Merge pull request #7783 from inspektor-gadget/qasim/cri-disable-swap

cri: make swapping disabled with memory limit

integration/container_update_resources_test.go

@@ -236,6 +236,13 @@ func TestUpdateContainerResources_MemoryLimit(t *testing.T) {
 	pauseImage := images.Get(images.Pause)
 	EnsureImageExists(t, pauseImage)
 
+	expectedSwapLimit := func(memoryLimit int64) *int64 {
+		if cgroups.Mode() == cgroups.Unified {
+			memoryLimit = 0
+		}
+		return &memoryLimit
+	}
+
 	t.Log("Create a container with memory limit")
 	cnConfig := ContainerConfig(
 		"container",
@@ -253,6 +260,7 @@ func TestUpdateContainerResources_MemoryLimit(t *testing.T) {
 	spec, err := container.Spec(context.Background())
 	require.NoError(t, err)
 	checkMemoryLimit(t, spec, 200*1024*1024)
+	checkMemorySwapLimit(t, spec, expectedSwapLimit(200*1024*1024))
 
 	t.Log("Update container memory limit after created")
 	err = runtimeService.UpdateContainerResources(cn, &runtime.LinuxContainerResources{
@@ -264,6 +272,7 @@ func TestUpdateContainerResources_MemoryLimit(t *testing.T) {
 	spec, err = container.Spec(context.Background())
 	require.NoError(t, err)
 	checkMemoryLimit(t, spec, 400*1024*1024)
+	checkMemorySwapLimit(t, spec, expectedSwapLimit(400*1024*1024))
 
 	t.Log("Start the container")
 	require.NoError(t, runtimeService.StartContainer(cn))
@@ -273,6 +282,8 @@ func TestUpdateContainerResources_MemoryLimit(t *testing.T) {
 	t.Log("Check memory limit in cgroup")
 	memLimit := getCgroupMemoryLimitForTask(t, task)
 	assert.Equal(t, uint64(400*1024*1024), memLimit)
+	swapLimit := getCgroupSwapLimitForTask(t, task)
+	assert.Equal(t, uint64(400*1024*1024), swapLimit)
 
 	t.Log("Update container memory limit after started")
 	err = runtimeService.UpdateContainerResources(cn, &runtime.LinuxContainerResources{
@@ -284,10 +295,14 @@ func TestUpdateContainerResources_MemoryLimit(t *testing.T) {
 	spec, err = container.Spec(context.Background())
 	require.NoError(t, err)
 	checkMemoryLimit(t, spec, 800*1024*1024)
+	checkMemorySwapLimit(t, spec, expectedSwapLimit(800*1024*1024))
 
 	t.Log("Check memory limit in cgroup")
 	memLimit = getCgroupMemoryLimitForTask(t, task)
 	assert.Equal(t, uint64(800*1024*1024), memLimit)
+	swapLimit = getCgroupSwapLimitForTask(t, task)
+	assert.Equal(t, uint64(800*1024*1024), swapLimit)
+
 }
 
 func TestUpdateContainerResources_StatusUpdated(t *testing.T) {

pkg/cri/opts/spec_linux.go

@@ -448,6 +448,10 @@ func WithResources(resources *runtime.LinuxContainerResources, tolerateMissingHu
 		}
 		if limit != 0 {
 			s.Linux.Resources.Memory.Limit = &limit
+			// swap/memory limit should be equal to prevent container from swapping by default
+			if swapLimit == 0 {
+				s.Linux.Resources.Memory.Swap = &limit
+			}
 		}
 		if swapLimit != 0 {
 			s.Linux.Resources.Memory.Swap = &swapLimit

pkg/cri/sbserver/container_update_resources_linux_test.go

@@ -70,7 +70,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),
@@ -113,7 +116,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),
@@ -151,7 +157,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),
@@ -197,7 +206,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),

pkg/cri/server/container_update_resources_linux_test.go

@@ -70,7 +70,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),
@@ -113,7 +116,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),
@@ -151,7 +157,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),
@@ -197,7 +206,10 @@ func TestUpdateOCILinuxResource(t *testing.T) {
 				Process: &runtimespec.Process{OOMScoreAdj: oomscoreadj},
 				Linux: &runtimespec.Linux{
 					Resources: &runtimespec.LinuxResources{
-						Memory: &runtimespec.LinuxMemory{Limit: proto.Int64(54321)},
+						Memory: &runtimespec.LinuxMemory{
+							Limit: proto.Int64(54321),
+							Swap:  proto.Int64(54321),
+						},
 						CPU: &runtimespec.LinuxCPU{
 							Shares: proto.Uint64(4444),
 							Quota:  proto.Int64(5555),