summaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
authorgVisor bot <gvisor-bot@google.com>2021-02-23 00:02:30 +0000
committergVisor bot <gvisor-bot@google.com>2021-02-23 00:02:30 +0000
commit9b511d5b59e06c72967f16f1e8ac23b99ce71560 (patch)
tree6afcc42dc5c650ff5586a7012268f195fe351e28
parentf98283501eed31a3bd941e5215a1453e16801ace (diff)
parent34e2cda9ad6a20861844776abfbb45052d20c3fa (diff)
Merge release-20210208.0-82-g34e2cda9a (automated)
-rw-r--r--runsc/cgroup/cgroup.go11
-rw-r--r--runsc/container/container.go5
2 files changed, 15 insertions, 1 deletions
diff --git a/runsc/cgroup/cgroup.go b/runsc/cgroup/cgroup.go
index 797c1c2bc..ac9e4e3a8 100644
--- a/runsc/cgroup/cgroup.go
+++ b/runsc/cgroup/cgroup.go
@@ -32,6 +32,7 @@ import (
"github.com/cenkalti/backoff"
specs "github.com/opencontainers/runtime-spec/specs-go"
+ "golang.org/x/sys/unix"
"gvisor.dev/gvisor/pkg/cleanup"
"gvisor.dev/gvisor/pkg/log"
)
@@ -59,6 +60,16 @@ var controllers = map[string]config{
"systemd": {ctrlr: &noop{}},
}
+// IsOnlyV2 checks whether cgroups V2 is enabled and V1 is not.
+func IsOnlyV2() bool {
+ var stat unix.Statfs_t
+ if err := unix.Statfs(cgroupRoot, &stat); err != nil {
+ // It's not used for anything important, assume not V2 on failure.
+ return false
+ }
+ return stat.Type == unix.CGROUP2_SUPER_MAGIC
+}
+
func setOptionalValueInt(path, name string, val *int64) error {
if val == nil || *val == 0 {
return nil
diff --git a/runsc/container/container.go b/runsc/container/container.go
index aae64ae1c..40812efb8 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -230,7 +230,6 @@ func New(conf *config.Config, args Args) (*Container, error) {
if args.Spec.Linux.CgroupsPath == "" && !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot {
args.Spec.Linux.CgroupsPath = "/" + args.ID
}
-
// Create and join cgroup before processes are created to ensure they are
// part of the cgroup from the start (and all their children processes).
cg, err := cgroup.New(args.Spec)
@@ -238,6 +237,10 @@ func New(conf *config.Config, args Args) (*Container, error) {
return nil, err
}
if cg != nil {
+ // TODO(gvisor.dev/issue/3481): Remove when cgroups v2 is supported.
+ if !conf.Rootless && cgroup.IsOnlyV2() {
+ return nil, fmt.Errorf("cgroups V2 is not yet supported. Enable cgroups V1 and retry")
+ }
// If there is cgroup config, install it before creating sandbox process.
if err := cg.Install(args.Spec.Linux.Resources); err != nil {
switch {