docker run: specify cgroup namespace mode with --cgroupns #2024

rgulewich · 2019-07-30T04:47:48Z

- What I did

This adds the --cgroupns=host|private option to docker run to allow setting the cgroup namespace mode. Fixes #1988

- How I did it

Largely by copying the code for userns and ipc modes.

- How to verify it

docker run --cgroupns=private against a daemon that's running with --default-cgroupns-mode=host.

- Description for the changelog

docker run: allow specifying cgroup namespace mode with --cgroupns

- A picture of a cute animal (not mandatory but encouraged)

AkihiroSuda · 2019-07-30T04:56:13Z

Looks good, but CI failing

GordonTheTurtle · 2019-07-30T16:50:45Z

Please sign your commits following these rules:
https://github.com/moby/moby/blob/master/CONTRIBUTING.md#sign-your-work
The easiest way to do this is to amend the last commit:

$ git clone -b "1988-run-cgroupns-mode" git@github.com:rgulewich/cli.git somewhere
$ cd somewhere
$ git rebase -i HEAD~842358791888
editor opens
change each 'pick' to 'edit'
save the file and quit
$ git commit --amend -s --no-edit
$ git rebase --continue # and repeat the amend for each commit
$ git push -f

Amending updates the existing PR. You DO NOT need to open a new one.

codecov-io · 2019-07-30T17:10:28Z

Codecov Report

❗ No coverage uploaded for pull request base (master@2079e74). Click here to learn what that means.
The diff coverage is 80%.

@@            Coverage Diff            @@
##             master    #2024   +/-   ##
=========================================
  Coverage          ?   56.79%           
=========================================
  Files             ?      311           
  Lines             ?    21849           
  Branches          ?        0           
=========================================
  Hits              ?    12410           
  Misses            ?     8523           
  Partials          ?      916

rgulewich · 2019-07-30T17:42:15Z

Looks good, but CI failing

@AkihiroSuda - Fixed CI failures related to my changes - TestSigProxyWithTTY() is failling, but as far as I can tell, the failure is unrelated.

kolyshkin · 2019-07-31T01:13:46Z

TestSigProxyWithTTY() is failling

@rgulewich might be fixed by #2016, could you please rebase?

rgulewich · 2019-07-31T16:59:42Z

@kolyshkin - That did it, thanks!

kolyshkin · 2019-07-31T17:22:18Z

e2e/container/run_test.go

+	environment.SkipIfCgroupNamespacesNotSupported(t)
+
+	result := icmd.RunCommand("docker", "run", "--cgroupns=private", "--rm", fixtures.AlpineImage,
+		"sh", "-c", "[[ $(cat /proc/1/cgroup | grep memory | cut -d: -f 3) == '/' ]]")


Perhaps rewrite this to not depend on bash? Also, looks like a single grep is sufficient, e.g.

grep -q ':memory:/$' /proc/1/cgroup

@rgulewich ^^

Updated - PTAL.

@kolyshkin ^^

thaJeztah

Thanks! left some comments inline

cli/command/container/opts.go

thaJeztah · 2019-08-06T11:48:50Z

docs/reference/commandline/create.md

@@ -29,6 +29,10 @@ Options:
      --blkio-weight-device value     Block IO weight (relative device weight) (default [])
      --cap-add value                 Add Linux capabilities (default [])
      --cap-drop value                Drop Linux capabilities (default [])
+      --cgroupns string               Cgroup namespace to use
+                                      'host': Run the container in the Docker host's cgroup namespace


Might be slightly easier to read if the descriptions are aligned;

--cgroupns string Cgroup namespace to use 'host': Run the container in the Docker host's cgroup namespace 'private': Run the container in its own private cgroup namespace '': Use the default Docker daemon cgroup namespace specified by the "--default-cgroupns-mode" option (default)

docs/reference/commandline/run.md

man/docker-run.1.md

thaJeztah · 2019-08-06T11:50:12Z

man/dockerd.8.md

@@ -177,6 +178,10 @@ $ sudo dockerd --add-runtime runc=runc --add-runtime custom=/usr/local/bin/my-ru
 **-D**, **--debug**=*true*|*false*
  Enable debug mode. Default is false.

+**--default-cgroupns-mode**="**host**|**private**"
+  Set the default cgroup namespace mode for newly created containers. The argument
+  can either be **host** or **private**.


Should we describe the default here as well?

thaJeztah · 2019-08-06T11:56:48Z

cli/command/container/opts.go

@@ -471,6 +473,11 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		return nil, errors.Errorf("--userns: invalid USER mode")
 	}

+	cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)
+	if !cgroupnsMode.Valid() {


Thinking about this; I'm a bit on the fence if we should validate this on the client side, or just leave it to the daemon to return an error if an invalid value was provided. OTOH, these values likely won't change in future, so perhaps it's ok

@kolyshkin wdyt?

I think it's ok for now, given that it likely won't change in future, but I'll open a follow-up issue after this is merged to discuss this

albers

bash completion LGTM, thanks.

AkihiroSuda · 2019-08-16T19:41:47Z

needs rebase

thaJeztah

thanks for updating! (and sorry for the delay 😞) I left one comment about the docker-compose schema version (hoping #2073 will be merged soon), and a suggestion for the flag description output for --help.

Otherwise looks good to me!

cli/compose/schema/data/config_schema_v3.8.json

cli/command/container/opts.go

thaJeztah · 2019-08-30T09:45:33Z

cli/command/container/opts.go

@@ -471,6 +473,11 @@ func parse(flags *pflag.FlagSet, copts *containerOptions, serverOS string) (*con
 		return nil, errors.Errorf("--userns: invalid USER mode")
 	}

+	cgroupnsMode := container.CgroupnsMode(copts.cgroupnsMode)
+	if !cgroupnsMode.Valid() {


I think it's ok for now, given that it likely won't change in future, but I'll open a follow-up issue after this is merged to discuss this

rgulewich · 2019-09-10T04:18:45Z

@thaJeztah - Updated with your changes. Mind taking a look?

rgulewich · 2019-09-30T20:56:16Z

@thaJeztah / @kolyshkin - Mind taking a look? Thanks!

AkihiroSuda · 2019-10-25T08:30:54Z

@thaJeztah PTAL?

AkihiroSuda · 2019-10-25T08:30:59Z

needs rebase

rgulewich · 2019-10-25T18:43:55Z

Rebased. @thaJeztah, mind taking a look?

AkihiroSuda · 2020-01-15T03:45:24Z

ping @thaJeztah

thaJeztah

LGTM

silvin-lubecki

Looks Good To Me 🐯

Signed-off-by: Rob Gulewich <rgulewich@netflix.com>

AkihiroSuda · 2020-02-10T14:39:06Z

CI failure seems unrelated



=== Failed

=== FAIL: e2e/image TestPushWithContentTrustUnreachableServer (0.37s)

    push_test.go:323: assertion failed: 

        Command:  docker tag registry:5000/alpine:3.6 registry:5000/trust-push-unreachable:latest

        ExitCode: 1

        Error:    exit status 1

        Stdout:   

        Stderr:   error during connect: Post http://docker/v1.40/images/registry:5000/alpine:3.6/tag?repo=registry%3A5000%2Ftrust-push-unreachable&tag=latest: command [ssh -o ControlMaster=auto -o ControlPath=/root/.docker/%r@%h:%p -l penguin 172.20.0.2 -- docker system dial-stdio] has exited with exit status 255, please make sure the URL is valid, and Docker 18.09 or later is installed on the remote host: stderr=

        

        

        Failures:

        ExitCode was 1 expected 0

        Expected no error

AkihiroSuda · 2020-02-11T08:43:58Z

CI green

thaJeztah · 2020-02-11T10:16:00Z

Whoop! Let's merge!

@AkihiroSuda if you're able to assist with #2303 (that's related to CI being really flaky currently)

rgulewich requested review from albers and thaJeztah as code owners July 30, 2019 04:47

GordonTheTurtle added the status/0-triage label Jul 30, 2019

rgulewich mentioned this pull request Jul 30, 2019

docker run flag for overriding daemon default-cgroupns-mode #1988

Closed

AkihiroSuda approved these changes Jul 30, 2019

View reviewed changes

rgulewich force-pushed the 1988-run-cgroupns-mode branch from f39912d to b560da6 Compare July 30, 2019 16:50

GordonTheTurtle added the dco/no label Jul 30, 2019

rgulewich force-pushed the 1988-run-cgroupns-mode branch from b560da6 to bd828fd Compare July 30, 2019 17:10

GordonTheTurtle removed the dco/no label Jul 30, 2019

rgulewich force-pushed the 1988-run-cgroupns-mode branch from bd828fd to 0883b2a Compare July 30, 2019 17:27

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 0883b2a to 4c4bb53 Compare July 31, 2019 02:44

kolyshkin reviewed Jul 31, 2019

View reviewed changes

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 4c4bb53 to b6efc48 Compare August 2, 2019 18:11

thaJeztah added impact/changelog impact/documentation status/2-code-review and removed status/0-triage labels Aug 6, 2019

thaJeztah requested changes Aug 6, 2019

View reviewed changes

thaJeztah reviewed Aug 6, 2019

View reviewed changes

albers approved these changes Aug 6, 2019

View reviewed changes

GordonTheTurtle added the dco/no label Aug 7, 2019

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 2ea22b0 to 602452f Compare August 23, 2019 20:42

GordonTheTurtle removed the dco/no label Aug 23, 2019

thaJeztah requested changes Aug 30, 2019

View reviewed changes

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 602452f to fdeb2fd Compare September 10, 2019 04:15

rgulewich force-pushed the 1988-run-cgroupns-mode branch 2 times, most recently from 977f2ad to 88aba22 Compare September 16, 2019 19:00

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 88aba22 to 306338f Compare September 30, 2019 20:54

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 306338f to 298d9cd Compare October 25, 2019 18:42

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 298d9cd to 15c01bb Compare November 11, 2019 22:29

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 15c01bb to 5afc093 Compare December 18, 2019 22:25

rgulewich force-pushed the 1988-run-cgroupns-mode branch from 5afc093 to e0d3e04 Compare January 15, 2020 21:01

thaJeztah approved these changes Jan 16, 2020

View reviewed changes

thaJeztah added status/4-merge and removed status/2-code-review labels Jan 16, 2020

silvin-lubecki approved these changes Jan 17, 2020

View reviewed changes

docker run: specify cgroup namespace mode with --cgroupns

5ad1d4d

Signed-off-by: Rob Gulewich <rgulewich@netflix.com>

rgulewich force-pushed the 1988-run-cgroupns-mode branch from e0d3e04 to 5ad1d4d Compare January 29, 2020 22:51

thaJeztah merged commit 8ef8547 into docker:master Feb 11, 2020

thaJeztah added this to the 20.03.0 milestone Feb 19, 2020

hendrikmaus mentioned this pull request Jul 7, 2022

docs: fix default value for dockerd --default-cgroupns to private #3699

Open

crazy-max mentioned this pull request Dec 18, 2022

cmd: set double quotes as code delimiter #3924

Merged

LewisGaul mentioned this pull request Jan 18, 2023

Add support for the --cgroupns arg gabrieldemarmiesse/python-on-whales#400

Merged

BenTheElder mentioned this pull request Apr 6, 2023

Cannot start kind with userns remap kubernetes-sigs/kind#3043

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docker run: specify cgroup namespace mode with --cgroupns #2024

docker run: specify cgroup namespace mode with --cgroupns #2024

rgulewich commented Jul 30, 2019

AkihiroSuda commented Jul 30, 2019

GordonTheTurtle commented Jul 30, 2019

codecov-io commented Jul 30, 2019 •

edited

Loading

rgulewich commented Jul 30, 2019

kolyshkin commented Jul 31, 2019

rgulewich commented Jul 31, 2019

kolyshkin Jul 31, 2019

kolyshkin Aug 1, 2019

rgulewich Aug 2, 2019

rgulewich Aug 5, 2019

thaJeztah left a comment

thaJeztah Aug 6, 2019

thaJeztah Aug 6, 2019

thaJeztah Aug 6, 2019

thaJeztah Aug 30, 2019

albers left a comment

AkihiroSuda commented Aug 16, 2019

thaJeztah left a comment

thaJeztah Aug 30, 2019

rgulewich commented Sep 10, 2019

rgulewich commented Sep 30, 2019

AkihiroSuda commented Oct 25, 2019

AkihiroSuda commented Oct 25, 2019

rgulewich commented Oct 25, 2019

AkihiroSuda commented Jan 15, 2020

thaJeztah left a comment

silvin-lubecki left a comment

AkihiroSuda commented Feb 10, 2020

AkihiroSuda commented Feb 11, 2020

thaJeztah commented Feb 11, 2020

docker run: specify cgroup namespace mode with --cgroupns #2024

docker run: specify cgroup namespace mode with --cgroupns #2024

Conversation

rgulewich commented Jul 30, 2019

AkihiroSuda commented Jul 30, 2019

GordonTheTurtle commented Jul 30, 2019

codecov-io commented Jul 30, 2019 • edited Loading

Codecov Report

rgulewich commented Jul 30, 2019

kolyshkin commented Jul 31, 2019

rgulewich commented Jul 31, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thaJeztah left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

albers left a comment

Choose a reason for hiding this comment

AkihiroSuda commented Aug 16, 2019

thaJeztah left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rgulewich commented Sep 10, 2019

rgulewich commented Sep 30, 2019

AkihiroSuda commented Oct 25, 2019

AkihiroSuda commented Oct 25, 2019

rgulewich commented Oct 25, 2019

AkihiroSuda commented Jan 15, 2020

thaJeztah left a comment

Choose a reason for hiding this comment

silvin-lubecki left a comment

Choose a reason for hiding this comment

AkihiroSuda commented Feb 10, 2020

AkihiroSuda commented Feb 11, 2020

thaJeztah commented Feb 11, 2020

codecov-io commented Jul 30, 2019 •

edited

Loading