Support host side cgroups v2

[jodh-intel]

Problem

The runtime doesn't support cgroups v2 on the host.

$ egrep -r  "\<cgroupsLoadFunc\(|parentCgroup\(" | grep '[12]'
virtcontainers/container.go:    cgroup, err := cgroupsLoadFunc(cgroups.V1,
virtcontainers/container.go:    parent, err := parentCgroup(cgroups.V1, c.state.CgroupPath)
virtcontainers/container.go:    cgroup, err := cgroupsLoadFunc(cgroups.V1,
virtcontainers/sandbox.go:      cgroup, err := cgroupsLoadFunc(V1Constraints, cgroups.StaticPath(s.state.CgroupPath))

Consequence

This means we cannot run on F31 and F32, which default to cgroups v2 only without the user performing surgery on their system (reverting to cgroups v1 by changing bootloader stuff and rebooting - yikes!)

Related:

• docs: Add containerd install guide #739 (comment)
• docs: Add containerd install guide #739
• Ensure 2.0 is as easy to install as 1.x (aka update release docs) #538

[ariel-adam]

@jodh-intel was this already fixed?

[azenla]

This could be more important very soon. Ubuntu 21.10 is going to ship with cgroups v2 enabled by default: https://www.phoronix.com/scan.php?page=news_item&px=Ubuntu-21.10-systemd-cgroup

[itplayer-de]

Is there any news or a roadmap here? Also Debian 11 "bullseye" now has cgroups v2 as default. Containerd runs in a "mountpoint does not exist" (also with setting sandbox_cgroup_only=true). Thx & regards

[zvonkok]

Arch and all derivates (EndeavourOS, Manjaro, Garuda) have also per default cgroup v2.

[liyimeng]

What is blocking this from fixed?

[liubin]

@jodh-intel we are joining a summer code and can I assign this one to others if you are not started yet?

[jodh-intel]

Hi @liubin - yes, please do! ;) I was not involved in discussions on this being assigned to me, and don't have the time to look at it.

[bradennapier]

:( Manjaro no bueno due to this it seems!

[jodh-intel]

This issue should have been closed when #4397 landed (issue #3073).

See: https://github.com/kata-containers/kata-containers/blob/main/docs/design/host-cgroups.md

Closing this issue, but I've raised #6259 to fix kata-manager which by default fails (incorrectly) when run on a cgroupsv2 system.