cgroupsv2 adjustments

[x7upLime]

Makes the proof of concept work for cgroupsv2 scenarios:
.Adjust the logic in the cg(), to reflect the new cgroupsv2 hierarchy
.Adds a cgroup-cleanup mechanism that would work for cgroupsv2.
....commits should tell more

Tied to #14
proposes solution to #10 (even though there is already one at the end of the thread)

[netskink]

hello @x7upLime , you closed this issue without it being merged. Any particular reason why? I am trying to get this to work as well and I am using your code as a reference.

FWIW, I was using a busybox rootfs. I didn't see any items in /sys. I figured it was populated by systemd. I switched to a ubuntu rootfs. I still don't see any times in /sys.

I'll let you know if using your version of the code works.

[netskink]

Hmm. Ok here is the deal.

I am using linux kernel 5.x.

If I use the code as is and tweak for mods similar to yours, I can create the files as you/she did. However, they have no effect on the number of processes.

Alternatively, if I mount sysfs I can see a similar sys directory as I do on the host. That is good. What's bad, is the result is not modifiable. Here is mounting the filesystem but using interactive mode to attempt to write to it. (despite its mounted read/write)

Here is the code for cg() during this run:

func cg() {

    // Path name for the custom v2cgroup
    cgroups := "/sys/fs/cgroup/"
    custom_cgroup := filepath.Join(cgroups, "davis")

    // Make the custom v2cgroup
    err := os.MkdirAll(custom_cgroup, 0755)
    chkerr("after mkdir custom cgroup", err)

}

[netskink]

Here is an example of the alternative method. Not mounting sysfs, making the pids.max but not having any effect. Also note, I'm creating a max pid of 3. But i'm able to spawn bash 5 times. FWIW, this is writing to the actual roofs image mounted as root. So if my rootfs/sys on host was originally just a mount point, doing without mounting sysfs means these writes are being done to the filesystem and not to memory/kernel.

In this case, cg() looks like this:

func cg() {

    // Path name for the custom v2cgroup
    cgroups := "/sys/fs/cgroup"
    custom_cgroup := filepath.Join(cgroups, "davis")

    // Make the custom v2cgroup
    err := os.MkdirAll(custom_cgroup, 0755)
    if err != nil && !os.IsExist(err) {
        panic(err)
    }

    // limit to 3 processes
    must(ioutil.WriteFile(filepath.Join(custom_cgroup, "pids.max"), []byte("3"), 0744))
    // removes the new cgroup in place after the container exits
    must(ioutil.WriteFile(filepath.Join(custom_cgroup, "notify_on_release"), []byte("1"), 0744))
    must(ioutil.WriteFile(filepath.Join(custom_cgroup, "cgroup.procs"), []byte(strconv.Itoa(os.Getpid())), 0744))

}