There used to be a race condition while creating the cgroup hierarchy:
if a parent directory was created after .exists() but before
.create_dir, the function failed unnecessarily.
This commit changes the function to use create_dir_all, which is the
atomic variant of the above pattern, and fixes some surrounding
docstrings on the way.
Signed-off-by: Markus Rudy <mr@edgeless.systems>
Fixed an error hidden during the creation of cgroup,
which resulted in subsequent error propagation
Signed-off-by: jokemanfire <hu.dingyang@zte.com.cn>
The systemd version is purely informational and should not be parsed, as
documented in the [1]. In practice, systemd version has different formats
on OpenShift and Ubuntu.
This commit skips the version check and allows all operations. The errors
will be thrown from dbus when performing unsupported operations on obsolete
versions of systemd.
1: https://www.freedesktop.org/software/systemd/man/latest/org.freedesktop.systemd1.html
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
The tests cover the methods of `conv` mod, `FsManager`, and
`SystemdManager`. Since we have to manipulate the cgroups during testing,
the tests related to this part are set to be run in sequence.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
The tests cover `SystemdClient` and methods from `utils` mods.
Please note that the `SystemdClient` tests do not run well in parallel, but
work well in sequence. Please run them with `--test-threads=1`.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
Systemd manager takes cgroups path in the format of
"parent:scope_prefix:name" to create and manipulate cgroups through
systemd. It does value conversions for resources defined in the Linux
resources from the OCI spec, such as CPU quota, period, etc.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
`SystemdCgroup` takes a `parent`, which is the name of a slice, and a
`unit`, which is the name of a slice or a scope unit, and provides methods
to start, kill the unit, as well as set properties for the unit.
The mods, `cpu`, `memory`, `cpuset`, and `pids`, are designed to generate
properties quickly. It hides the difference between cgroups v1 and v2, and
does simple checks for the systemd version and arguments.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
`Manager` is a trait to unify the interface of cgroups. It is designed for
OCI containers. Its `set()` takes Linux resources of the OCI spec to set
cgroups.
The `FsManager`, the concrete implementation of `Manager`, manipulates
cgroups through cgroupfs, and supports both cgroups v1 and v2.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
Prepare to implement FsManager, which should be done in the following-up
commits. Apart from that, no code is not modified.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
Most of the issues are small, but `fold()`. The usage of `fold()` in these
cases confuses me a lot, so that I don't follow the sugguestions from
clippy to replace `fold()` with `try_fold()`. Instead, I replace them with
`map() + collect()`.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
This removes the only place the regex crate is used, which could lead to significant binary size savings in projects that don't use the regex craate.
Signed-off-by: Oguz Bilgener <oguz@bilgener.me>
The documentation in the hierarchies module is outdated, this project
does support cgroups2 and the unified hierarchy :)
Signed-off-by: Michel Heily <michelheily@gmail.com>
I'm not fmiliar with this crate, so let's just ignore the warning for
now instead of removing the code.
Signed-off-by: Fabiano Fidêncio <fidencio@northflank.com>
Path of cgroup is wrong when running a container in a container. Use
the root path of mountinfo fetched from /proc/$(shim_pid)/mountinfo
to trim the path obtained from /proc/self/mountinfo.
Fixes: #131
Signed-off-by: 乔琛 10307740 <qiao.chen@zte.com.cn>
In older kernel versions (tested with 5.10.208), the cgroup.controllers
files ends with a newline. This newline is not trimmed and as such the
application later can incorrectly consider that the last controller is not
supported
When compiling for a musl target, use the same CGROUP2_SUPER_MAGIC
constant that we use for other linux targets
Signed-off-by: Andrés Medina <andresnrx@gmail.com>
When setting memory.max/memory.swap.max in cgroup v2, Linux uses "max"
instead of "-1" to indicate no restriction on memory usage. The
set_limit and set_memswap_limit functions of the memory controller
accept i64 as a parameter. In cgroupv2, if the parameter is -1, "max"
should be written into the cgroup file.
Fixes#128
Signed-off-by: mengze <mengze@linux.alibaba.com>
Kernel 5.19 introduces `memory.peak` and kernel 6.5 introduces
`memory.swap.peak` to expose the memory and swap usage watermark.
This change use these values to fill `max_usage_in_bytes`.
Signed-off-by: HeRaNO <heran55@126.com>
The changes include:
- Expose `create()` and add `exists()` for `Cgroup`: The changes
are allowed to load cgroup and test if the cgroup exists. If not exists,
performing the `create()` directly to avoid performing `new()`.
- Make path of devices cgroup error more details: The origin path is
either `devices.allow` or `devices.deny`. It not shows which cgroup it
belongs to.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
The cgroup-rs should throw errors while setting devices cgroup if the rule
is invalid. For example, if a cgroup has permissions of some devices. Then
we set a `a *:* rwm` to its parent's `devices.deny`. An error should be
thrown to make users realize that it is a invalid rule.
Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
Determine the cgroup mode in add_task() to avoid the wrong operation of the caller writing threads to cgroup.threads in non-thread mode.
Fixes: #103
Signed-off-by: yaoyinnan <yaoyinnan@foxmail.com>
Some system has the `Discard` field in io service data, current the
library can't handle it correctly.
With this commit the blkio can get metrics whether it has the discard field.
Fixes: #109
Signed-off-by: bin liu <liubin0329@gmail.com>
Fixes: #98
Add a Kill method for cgroups v2. This uses the new functionality in
kernels 5.14+ where writing to a cgroup.kill file will send a SIGKILL
to every process running in the cgroup. This would be useful for
kata to avoid freezing+manually sending SIGKILL+thawing process it
does currently to emulate runc's behavior.
Signed-off-by: Danny Canter <danny@dcantah.dev>
Support to set threaded mode in cgroup v2. The premise of switching to threaded mode is that only the cgroup of cpuset, cpu and pids is supported.
Fixes: #90
Signed-off-by: yaoyinnan <yaoyinnan@foxmail.com>
For some cgroup file operations, when failed, add the path
and the value (for write operation) to the error message.
Fixes: #93
Signed-off-by: bin liu <liubin0329@gmail.com>
