[CI/fedora] found more than one filter (2) attached to a cgroup

[kolyshkin]

On GHA CI, Fedora:

=== RUN   TestCheckpoint
time="2021-06-01T20:24:09Z" level=warning msg="found more than one filter (2) attached to a cgroup -- removing extra filters!"
--- PASS: TestCheckpoint (0.82s)

I thought we'd never see this warning; looks suspicious to me.

[cyphar]

Was this happening regularly, or is it a flaky issue? I don't see it in the CI for #2986 (where I added some debugging info to try to figure out what's going on here).

[kolyshkin]

OK, I think that was a flake, related to checkpoint/restore. The cause of it might be the container being restored into the same cgroup it was checkpointed from, which might not have been fully removed by the restore time.

Now, why the cgroup was allegedly not removed is not clear to me.

To debug, we can add a check that the cgroup is present before creating it. In fact, it might make sense to print a warning in such a case (except when a few containers are sharing the same cgroup... but there's no notion for it in runtime spec).

Tried to reproduce this locally:

$ cd libcontainer/integration
$ go test -c .
$ sudo ./integration.test -test.v -test.run Checkpoint -test.count 1200
=== RUN   TestUsernsCheckpoint
--- PASS: TestUsernsCheckpoint (0.62s)
=== RUN   TestCheckpoint
--- PASS: TestCheckpoint (0.49s)
=== RUN   TestUsernsCheckpoint
--- PASS: TestUsernsCheckpoint (0.51s)
....

but it works just fine (i.e. I was not able to reproduce that).

[kolyshkin]

This might be different but I am seeing the same warning from the test added by #3000

[cyphar]

I think the warning is coming from the the lack of BPF_F_REPLACE flag which I have a fix for in #2986 -- if you run update more than once you'll end up with more than one program, triggering the warning.