Commit Graph

4285 Commits

Author SHA1 Message Date
Kir Kolyshkin ca1d135bd4 runc checkpoint: fix --status-fd to accept fd
1. The command `runc checkpoint --lazy-server --status-fd $FD` actually
accepts a file name as an $FD. Make it accept a file descriptor,
like its name implies and the documentation states.

In addition, since runc itself does not use the result of CRIU status
fd, remove the code which relays it, and pass the FD directly to CRIU.

Note 1: runc should close this file descriptor itself after passing it
to criu, otherwise whoever waits on it might wait forever.

Note 2: due to the way criu swrk consumes the fd (it reopens
/proc/$SENDER_PID/fd/$FD), runc can't close it as soon as criu swrk has
started. There is no good way to know when criu swrk has reopened the
fd, so we assume that as soon as we have received something back, the
fd is already reopened.

2. Since the meaning of --status-fd has changed, the test case using
it needs to be fixed as well.

Modify the lazy migration test to remove "sleep 2", actually waiting
for the the lazy page server to be ready.

While at it,

 - remove the double fork (using shell's background process is
   sufficient here);

 - check the exit code for "runc checkpoint" and "criu lazy-pages";

 - remove the check for no errors in dump.log after restore, as we
   are already checking its exit code.

[v2: properly close status fd after spawning criu]
[v3: move close status fd to after the first read]

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-11 15:36:50 -07:00
Kir Kolyshkin 2c8d668eee
Merge pull request #2387 from kolyshkin/g-knot-prepare
cgroup refactoring

LGTMs: AkihiroSuda, mrunalp.
2020-05-08 12:03:22 -07:00
Kir Kolyshkin 1d143562d2 libct/cgroups/fs: access m.paths under lock
1. Prevent theoretical "concurrent map access" error to m.paths.

2. There is no need to call m.Paths -- we can access m.paths directly.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:09:55 -07:00
Kir Kolyshkin 51e1a0842d libct/cgroups/systemd/v1: privatize v1 manager
This patch was generated entirely by gorename -- nothing to review here.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:09:48 -07:00
Kir Kolyshkin d827e323b0 libct/cgroups/systemd/v1: add NewLegacyManager
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:07:40 -07:00
Kir Kolyshkin fc620fdf81 libct/cgroups/fs: privatize Manager and its fields
This was generated entirely by gorename -- nothing to review here.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:07:00 -07:00
Kir Kolyshkin 5935bf8c21 libct/cgroups/fs: introduce NewManager()
...and use it from libcontainer/factory_linux.go.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:06:05 -07:00
Kir Kolyshkin 24f945e08d libct/cgroups/systemd/v2: return a public interface
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:06:02 -07:00
Kir Kolyshkin 63854b0ea8 newSetnsProcess: reuse state.CgroupPaths
c.cgroupManager.GetPaths() are called twice here: once in currentState()
and then in newSetnsProcess(). Reuse the result of the first call, which
is stored into state.CgroupPaths.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:05:59 -07:00
Kir Kolyshkin 9a3e632625 notify: simplify usage
Instead of passing the whole map of paths, pass the path to the memory
controller which these functions actually require.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-08 10:05:58 -07:00
Aleksa Sarai 6621af89e5
merge branch 'pr-2381'
Alice Frosi (3):
  epbf: update github.com/cilium/ebpf
  test: update devicefilter tests
  ebpf: fix big endian issue for s390x

LGTMs: @AkihiroSuda @cyphar
Closes #2381
2020-05-09 00:05:18 +10:00
Alice Frosi 828e4ad89d epbf: update github.com/cilium/ebpf
Update ebpf to include PR https://github.com/cilium/ebpf/pull/91.
The update is needed to fix #2316.

Signed-off-by: Alice Frosi <afrosi@de.ibm.com>
2020-05-08 14:20:19 +02:00
Alice Frosi b18a9650f8 test: update devicefilter tests
The test cases need to take into account the assembly modifications.
The instruction:
	LdXMemH dst: r2 src: r1 off: 0 imm: 0
has been replaced with:
        LdXMemW dst: r2 src: r1 off: 0 imm: 0
        And32Imm dst: r2 imm: 65535

Signed-off-by: Alice Frosi <afrosi@de.ibm.com>
2020-05-08 07:31:05 +01:00
Alice Frosi 128cb60f58 ebpf: fix big endian issue for s390x
Load the full 32 bits word and take the lower 16 bits, instead of
reading just 16 bits.

Same fix as 07bae05e61

Signed-off-by: Alice Frosi <afrosi@de.ibm.com>
2020-05-08 07:31:05 +01:00
Kir Kolyshkin 2b31437caa
Merge pull request #2281 from AkihiroSuda/rootless-systemd
cgroup v2: support rootless systemd

LGTMs: kolyshkin, mrunalp
2020-05-07 21:45:52 -07:00
Mrunal Patel 47a7343182
Merge pull request #2373 from kolyshkin/logging-nits
Logging nits
2020-05-07 20:54:49 -07:00
Akihiro Suda 492cfd8bf9
Merge pull request #2352 from lifubang/eventsv2
fix runc events error in cgroup v2
2020-05-08 12:51:05 +09:00
Akihiro Suda bf15cc99b1 cgroup v2: support rootless systemd
Tested with both Podman (master) and Moby (master), on Ubuntu 19.10 .

$ podman --cgroup-manager=systemd run -it --rm --runtime=runc \
  --cgroupns=host --memory 42m --cpus 0.42 --pids-limit 42 alpine
/ # cat /proc/self/cgroup
0::/user.slice/user-1001.slice/user@1001.service/user.slice/libpod-132ff0d72245e6f13a3bbc6cdc5376886897b60ac59eaa8dea1df7ab959cbf1c.scope
/ # cat /sys/fs/cgroup/user.slice/user-1001.slice/user@1001.service/user.slice/libpod-132ff0d72245e6f13a3bbc6cdc5376886897b60ac59eaa8dea1df7ab959cbf1c.scope/memory.max
44040192
/ # cat /sys/fs/cgroup/user.slice/user-1001.slice/user@1001.service/user.slice/libpod-132ff0d72245e6f13a3bbc6cdc5376886897b60ac59eaa8dea1df7ab959cbf1c.scope/cpu.max
42000 100000
/ # cat /sys/fs/cgroup/user.slice/user-1001.slice/user@1001.service/user.slice/libpod-132ff0d72245e6f13a3bbc6cdc5376886897b60ac59eaa8dea1df7ab959cbf1c.scope/pids.max
42

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-05-08 12:39:20 +09:00
lifubang 657407ff23 fix runc events error in cgroup v2
Signed-off-by: lifubang <lifubang@acmcoder.com>
2020-05-07 22:18:46 +08:00
Kir Kolyshkin 64416d34f3
Merge pull request #2382 from thaJeztah/bump_selinux
vendor: opencontainers/selinux v1.5.1, update deprecated uses
2020-05-06 14:33:00 -07:00
Sebastiaan van Stijn b48bbdd08d
vendor: opencontainers/selinux v1.5.1, update deprecated uses
full diff: https://github.com/opencontainers/selinux/v1.4.0...v1.5.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-05 15:53:40 +02:00
Mrunal Patel a57358e016
Merge pull request #2370 from lifubang/swap0
let runc disable swap in cgroup v2
2020-05-04 16:57:12 -07:00
Kir Kolyshkin 96310f0476
Merge pull request #2377 from thaJeztah/ticks_simplify
Simplify ticks, as the value is a constant
2020-05-04 15:51:31 -07:00
Sebastiaan van Stijn 402d645c5c
Simplify ticks, as the value is a constant
See for example in the Musl libc source code https://git.musl-libc.org/cgit/musl/tree/src/conf/sysconf.c#n29

This removes the cgo dependency for the system package.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-04 23:05:46 +02:00
Akihiro Suda a0ddd02bf3
Merge pull request #2378 from thaJeztah/bump_logrus
vendor: sirupsen/logrus v1.6.0
2020-05-05 02:42:16 +09:00
Mrunal Patel 12ba2a7320
Merge pull request #2380 from thaJeztah/userns_sync_once
libcontainer: RunningInUserNS() use sync.Once
2020-05-04 09:33:42 -07:00
Sebastiaan van Stijn 9df0b5e268
libcontainer: RunningInUserNS() use sync.Once
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-04 15:53:33 +02:00
Sebastiaan van Stijn e8bece65a9
vendor: sirupsen/logrus v1.6.0
full diff: https://github.com/sirupsen/logrus/compare/v1.5.0...v1.6.0

- Add flag to disable quotes in TextFormatter
- Revert "fix race conditions on entry"
    - fixes Deadlock during Entry.Infof after upgrade to v1.5.0
    - fixes Deadlock when using WithField inside of hook
    - fixes Overly-aggressive mutex locks

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-04 02:24:03 +02:00
Mrunal Patel 609ba79f7a
Merge pull request #2371 from kolyshkin/criu314
Use criu 3.14
2020-05-03 09:03:53 -07:00
Mrunal Patel 6161d255b6
Merge pull request #2375 from tedyu/wait-lazy-close
Close fd in case fd.Write() returns error
2020-05-03 09:03:40 -07:00
lifubang a70f354680 let runc disable swap in cgroup v2
In cgroup v2, when memory and memorySwap set to the same value which is greater than zero,
runc should write zero in `memory.swap.max` to disable swap.

Signed-off-by: lifubang <lifubang@acmcoder.com>
2020-05-03 20:57:36 +08:00
Ted Yu db29dce076 Close fd in case fd.Write() returns error
Signed-off-by: Ted Yu <yuzhihong@gmail.com>
2020-05-02 20:06:08 -07:00
Kir Kolyshkin f6439a84cc
Merge pull request #2372 from thaJeztah/improve_error_readability
Improve readability of errors
2020-05-02 18:36:50 -07:00
Kir Kolyshkin 1b84a21c51 Don't print errors twice
Function fatal() and method (*FatalWriter).Write log the error to the
logger when prints it to stderr just be be sure. Since by default the
logger is configured to write to os.Stderr, we get something like this
as a result:

> # ./runc checkpoint xx5
> ERRO[0000] Container cannot be checkpointed in stopped state
> Container cannot be checkpointed in stopped state

or

> # ./runc sdf
> ERRO[0000] No help topic for 'sdf'
> No help topic for 'sdf'

This is very annoying.

To fix, check if logrus is logging into stderr, and if it is, skip
the second write.

After this commit:

> # ./runc sdf
> ERRO[0000] No help topic for 'sdf'

> [root@kir-rhat runc]# ./runc --log=out sdf
> No help topic for 'sdf'

Note that now the logrus prefix might be in or out, depending on whether
logrus is logging to stderr or not. This is not perfect, but better than
the old behavior.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-02 18:13:07 -07:00
Sebastiaan van Stijn 64ca54816c
libcontainer: simplify error message
The error message was including both the rootfs path, and the full
mount path, which also includes the path of the rootfs.

This patch removes the rootfs path from the error message, as it
was redundant, and made the error message overly verbose

Before this patch (errors wrapped for readability):

```
container_linux.go:348: starting container process caused: process_linux.go:438:
container init caused: rootfs_linux.go:58: mounting "/foo.txt"
to rootfs "/var/lib/docker/overlay2/de506d67da606b807009e23b548fec60d72359c77eec88785d8c7ecd54a6e4b2/merged"
at "/var/lib/docker/overlay2/de506d67da606b807009e23b548fec60d72359c77eec88785d8c7ecd54a6e4b2/merged/usr/share/nginx/html"
caused: not a directory: unknown
```

With this patch applied:

```
container_linux.go:348: starting container process caused: process_linux.go:438:
container init caused: rootfs_linux.go:58: mounting "/foo.txt"
to rootfs at "/var/lib/docker/overlay2/de506d67da606b807009e23b548fec60d72359c77eec88785d8c7ecd54a6e4b2/merged/usr/share/nginx/html"
caused: not a directory: unknown
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-03 02:59:46 +02:00
Sebastiaan van Stijn 2adfd20ac9
libcontainer: don't double-quote errors
genericError.Error() was formatting the underlying error using `%q`; as a
result, quotes in underlying errors were escaped multiple times, which
caused the output to become hard to read, for example (wrapped for readability):

```
container_linux.go:345: starting container process caused "process_linux.go:430:
container init caused \"rootfs_linux.go:58: mounting \\\"/foo.txt\\\"
to rootfs \\\"/var/lib/docker/overlay2/f49a0ae0ec6646c818dcf05dbcbbdd79fc7c42561f3684fbb1fc5d2b9d3ad192/merged\\\"
at \\\"/var/lib/docker/overlay2/f49a0ae0ec6646c818dcf05dbcbbdd79fc7c42561f3684fbb1fc5d2b9d3ad192/merged/usr/share/nginx/html\\\"
caused \\\"not a directory\\\"\"": unknown
```

With this patch applied:

```
container_linux.go:348: starting container process caused: process_linux.go:438:
container init caused: rootfs_linux.go:58: mounting "/foo.txt"
to rootfs "/var/lib/docker/overlay2/de506d67da606b807009e23b548fec60d72359c77eec88785d8c7ecd54a6e4b2/merged"
at "/var/lib/docker/overlay2/de506d67da606b807009e23b548fec60d72359c77eec88785d8c7ecd54a6e4b2/merged/usr/share/nginx/html"
caused: not a directory: unknown
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-03 02:55:15 +02:00
Kir Kolyshkin c52a598d74 Remove fatalf()
It was only used in one place, all others are happy with
`fatal(fmt.Errorf())`.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-02 16:19:14 -07:00
Kir Kolyshkin d2061ee5f1 Vagrantfile: install less packages
1. Disable updating the kernel (we're not going to reboot into it
   anyway)

2. Disable weak dependencies (that includes git, svn and a ton of perl
   modules).

3. Add git-core to list of packages since it is used from Makefile.

Before:

    default: Transaction Summary
    default: ================================================================================
    default: Install  123 Packages
    default: Upgrade   63 Packages
    default: Total size: 326 M
    default: Total download size: 326 M

After:

    default: Transaction Summary
    default: ================================================================================
    default: Install  53 Packages
    default: Upgrade  63 Packages
    default: Total size: 181 M
    default: Total download size: 180 M

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-02 14:56:20 -07:00
Kir Kolyshkin e9e31f70fe Vagrantfile: use criu 3.14 from testing
...just to test the new package.

This complexity is temporary: once criu-3.14 will be moved from testing
to stable, this will be removed.

Also remove criu build deps as we're no longer building it from source.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-02 14:18:08 -07:00
Kir Kolyshkin 9634a80ce8 Dockerfile: bump criu to version π (3.14)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-05-02 14:14:34 -07:00
Mrunal Patel dd8d48ede8
Merge pull request #2358 from kolyshkin/fs2-nit
cgroups/fs2: don't always parse /proc/self/cgroup
2020-04-29 08:45:26 -07:00
Kir Kolyshkin c3b0b13fe9 cgroups/fs2: don't always parse /proc/self/cgroup
Function defaultPath always parses /proc/self/cgroup, but
the resulting value is not always used.

Avoid unnecessary reading/parsing by moving the code
to just before its use.

Modify the test case accordingly.

[v2: test: use UnifiedMountpoint, skip test if not on v2]

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2020-04-28 22:16:36 -07:00
Kir Kolyshkin 051d6705a7
Merge pull request #2363 from AkihiroSuda/vagrant-f32
Vagrantfile: use Fedora 32 (and remove unused Podman)

LGTMs: @cyphar @kolyshkin
2020-04-28 22:01:44 -07:00
Akihiro Suda 85c44b190e Vagrantfile: use Fedora 32
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
2020-04-29 12:36:03 +09:00
Akihiro Suda c18485ada6
Merge pull request #2359 from cyphar/terminal-docs-subreaper
docs: terminals: mention subreaper requirement
2020-04-29 10:53:01 +09:00
Kir Kolyshkin 0a4dcc0203
Merge pull request #2331 from lifubang/StartTransientUnit
check that StartTransientUnit/StopUnit succeeds

LGTMs: @AkihiroSuda @kolyshkin 
Closes #2313, #2309
2020-04-28 10:47:52 -07:00
Aleksa Sarai eea0fbfec1
docs: terminals: mention subreaper requirement
I realised that the terminal documentation which covers detached
terminals fails to mention that callers need to make themselves a
subreaper. Probably a good idea to mention this. I've also included a
minor comparison to LXC.

Signed-off-by: Aleksa Sarai <asarai@suse.de>
2020-04-28 22:53:59 +10:00
lifubang bfa1b2aab3 check that StartTransientUnit and StopUnit succeeds
Signed-off-by: lifubang <lifubang@acmcoder.com>
2020-04-28 15:46:28 +08:00
Mrunal Patel 80e2d1f145
Merge pull request #2357 from kolyshkin/makefile-2
Makefile fixes and improvements
2020-04-27 21:21:25 -07:00
Mrunal Patel a1f007e067
Merge pull request #2340 from AkihiroSuda/fix-2339
fs2: fix cgroup.subtree_control EPERM on rootless + add CI
2020-04-27 21:20:23 -07:00