Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
Support cgroups with limits as rootless #1540
Following on from the rootless cgroups discussion in #1457, this PR provides an initial implementation for rootless cgroups that fulfils Garden's needs. This does not enable all cgroup related functiionality, but we think it's a good starting point for other currently disabled features to work.
In more detail, this PR removes the current rootless cgroup implementation, and using cgroups in rootless mode should now work broadly the same as rootful, providing that runc has permissions on the cgroup path.
Differences with Rootful
Typically, without permissions on the cgroup path, we would expect an error when
The devices cgroup doesn't have all functionality available for setting limits. This is because there is a requirement on
We haven't enabled OOM notification or Memory pressure notificiation but this is hopefully as simple as removing the rootless conditional:
We haven't enabled CRIU features because we aren't familiar with what is required.
The BATS added seem to cover the right features, however, we aren't super happy with the changes to the Makefile. Thoughts on how to solve the requirement that a cgroup exists, chowned to rootless in a nicer way would be much appreciated.
Signed-off-by: Ed King firstname.lastname@example.org
Just to be clear, I'm very impressed that there were only two changes necessary to make the
I'll look over the limitations you've listed when I get a chance.
We've rebased and pushed a few changes, specifically:
Hopefully that addresses most of the comments. We can also squash the additional commits if that'd be preferred.
We've rebased on master and taken a stab at updating this PR's tests to fit the new
Here's a brief overview of the changes since last push:
cyphar left a comment
Here's my comments. They are very minor, and I will do my final review when I get back from OSS (and I have a chance to play with it some more). Overall it looks pretty great, thanks!
Okay, the one thing left is the notification scheme for OOM and memory pressure. Effectively I think that we should not allow someone to register for notifications if we did not join a cgroup (and inherited the original cgroups) -- so we'd have to save somewhere whether the cgroup manager (silently) failed to setup cgroups.
I'll work on this after we merge this, since it's not a blocker IMO.