-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #4277 from lifubang/backport-4265-nofilerlimit
[1.1] Fix set nofile rlimit error
- Loading branch information
Showing
11 changed files
with
162 additions
and
54 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| module github.com/opencontainers/runc | ||
|
|
||
| go 1.17 | ||
| go 1.18 | ||
|
|
||
| require ( | ||
| github.com/checkpoint-restore/go-criu/v5 v5.3.0 | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| //go:build go1.19 | ||
|
|
||
| package system | ||
|
|
||
| import ( | ||
| "sync/atomic" | ||
| "syscall" | ||
|
|
||
| _ "unsafe" // for go:linkname | ||
| ) | ||
|
|
||
| //go:linkname syscallOrigRlimitNofile syscall.origRlimitNofile | ||
| var syscallOrigRlimitNofile atomic.Pointer[syscall.Rlimit] | ||
|
|
||
| // ClearRlimitNofileCache is to clear go runtime's nofile rlimit cache. | ||
| func ClearRlimitNofileCache() { | ||
| // As reported in issue #4195, the new version of go runtime(since 1.19) | ||
| // will cache rlimit-nofile. Before executing execve, the rlimit-nofile | ||
| // of the process will be restored with the cache. In runc, this will | ||
| // cause the rlimit-nofile setting by the parent process for the container | ||
| // to become invalid. It can be solved by clearing this cache. But | ||
| // unfortunately, go stdlib doesn't provide such function, so we need to | ||
| // link to the private var `origRlimitNofile` in package syscall to hack. | ||
| syscallOrigRlimitNofile.Store(nil) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| //go:build !go1.19 | ||
|
|
||
| package system | ||
|
|
||
| func ClearRlimitNofileCache() { | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| #!/usr/bin/env bats | ||
|
|
||
| load helpers | ||
|
|
||
| function setup() { | ||
| # Do not change the Cur value to be equal to the Max value | ||
| # Because in some environments, the soft and hard nofile limit have the same value. | ||
| [ $EUID -eq 0 ] && prlimit --nofile=1024:65536 -p $$ | ||
| setup_busybox | ||
| } | ||
|
|
||
| function teardown() { | ||
| teardown_bundle | ||
| } | ||
|
|
||
| # Set and check rlimit_nofile for runc run. Arguments are: | ||
| # $1: soft limit; | ||
| # $2: hard limit. | ||
| function run_check_nofile() { | ||
| soft="$1" | ||
| hard="$2" | ||
| update_config ".process.rlimits = [{\"type\": \"RLIMIT_NOFILE\", \"soft\": ${soft}, \"hard\": ${hard}}]" | ||
| update_config '.process.args = ["/bin/sh", "-c", "ulimit -n; ulimit -H -n"]' | ||
|
|
||
| runc run test_rlimit | ||
| [ "$status" -eq 0 ] | ||
| [[ "${lines[0]}" == "${soft}" ]] | ||
| [[ "${lines[1]}" == "${hard}" ]] | ||
| } | ||
|
|
||
| # Set and check rlimit_nofile for runc exec. Arguments are: | ||
| # $1: soft limit; | ||
| # $2: hard limit. | ||
| function exec_check_nofile() { | ||
| soft="$1" | ||
| hard="$2" | ||
| update_config ".process.rlimits = [{\"type\": \"RLIMIT_NOFILE\", \"soft\": ${soft}, \"hard\": ${hard}}]" | ||
|
|
||
| runc run -d --console-socket "$CONSOLE_SOCKET" test_rlimit | ||
| [ "$status" -eq 0 ] | ||
|
|
||
| runc exec test_rlimit /bin/sh -c "ulimit -n; ulimit -H -n" | ||
| [ "$status" -eq 0 ] | ||
| [[ "${lines[0]}" == "${soft}" ]] | ||
| [[ "${lines[1]}" == "${hard}" ]] | ||
| } | ||
|
|
||
| @test "runc run with RLIMIT_NOFILE(The same as system's hard value)" { | ||
| hard=$(ulimit -n -H) | ||
| soft="$hard" | ||
| run_check_nofile "$soft" "$hard" | ||
| } | ||
|
|
||
| @test "runc run with RLIMIT_NOFILE(Bigger than system's hard value)" { | ||
| requires root | ||
| limit=$(ulimit -n -H) | ||
| soft=$((limit + 1)) | ||
| hard=$soft | ||
| run_check_nofile "$soft" "$hard" | ||
| } | ||
|
|
||
| @test "runc run with RLIMIT_NOFILE(Smaller than system's hard value)" { | ||
| limit=$(ulimit -n -H) | ||
| soft=$((limit - 1)) | ||
| hard=$soft | ||
| run_check_nofile "$soft" "$hard" | ||
| } | ||
|
|
||
| @test "runc exec with RLIMIT_NOFILE(The same as system's hard value)" { | ||
| hard=$(ulimit -n -H) | ||
| soft="$hard" | ||
| exec_check_nofile "$soft" "$hard" | ||
| } | ||
|
|
||
| @test "runc exec with RLIMIT_NOFILE(Bigger than system's hard value)" { | ||
| requires root | ||
| limit=$(ulimit -n -H) | ||
| soft=$((limit + 1)) | ||
| hard=$soft | ||
| exec_check_nofile "$soft" "$hard" | ||
| } | ||
|
|
||
| @test "runc exec with RLIMIT_NOFILE(Smaller than system's hard value)" { | ||
| limit=$(ulimit -n -H) | ||
| soft=$((limit - 1)) | ||
| hard=$soft | ||
| exec_check_nofile "$soft" "$hard" | ||
| } |