oci: make sure cgroupns is enabled if supported #4003
Conversation
Signed-off-by: Tonis Tiigi <[email protected]>
| @@ -139,3 +146,12 @@ func getTracingSocketMount(socket string) specs.Mount { | |||
| func getTracingSocket() string { | |||
| return fmt.Sprintf("unix://%s", tracingSocketPath) | |||
| } | |||
|
|
|||
| func cgroupNamespaceSupported() bool { | |||
There was a problem hiding this comment.
Moby, containerd, etc. disables cgroup namespace on cgroup v1 regardless to kernel version/config.
There was a problem hiding this comment.
Where is this done? In Runc code I see it checks ns existence for both cgroup versions.
https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_linux.go#L268
There was a problem hiding this comment.
There was a problem hiding this comment.
Iiuc this means privileged containers get host cgroups on v1? Is this what you mean and we should replicate it for --security=insecure. I don't quite see how it makes sense though to have different behaviour for privileged containers based on group versions.
There was a problem hiding this comment.
Also see these consts in moby https://github.com/moby/moby/blob/462d6ef826861fad021fb565c0481fb61d2db6bc/daemon/config/config_linux.go#L23-L27 now used in https://github.com/moby/moby/blob/462d6ef826861fad021fb565c0481fb61d2db6bc/daemon/config/config_linux.go#L189-L193. So if not v2 then always set host mode.
Signed-off-by: Tonis Tiigi <[email protected]>
|
@AkihiroSuda Merging for v0.12 rc2. Lmk if you think any follow-ups are needed. |
|
LGTM |
This is not set by default by containerd default spec but needed for the cgroup mounts to be scoped to the ID by runc.
closes #3985