containers:master Sep 10, 2019

This was referenced Sep 10, 2019

Cirrus: Support testing with F31 #3901

Merged

rootless: automatically create a systemd scope #3959

Merged

edsantiago mentioned this pull request Aug 10, 2021

podman run --cgroups=disabled: missing "supervisor" #11191

Closed

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 26, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 26, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support running containers without CGroups #3581

Support running containers without CGroups #3581

mheon commented Jul 16, 2019

openshift-ci-robot commented Jul 16, 2019

AkihiroSuda commented Jul 16, 2019

mheon commented Jul 16, 2019

giuseppe commented Jul 16, 2019

mheon commented Jul 16, 2019

vrothberg commented Jul 17, 2019

rh-atomic-bot commented Jul 18, 2019

rhatdan commented Aug 19, 2019

rhatdan commented Aug 22, 2019

mheon commented Aug 22, 2019

rhatdan commented Aug 22, 2019

mheon commented Aug 22, 2019

rhatdan commented Aug 22, 2019

mheon commented Aug 22, 2019

mheon commented Aug 26, 2019

mheon commented Sep 5, 2019

rhatdan commented Sep 5, 2019

vrothberg Sep 6, 2019

vrothberg Sep 6, 2019

vrothberg commented Sep 6, 2019

vrothberg commented Sep 6, 2019

mheon commented Sep 9, 2019

mheon commented Sep 9, 2019

rhatdan left a comment

rhatdan commented Sep 9, 2019

TomSweeneyRedHat commented Sep 9, 2019

vrothberg left a comment

mheon commented Sep 10, 2019

vrothberg left a comment

mheon commented Sep 10, 2019

baude commented Sep 10, 2019

baude commented Sep 10, 2019

mheon commented Sep 10, 2019

Support running containers without CGroups #3581

Support running containers without CGroups #3581

Conversation

mheon commented Jul 16, 2019

openshift-ci-robot commented Jul 16, 2019

AkihiroSuda commented Jul 16, 2019

mheon commented Jul 16, 2019

giuseppe commented Jul 16, 2019

mheon commented Jul 16, 2019

vrothberg commented Jul 17, 2019

rh-atomic-bot commented Jul 18, 2019

rhatdan commented Aug 19, 2019

rhatdan commented Aug 22, 2019

mheon commented Aug 22, 2019

rhatdan commented Aug 22, 2019

mheon commented Aug 22, 2019

rhatdan commented Aug 22, 2019

mheon commented Aug 22, 2019

mheon commented Aug 26, 2019

mheon commented Sep 5, 2019

rhatdan commented Sep 5, 2019

vrothberg Sep 6, 2019

Choose a reason for hiding this comment

vrothberg Sep 6, 2019

Choose a reason for hiding this comment

vrothberg commented Sep 6, 2019

vrothberg commented Sep 6, 2019

mheon commented Sep 9, 2019

mheon commented Sep 9, 2019

rhatdan left a comment

Choose a reason for hiding this comment

rhatdan commented Sep 9, 2019

TomSweeneyRedHat commented Sep 9, 2019

vrothberg left a comment

Choose a reason for hiding this comment

mheon commented Sep 10, 2019

vrothberg left a comment

Choose a reason for hiding this comment

mheon commented Sep 10, 2019

baude commented Sep 10, 2019

baude commented Sep 10, 2019

mheon commented Sep 10, 2019