linux, rootless: clamp oom_score_adj if it is too low

[giuseppe]

when running rootless, if the specified oom_score_adj for the container process is lower than the current value, clamp it to the current value and print a warning.

Closes: #19829

Does this PR introduce a user-facing change?

When running rootless, if the oom-score-adj value is too low, then it is clamped to the current value

[vrothberg]

Code LGTM

Can you add a note to the docs as well?

[giuseppe]

Can you add a note to the docs as well?

sure, added a note to the docs

[vrothberg]

LGTM
@containers/podman-maintainers PTAL

[flouthoc]

LGTM
/hold
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flouthoc, giuseppe, vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [flouthoc,giuseppe,vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[giuseppe]

needs again the lgtm label

[rhatdan]

/lgtm
/hold cancel

[Luap99]

Late comment but doesn't this run into the same problem similar to #18721?

You know set the limit on container creation permanently. Which means a long living container cannot be started if the oom_score_adj limit for the current user is set higher.
Instead we should check this value on startup time based on the real current value and not the calue at creation time.

[giuseppe]

Late comment but doesn't this run into the same problem similar to #18721?

You know set the limit on container creation permanently. Which means a long living container cannot be started if the oom_score_adj limit for the current user is set higher. Instead we should check this value on startup time based on the real current value and not the calue at creation time.

That is a good idea, taking a look right now

[giuseppe]

@Luap99 PR here: #19927

[snazy]

Maybe not the right place to ask, but could you push a new 4.6.3 patch release with this fix?
I'm kind of locked into SuSE's unstable repo and the workaround to downgrade crun doesn't work there (switching to the "stable" one doesn't work for other reasons).