oom_score_adj must be in the range -1000 to 1000. In AdjustOOMScore if containerd's score is already at the maximum value we should set that value for the shim instead of trying to set 1001 which is invalid.
Signed-off-by: Simon Kaegi <simon_kaegi@ca.ibm.com>
GitHub Actions process wrapper sets score adj to 500 for any process;
the OOM score adj test expected default adj to be 0 during test.
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
Dependencies may be switching to use the new `%w` formatting
option to wrap errors; switching to use `errors.Is()` makes
sure that we are still able to unwrap the error and detect the
underlying cause.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Given that we're only interested in detecting if userns is
enabled, and no further details about the mapping, we can
revert this function to go back to its original implementation
in github.com/lxc/lxd/shared/util.go
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
After e115b52ce2 was merged, this
function was no longer in use, so we should be able to remove it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
It was only used in sys/reaper, and after moving it, that package
no longer depends on the `sys` package.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
forkAndMountat forks a process to chdir then mount layers. Signals are
blocked (using runtime_beforeFork) during fork.
There is a race condition that the child process finishes before the
parent process is scheduled and can unblock signal handling. The SIGCHLD
signal sent from the finished process may have been delivered to the
shim process's reaper thread and caused the parent process fail with
ECHLD error.
This patch sets up a pipe for communication between child and parent
instead of waiting for child exit status.
Fixes#4009.
Signed-off-by: Haitao Li <hli@atlassian.com>
- preserve `syscall.ENOTDIR` to match os.MkDirAll
- change back parameter name to `adminAndLocalSystem`
- revert accidental change of permissions of parent-dir
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Fix `buildkitd --group GROUP` issue when `/run/buildkit` already exists
and is owned by the root.
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Auto-detect longest common dir in lowerdir option and compact it if the
option size is hitting one page size. If does, Use chdir + CLONE to do
mount thing to avoid hitting one page argument buffer in linux kernel
mount.
Signed-off-by: Wei Fu <fhfuwei@163.com>
This allows non-privileged users to use containerd.
If a non root user tried to set a negative oom score adjustment,
it will fail. Containerd should not fail if running rootless.
This is part of a larger track of work integrating containerd
into Cloudfoundry's garden with support for rootless.
[#156343443]
Signed-off-by: Danail Branekov <danailster@gmail.com>
Given these same exact functions are both now available in
opencontainers/runc (libcontainer/system) package, and we only use the
`SetSubreaper` today from the shim, there seems to be no reason for
duplication.
Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com>
This linter checks for unnecessary type convertions.
Some convertions are whitelisted because their type is different
on 32bit platforms
Signed-off-by: Daniel Nephin <dnephin@gmail.com>
gometalinter runs linters in parallel for faster linting
it provides a uniform way of whitelisting lines using // nolint or the exclude
field in the config
Signed-off-by: Daniel Nephin <dnephin@gmail.com>
Use unix.Prctl() instead of manually reimplementing it using
unix.RawSyscall. Also use unix.PR_SET_CHILD_SUBREAPER
unix.PR_GET_CHILD_SUBREAPER instead of locally defining them.
Also fix the package name form 'osutils' to 'sys' in the package level
comment.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
