Merge pull request #150 from Tim-Zhang/release-v0.4.0

release: v0.4.0

Cargo.toml

@@ -5,7 +5,7 @@ repository = "https://github.com/kata-containers/cgroups-rs"
 keywords = ["linux", "cgroup", "containers", "isolation"]
 categories = ["os", "api-bindings", "os::unix-apis"]
 license = "MIT OR Apache-2.0"
-version = "0.3.5"
+version = "0.4.0"
 authors = ["The Kata Containers community <kata-dev@lists.katacontainers.io>", "Levente Kurusa <lkurusa@acm.org>", "Sam Wilson <tecywiz121@hotmail.com>"]
 edition = "2018"
 homepage = "https://github.com/kata-containers/cgroups-rs"
@@ -17,9 +17,15 @@ nix = { version = "0.25.0", default-features = false, features = ["event", "fs",
 libc = "0.2"
 serde = { version = "1.0", features = ["derive"], optional = true }
 thiserror = "1"
+oci-spec = { version = "0.8.1", optional = true }
+zbus = "5.8"
+bit-vec = "0.6"
 
 [dev-dependencies]
 libc = "0.2.76"
+rand = "0.8"
+nix = "0.25"
 
 [features]
 default = []
+oci = ["oci-spec"]

Makefile

@@ -19,9 +19,37 @@ build: debug
 # Tests and linters
 #
 
-.PHONY: test
-test:
-	cargo test -- --color always --nocapture
+# Tests that manipulate cgroups should run in sequence, so that
+# `--test-threads=1` is used.
+test: test-systemd test-fs-manager test-systemd-manager
+	cargo test --all-features -- --color always \
+	  --nocapture \
+	  --skip systemd::dbus::client::tests \
+	  --skip manager::fs::tests \
+	  --skip manager::systemd::tests
+
+.PHONY: test-systemd
+# Tests that manipulate cgroups should run in sequence, so that
+# `--test-threads=1` is used.
+test-systemd:
+	cargo test --package cgroups-rs --lib \
+	    -- systemd::dbus::client::tests \
+	    --color always --nocapture \
+		--test-threads=1
+
+.PHONY: test-fs-manager
+# See test-systemd
+test-fs-manager:
+	cargo test --all-features --package cgroups-rs \
+		--lib -- manager::fs::tests \
+		--color always --nocapture --test-threads=1
+
+.PHONY: test-systemd-manager
+# See test-systemd
+test-systemd-manager:
+	cargo test --all-features --package cgroups-rs \
+	  --lib -- manager::systemd::tests \
+	  --color always --nocapture --test-threads=1
 
 .PHONY: check
 check: fmt clippy

src/fs/blkio.rs

@@ -11,11 +11,11 @@
 use std::io::Write;
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::{read_string_from, read_u64_from};
-use crate::{
+use crate::fs::{read_string_from, read_u64_from};
+use crate::fs::{
     BlkIoResources, ControllIdentifier, ControllerInternal, Controllers, CustomizedAttribute,
     Resources, Subsystem,
 };
@@ -829,9 +829,9 @@ impl BlkIoController {
 impl CustomizedAttribute for BlkIoController {}
 #[cfg(test)]
 mod test {
-    use crate::blkio::{parse_blkio_data, BlkIoData};
-    use crate::blkio::{parse_io_service, parse_io_service_total, IoService};
-    use crate::error::*;
+    use crate::fs::blkio::{parse_blkio_data, BlkIoData};
+    use crate::fs::blkio::{parse_io_service, parse_io_service_total, IoService};
+    use crate::fs::error::*;
 
     static TEST_VALUE: &str = "\
 8:32 Read 4280320

src/fs/cgroup.rs

@@ -6,11 +6,11 @@
 
 //! This module handles cgroup operations. Start here!
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::hierarchies::V1;
-use crate::{CgroupPid, ControllIdentifier, Controller, Hierarchy, Resources, Subsystem};
+use crate::fs::hierarchies::V1;
+use crate::fs::{CgroupPid, ControllIdentifier, Controller, Hierarchy, Resources, Subsystem};
 
 use std::collections::HashMap;
 use std::convert::From;
@@ -51,7 +51,7 @@ impl Clone for Cgroup {
     fn clone(&self) -> Self {
         Cgroup {
             subsystems: self.subsystems.clone(),
-            hier: crate::hierarchies::auto(),
+            hier: crate::fs::hierarchies::auto(),
             path: self.path.clone(),
             specified_controllers: None,
         }
@@ -62,7 +62,7 @@ impl Default for Cgroup {
     fn default() -> Self {
         Cgroup {
             subsystems: Vec::new(),
-            hier: crate::hierarchies::auto(),
+            hier: crate::fs::hierarchies::auto(),
             path: "".to_string(),
             specified_controllers: None,
         }

src/fs/cgroup_builder.rs

@@ -16,10 +16,10 @@
 //! by a call to `build()`.
 //!
 //! ```rust,no_run
-//! # use cgroups_rs::*;
-//! # use cgroups_rs::devices::*;
-//! # use cgroups_rs::cgroup_builder::*;
-//! let h = cgroups_rs::hierarchies::auto();
+//! # use cgroups_rs::fs::*;
+//! # use cgroups_rs::fs::devices::*;
+//! # use cgroups_rs::fs::cgroup_builder::*;
+//! let h = cgroups_rs::fs::hierarchies::auto();
 //! let cgroup: Cgroup = CgroupBuilder::new("hello")
 //!      .memory()
 //!          .kernel_memory_limit(1024 * 1024)
@@ -60,7 +60,7 @@
 //!      .build(h).unwrap();
 //! ```
 
-use crate::{
+use crate::fs::{
     BlkIoDeviceResource, BlkIoDeviceThrottleResource, Cgroup, DeviceResource, Error, Hierarchy,
     HugePageResource, MaxValue, NetworkPriority, Resources,
 };
@@ -250,9 +250,9 @@ impl DeviceResourceBuilder {
         mut self,
         major: i64,
         minor: i64,
-        devtype: crate::devices::DeviceType,
+        devtype: crate::fs::devices::DeviceType,
         allow: bool,
-        access: Vec<crate::devices::DevicePermissions>,
+        access: Vec<crate::fs::devices::DevicePermissions>,
     ) -> DeviceResourceBuilder {
         self.cgroup.resources.devices.devices.push(DeviceResource {
             allow,

src/fs/cpu.rs

@@ -13,11 +13,11 @@ use std::fs::File;
 use std::io::{Read, Write};
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
-use crate::{parse_max_value, read_i64_from, read_u64_from};
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::{parse_max_value, read_i64_from, read_u64_from};
 
-use crate::{
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, CpuResources, CustomizedAttribute,
     MaxValue, Resources, Subsystem,
 };

src/fs/cpuacct.rs

@@ -10,11 +10,11 @@
 use std::io::Write;
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::{read_string_from, read_u64_from};
-use crate::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::fs::{read_string_from, read_u64_from};
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
 
 /// A controller that allows controlling the `cpuacct` subsystem of a Cgroup.
 ///

src/fs/cpuset.rs

@@ -13,11 +13,11 @@ use log::*;
 use std::io::Write;
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::{read_string_from, read_u64_from};
-use crate::{
+use crate::fs::{read_string_from, read_u64_from};
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, CpuResources, Resources, Subsystem,
 };
 
@@ -591,7 +591,7 @@ impl CpuSetController {
 
 #[cfg(test)]
 mod tests {
-    use crate::cpuset;
+    use crate::fs::cpuset;
     #[test]
     fn test_parse_range() {
         let test_cases = vec![

src/fs/devices.rs

@@ -12,10 +12,10 @@ use std::path::PathBuf;
 
 use log::*;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::{
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, DeviceResource, DeviceResources,
     Resources, Subsystem,
 };

src/fs/events.rs

@@ -12,8 +12,8 @@ use std::path::Path;
 use std::sync::mpsc::{self, Receiver};
 use std::thread;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
 // notify_on_oom returns channel on which you can expect event about OOM,
 // if process died without OOM this channel will be closed.

src/fs/freezer.rs

@@ -11,10 +11,10 @@
 use std::io::{Read, Write};
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
-
-use crate::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::FreezerState;
 
 /// A controller that allows controlling the `freezer` subsystem of a Cgroup.
 ///
@@ -31,17 +31,6 @@ pub struct FreezerController {
     v2: bool,
 }
 
-/// The current state of the control group
-#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
-pub enum FreezerState {
-    /// The processes in the control group are _not_ frozen.
-    Thawed,
-    /// The processes in the control group are in the processes of being frozen.
-    Freezing,
-    /// The processes in the control group are frozen.
-    Frozen,
-}
-
 impl ControllerInternal for FreezerController {
     fn control_type(&self) -> Controllers {
         Controllers::Freezer

src/fs/hierarchies.rs

@@ -11,23 +11,23 @@ use std::fs::File;
 use std::io::{BufRead, BufReader};
 use std::path::{Path, PathBuf};
 
-use crate::blkio::BlkIoController;
-use crate::cpu::CpuController;
-use crate::cpuacct::CpuAcctController;
-use crate::cpuset::CpuSetController;
-use crate::devices::DevicesController;
-use crate::freezer::FreezerController;
-use crate::hugetlb::HugeTlbController;
-use crate::memory::MemController;
-use crate::net_cls::NetClsController;
-use crate::net_prio::NetPrioController;
-use crate::perf_event::PerfEventController;
-use crate::pid::PidController;
-use crate::rdma::RdmaController;
-use crate::systemd::SystemdController;
-use crate::{Controllers, Hierarchy, Subsystem};
+use crate::fs::blkio::BlkIoController;
+use crate::fs::cpu::CpuController;
+use crate::fs::cpuacct::CpuAcctController;
+use crate::fs::cpuset::CpuSetController;
+use crate::fs::devices::DevicesController;
+use crate::fs::freezer::FreezerController;
+use crate::fs::hugetlb::HugeTlbController;
+use crate::fs::memory::MemController;
+use crate::fs::net_cls::NetClsController;
+use crate::fs::net_prio::NetPrioController;
+use crate::fs::perf_event::PerfEventController;
+use crate::fs::pid::PidController;
+use crate::fs::rdma::RdmaController;
+use crate::fs::systemd::SystemdController;
+use crate::fs::{Controllers, Hierarchy, Subsystem};
 
-use crate::cgroup::Cgroup;
+use crate::fs::cgroup::Cgroup;
 
 /// Process mounts information.
 ///

src/fs/hugetlb.rs

@@ -12,11 +12,11 @@ use log::warn;
 use std::io::Write;
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
-use crate::{flat_keyed_to_vec, read_u64_from};
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::{flat_keyed_to_vec, read_u64_from};
 
-use crate::{
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, HugePageResources, Resources, Subsystem,
 };
 

src/fs/memory.rs

@@ -14,14 +14,14 @@ use std::io::Write;
 use std::path::PathBuf;
 use std::sync::mpsc::Receiver;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
-use crate::events;
-use crate::{read_i64_from, read_string_from, read_u64_from};
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
+use crate::fs::events;
+use crate::fs::{read_i64_from, read_string_from, read_u64_from};
 
-use crate::flat_keyed_to_hashmap;
+use crate::fs::flat_keyed_to_hashmap;
 
-use crate::{
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, CustomizedAttribute, MaxValue,
     MemoryResources, Resources, Subsystem,
 };
@@ -1002,7 +1002,7 @@ impl<'a> From<&'a Subsystem> for &'a MemController {
 
 #[cfg(test)]
 mod tests {
-    use crate::memory::{
+    use crate::fs::memory::{
         parse_memory_stat, parse_numa_stat, parse_oom_control, MemoryStat, NumaStat, OomControl,
     };
 

src/fs/net_cls.rs

@@ -10,11 +10,11 @@
 use std::io::Write;
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::read_u64_from;
-use crate::{
+use crate::fs::read_u64_from;
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, NetworkResources, Resources, Subsystem,
 };
 

src/fs/net_prio.rs

@@ -11,11 +11,11 @@ use std::collections::HashMap;
 use std::io::{BufRead, BufReader, Write};
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::read_u64_from;
-use crate::{
+use crate::fs::read_u64_from;
+use crate::fs::{
     ControllIdentifier, ControllerInternal, Controllers, NetworkResources, Resources, Subsystem,
 };
 

src/fs/perf_event.rs

@@ -9,9 +9,9 @@
 //!  [tools/perf/Documentation/perf-record.txt](https://raw.githubusercontent.com/torvalds/linux/master/tools/perf/Documentation/perf-record.txt)
 use std::path::PathBuf;
 
-use crate::error::*;
+use crate::fs::error::*;
 
-use crate::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
 
 /// A controller that allows controlling the `perf_event` subsystem of a Cgroup.
 ///

src/fs/pid.rs

@@ -11,11 +11,11 @@
 use std::io::{Read, Write};
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::read_u64_from;
-use crate::{
+use crate::fs::read_u64_from;
+use crate::fs::{
     parse_max_value, ControllIdentifier, ControllerInternal, Controllers, MaxValue, PidResources,
     Resources, Subsystem,
 };

src/fs/rdma.rs

@@ -10,11 +10,11 @@
 use std::io::Write;
 use std::path::PathBuf;
 
-use crate::error::ErrorKind::*;
-use crate::error::*;
+use crate::fs::error::ErrorKind::*;
+use crate::fs::error::*;
 
-use crate::read_string_from;
-use crate::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::fs::read_string_from;
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
 
 /// A controller that allows controlling the `rdma` subsystem of a Cgroup.
 ///

src/fs/systemd.rs

@@ -7,9 +7,9 @@
 //!
 use std::path::PathBuf;
 
-use crate::error::*;
+use crate::fs::error::*;
 
-use crate::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
+use crate::fs::{ControllIdentifier, ControllerInternal, Controllers, Resources, Subsystem};
 
 /// A controller that allows controlling the `systemd` subsystem of a Cgroup.
 ///

src/manager/conv.rs

@@ -0,0 +1,113 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::manager::error::{Error, Result};
+use crate::{CPU_SHARES_V1_MAX, CPU_WEIGHT_V2_MAX};
+
+// Converts CPU shares, used by cgroup v1, to CPU weight, used by cgroup
+// v2.
+//
+// Cgroup v1 CPU shares has a range of [2^1...2^18], i.e. [2...262144],
+// and the default value is 1024.
+//
+// Cgroup v2 CPU weight has a range of [10^0...10^4], i.e. [1...10000],
+// and the default value is 100.
+pub(crate) fn cpu_shares_to_cgroup_v2(shares: u64) -> u64 {
+    if shares == 0 {
+        return 0;
+    }
+    if shares <= 2 {
+        return 1;
+    }
+    if shares >= CPU_SHARES_V1_MAX {
+        return CPU_WEIGHT_V2_MAX;
+    }
+
+    (((shares - 2) * 9999) / 262142) + 1
+}
+
+// ConvertMemorySwapToCgroupV2Value converts MemorySwap value from OCI spec
+// for use by cgroup v2 drivers. A conversion is needed since
+// Resources.MemorySwap is defined as memory+swap combined, while in cgroup
+// v2 swap is a separate value.
+pub(crate) fn memory_swap_to_cgroup_v2(memswap_limit: i64, mem_limit: i64) -> Result<i64> {
+    // For compatibility with cgroup1 controller, set swap to unlimited in
+    // case the memory is set to unlimited, and swap is not explicitly set,
+    // treating the request as "set both memory and swap to unlimited".
+    if mem_limit == -1 && memswap_limit == 0 {
+        return Ok(-1);
+    }
+
+    // -1 is "max", 0 is "unset", so treat as is
+    if memswap_limit == -1 || memswap_limit == 0 {
+        return Ok(memswap_limit);
+    }
+
+    // Unlimited memory, so treat swap as is.
+    if mem_limit == -1 {
+        return Ok(memswap_limit);
+    }
+
+    // Unset or unknown memory, can't calculate swap.
+    if mem_limit == 0 {
+        return Err(Error::InvalidLinuxResource);
+    }
+
+    // Does not make sense to subtract a negative value.
+    if mem_limit < 0 {
+        return Err(Error::InvalidLinuxResource);
+    }
+
+    // Sanity check.
+    if memswap_limit < mem_limit {
+        return Err(Error::InvalidLinuxResource);
+    }
+
+    Ok(memswap_limit - mem_limit)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::manager::conv::*;
+
+    #[test]
+    fn test_cpu_shares_to_cgroup_v2() {
+        assert_eq!(cpu_shares_to_cgroup_v2(0), 0);
+        assert_eq!(cpu_shares_to_cgroup_v2(1), 1);
+        assert_eq!(cpu_shares_to_cgroup_v2(2), 1);
+        assert_eq!(cpu_shares_to_cgroup_v2(100), 4);
+        assert_eq!(
+            cpu_shares_to_cgroup_v2(CPU_SHARES_V1_MAX),
+            CPU_WEIGHT_V2_MAX
+        );
+        assert_eq!(
+            cpu_shares_to_cgroup_v2(CPU_SHARES_V1_MAX - 1),
+            CPU_WEIGHT_V2_MAX - 1
+        );
+        assert_eq!(cpu_shares_to_cgroup_v2(u64::MAX), CPU_WEIGHT_V2_MAX);
+    }
+
+    #[test]
+    fn test_memory_swap_to_cgroup_v2() {
+        // memory no limit and swap is 0, treat it as no limit
+        assert_eq!(memory_swap_to_cgroup_v2(0, -1).unwrap(), -1);
+        // -1 is "max", 0 is "unset", so treat as is
+        assert_eq!(memory_swap_to_cgroup_v2(-1, 0).unwrap(), -1);
+        assert_eq!(memory_swap_to_cgroup_v2(0, 0).unwrap(), 0);
+
+        // Now swap cannot be 0 or -1
+
+        // Unlimited memory, so treat swap as is.
+        assert_eq!(memory_swap_to_cgroup_v2(100, -1).unwrap(), 100);
+        // Unset or unknown memory, can't calculate swap.
+        assert!(memory_swap_to_cgroup_v2(100, 0).is_err());
+        // Does not make sense to subtract a negative value.
+        assert!(memory_swap_to_cgroup_v2(100, -2).is_err());
+        // Swap + mem < mem
+        assert!(memory_swap_to_cgroup_v2(50, 100).is_err());
+        // Real swap
+        assert_eq!(memory_swap_to_cgroup_v2(200, 100).unwrap(), 100);
+    }
+}

src/manager/error.rs

@@ -0,0 +1,28 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::fs::error::Error as CgroupfsError;
+use crate::systemd::dbus::error::Error as SystemdDbusError;
+use crate::systemd::error::Error as SystemdCgroupError;
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error("invalid argument")]
+    InvalidArgument,
+
+    #[error("invalid linux resource")]
+    InvalidLinuxResource,
+
+    #[error("cgroupfs error: {0}")]
+    Cgroupfs(#[from] CgroupfsError),
+
+    #[error("systemd cgroup error: {0}")]
+    SystemdCgroup(#[from] SystemdCgroupError),
+
+    #[error("systemd dbus error: {0}")]
+    SystemdDbus(#[from] SystemdDbusError),
+}

src/manager/mod.rs

@@ -0,0 +1,113 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+mod error;
+use std::collections::HashMap;
+
+pub use error::{Error, Result};
+mod fs;
+pub use fs::FsManager;
+mod systemd;
+pub use systemd::SystemdManager;
+mod conv;
+
+use oci_spec::runtime::LinuxResources;
+
+use crate::systemd::SLICE_SUFFIX;
+use crate::{CgroupPid, CgroupStats, FreezerState};
+
+/// Check if the cgroups path is a systemd cgroup.
+pub fn is_systemd_cgroup(cgroups_path: &str) -> bool {
+    let parts: Vec<&str> = cgroups_path.split(':').collect();
+    parts.len() == 3 && parts[0].ends_with(SLICE_SUFFIX)
+}
+
+/// Manage cgroups designed for OCI containers.
+pub trait Manager: Send + Sync {
+    /// Add a process specified by its tgid.
+    fn add_proc(&mut self, tgid: CgroupPid) -> Result<()>;
+
+    /// Add a thread specified by its pid.
+    fn add_thread(&mut self, pid: CgroupPid) -> Result<()>;
+
+    /// Get the list of pids joint to the cgroups.
+    fn pids(&self) -> Result<Vec<CgroupPid>>;
+
+    /// Set the freezer cgroup to the specified state.
+    fn freeze(&self, state: FreezerState) -> Result<()>;
+
+    /// Remove the cgroups.
+    fn destroy(&mut self) -> Result<()>;
+
+    /// Set the resources to the cgroups.
+    fn set(&mut self, resources: &LinuxResources) -> Result<()>;
+
+    /// Get the cgroup path.
+    ///
+    /// # Arguments
+    ///
+    /// - `subsystem`: cgroup subsystem, for cgroup v1 the value should not
+    ///   be empty, while for cgroup v2 the only valid value is `None`.
+    fn cgroup_path(&self, subsystem: Option<&str>) -> Result<String>;
+
+    /// Enable CPUs, topdown from root in cgroup hierarchy, this would be
+    /// useful for CPU hotplug in the guest.
+    ///
+    /// The caller should update cgroup resources manually, in particular
+    /// cpuset, after this, in order to use the new CPUs (or avoid using
+    /// offline CPUs).
+    ///
+    /// # Arguments
+    ///
+    /// - `cpus`: online CPUs in the same format with `cat
+    ///   /sys/devices/system/cpu/online`, e.g. "0-3,6-7".
+    fn enable_cpus_topdown(&self, cpus: &str) -> Result<()>;
+
+    /// Get cgroup stats.
+    fn stats(&self) -> CgroupStats;
+
+    /// Get the mappings of subsystems to their relative path. The full
+    /// path would be something like "{mountpoint}/{relative_path}". The
+    /// mappings of mountpoints see "mounts()".
+    fn paths(&self) -> &HashMap<String, String>;
+
+    /// Get the mappings of subsystems to their mountpoints. The full
+    /// path would be something like "{mountpoint}/{relative_path}". The
+    /// mappings of relative paths see "paths()".
+    fn mounts(&self) -> &HashMap<String, String>;
+
+    /// Indicate whether the cgroup manager is using systemd.
+    fn systemd(&self) -> bool;
+
+    /// Indicate whether the cgroup manager is using cgroup v2.
+    fn v2(&self) -> bool;
+}
+
+#[cfg(test)]
+mod tests {
+    pub const MEMORY_512M: i64 = 512 * 1024 * 1024; // 512 MiB
+    pub const MEMORY_1G: i64 = 1024 * 1024 * 1024; // 1 GiB
+    pub const MEMORY_2G: i64 = 2 * 1024 * 1024 * 1024; // 2 GiB
+
+    #[macro_export]
+    macro_rules! skip_if_cgroups_v1 {
+        () => {
+            if !$crate::fs::hierarchies::is_cgroup2_unified_mode() {
+                eprintln!("Skipping test in cgroups v1 mode");
+                return;
+            }
+        };
+    }
+
+    #[macro_export]
+    macro_rules! skip_if_cgroups_v2 {
+        () => {
+            if $crate::fs::hierarchies::is_cgroup2_unified_mode() {
+                eprintln!("Skipping test in cgroups v2 mode");
+                return;
+            }
+        };
+    }
+}

src/manager/systemd.rs

@@ -0,0 +1,582 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use std::collections::HashMap;
+
+use oci_spec::runtime::{LinuxCpu, LinuxMemory, LinuxPids, LinuxResources};
+use zbus::zvariant::Value as ZbusValue;
+
+use crate::manager::conv;
+use crate::manager::error::{Error, Result};
+use crate::manager::fs::{join_path, FsManager};
+use crate::systemd::props::PropertiesBuilder;
+use crate::systemd::utils::expand_slice;
+use crate::systemd::{
+    cpu, cpuset, memory, pids, Property, SystemdClient, DEFAULT_SLICE, SCOPE_SUFFIX, SLICE_SUFFIX,
+    TIMEOUT_STOP_USEC,
+};
+use crate::{CgroupPid, CgroupStats, FreezerState, Manager};
+
+/// Default kernel value for cpu quota period is 100000 us (100 ms), same
+/// for v1 [1] and v2 [2].
+///
+/// 1: https://www.kernel.org/doc/html/latest/scheduler/sched-bwc.html
+/// 2: https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2.html
+const DEFAULT_CPU_QUOTA_PERIOD: u64 = 100_000; // 100ms
+
+pub struct SystemdManager<'a> {
+    /// The name of slice
+    slice: String,
+    /// The name of unit
+    unit: String,
+    /// Systemd client
+    systemd_client: SystemdClient<'a>,
+    /// Cgroupfs manager
+    fs_manager: FsManager,
+}
+
+impl SystemdManager<'_> {
+    fn parse_slice_and_unit(path: &str) -> Result<(String, String)> {
+        let parts: Vec<&str> = path.split(':').collect();
+        if parts.len() != 3 {
+            return Err(Error::InvalidArgument);
+        }
+
+        let slice = if parts[0].is_empty() {
+            DEFAULT_SLICE.to_string()
+        } else {
+            parts[0].to_string()
+        };
+
+        let unit = new_unit_name(parts[1], parts[2]);
+
+        Ok((slice, unit))
+    }
+
+    /// Create a new `SystemdManager` from a cgroup path.
+    ///
+    /// # Arguments
+    ///
+    /// * `path` - A string slice that holds the cgroup path in the format
+    ///   "parent:scope_prefix:name".
+    pub fn new(path: &str) -> Result<Self> {
+        let (slice, unit) = Self::parse_slice_and_unit(path)?;
+        let props = PropertiesBuilder::default_cgroup(&slice, &unit).build();
+        let slice_base = expand_slice(&slice)?;
+
+        let fs_base = join_path(&slice_base, &unit);
+        let fs_manager = FsManager::new(&fs_base)?;
+
+        let cgroup = SystemdClient::new(&unit, props)?;
+
+        Ok(Self {
+            slice,
+            unit,
+            fs_manager,
+            systemd_client: cgroup,
+        })
+    }
+}
+
+impl SystemdManager<'_> {
+    /// Get the slice name.
+    pub fn slice(&self) -> &str {
+        &self.slice
+    }
+
+    /// Get the unit name.
+    pub fn unit(&self) -> &str {
+        &self.unit
+    }
+
+    fn set_cpuset(
+        &self,
+        props: &mut Vec<Property>,
+        linux_cpu: &LinuxCpu,
+        systemd_version: usize,
+    ) -> Result<()> {
+        if let Some(cpus) = linux_cpu.cpus().as_ref() {
+            let (id, value) = cpuset::cpus(cpus, systemd_version)?;
+            props.push((id, value.into()));
+        }
+
+        if let Some(mems) = linux_cpu.mems().as_ref() {
+            let (id, value) = cpuset::mems(mems, systemd_version)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    fn set_cpu(
+        &self,
+        props: &mut Vec<Property>,
+        linux_cpu: &LinuxCpu,
+        systemd_version: usize,
+    ) -> Result<()> {
+        if let Some(shares) = linux_cpu.shares() {
+            let shares = if self.v2() {
+                conv::cpu_shares_to_cgroup_v2(shares)
+            } else {
+                shares
+            };
+            let (id, value) = cpu::shares(shares, self.v2())?;
+            props.push((id, value.into()));
+        }
+
+        let period = linux_cpu.period().unwrap_or(0);
+        let quota = linux_cpu.quota().unwrap_or(0);
+
+        if period != 0 {
+            let (id, value) = cpu::period(period, systemd_version)?;
+            props.push((id, value.into()));
+        }
+
+        if period != 0 || quota != 0 {
+            // Corresponds to USEC_INFINITY in systemd
+            let mut quota_systemd = u64::MAX;
+            let mut period = period;
+            if quota > 0 {
+                if period == 0 {
+                    period = DEFAULT_CPU_QUOTA_PERIOD;
+                }
+                // systemd converts CPUQuotaPerSecUSec (microseconds per
+                // CPU second) to CPUQuota (integer percentage of CPU)
+                // internally. This means that if a fractional percent of
+                // CPU is indicated by Resources.CpuQuota, we need to round
+                // up to the nearest 10ms (1% of a second) such that child
+                // cgroups can set the cpu.cfs_quota_us they expect.
+                quota_systemd = ((quota as u64) * s_to_us(1)) / period;
+                if quota_systemd % ms_to_us(10) != 0 {
+                    quota_systemd = (quota_systemd / ms_to_us(10) + 1) * ms_to_us(10);
+                }
+            }
+            let (id, value) = cpu::quota(quota_systemd)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    fn set_memory(&self, props: &mut Vec<Property>, linux_memory: &LinuxMemory) -> Result<()> {
+        let v2 = self.v2();
+
+        let mem_limit = linux_memory.limit().unwrap_or(0);
+        if mem_limit != 0 {
+            let (id, value) = memory::limit(mem_limit, v2)?;
+            props.push((id, value.into()));
+        }
+
+        let reservation = linux_memory.reservation().unwrap_or(0);
+        if reservation != 0 && v2 {
+            let (id, value) = memory::low(reservation, v2)?;
+            props.push((id, value.into()));
+        }
+
+        let memswap_limit = linux_memory.swap().unwrap_or(0);
+        if memswap_limit != 0 && v2 {
+            let memswap_limit = conv::memory_swap_to_cgroup_v2(memswap_limit, mem_limit)?;
+            let (id, value) = memory::swap(memswap_limit, v2)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    fn set_pids(&self, props: &mut Vec<Property>, linux_pids: &LinuxPids) -> Result<()> {
+        let limit = linux_pids.limit();
+        if limit == -1 || limit > 0 {
+            let (id, value) = pids::max(limit)?;
+            props.push((id, value.into()));
+        }
+
+        Ok(())
+    }
+
+    /// The systemd sends SIGTERM to processes in the unit on stop. Once a
+    /// timeout occurs, SIGKILL will be sent to the processes.
+    ///
+    /// The item could be retrieved by:
+    ///
+    /// ```bash
+    /// $ systemctl show <unit> -p TimeoutStopUSec
+    /// ```
+    pub fn set_term_timeout(&mut self, timeout_in_sec: u64) -> Result<()> {
+        let timeout_in_usec = timeout_in_sec * 1_000_000;
+        let prop = (TIMEOUT_STOP_USEC, ZbusValue::U64(timeout_in_usec));
+        self.systemd_client.set_properties(&[prop])?;
+        Ok(())
+    }
+}
+
+impl Manager for SystemdManager<'_> {
+    fn add_proc(&mut self, pid: CgroupPid) -> Result<()> {
+        if !self.systemd_client.exists() {
+            self.systemd_client.set_pid_prop(pid)?;
+            self.systemd_client.start()?;
+            // The fs_manager was created in load mode, which doesn't create
+            // the cgroups. So we create them here.
+            self.fs_manager.create_cgroups()?;
+            return Ok(());
+        }
+
+        let subcgroup = self.fs_manager.subcgroup();
+        self.systemd_client.add_process(pid, subcgroup)?;
+
+        Ok(())
+    }
+
+    /// `add_thread()` is the same as `add_proc()`, as systemd doesn't
+    /// expose an API to add a thread directly. As a result, the whole
+    /// threads belonging to one process will be added to this cgroup.
+    fn add_thread(&mut self, pid: CgroupPid) -> Result<()> {
+        self.add_proc(pid)
+    }
+
+    fn cgroup_path(&self, subsystem: Option<&str>) -> Result<String> {
+        self.fs_manager.cgroup_path(subsystem)
+    }
+
+    /// Destroy the cgroup and stop the transient unit.
+    ///
+    /// Please note that if the current manager is in the cgroup, the
+    /// manager will be killed with SIGTERM signal. If you do not intend
+    /// that, please ignore the signal and do cleanup things immediately.
+    /// Systemd will forcibly terminate the process with SIGKILL after a
+    /// while.
+    fn destroy(&mut self) -> Result<()> {
+        self.systemd_client.stop()?;
+        Ok(())
+    }
+
+    fn enable_cpus_topdown(&self, cpus: &str) -> Result<()> {
+        self.fs_manager.enable_cpus_topdown(cpus)
+    }
+
+    fn freeze(&self, state: FreezerState) -> Result<()> {
+        match state {
+            FreezerState::Thawed => self.systemd_client.thaw()?,
+            FreezerState::Frozen => self.systemd_client.freeze()?,
+            FreezerState::Freezing => return Err(Error::InvalidArgument),
+        }
+
+        Ok(())
+    }
+
+    fn pids(&self) -> Result<Vec<CgroupPid>> {
+        self.fs_manager.pids()
+    }
+
+    fn set(&mut self, resources: &LinuxResources) -> Result<()> {
+        let mut props = vec![];
+
+        let systemd_version = self.systemd_client.systemd_version()?;
+
+        if let Some(linux_cpu) = resources.cpu() {
+            self.set_cpuset(&mut props, linux_cpu, systemd_version)?;
+            self.set_cpu(&mut props, linux_cpu, systemd_version)?;
+        }
+
+        if let Some(linux_memory) = resources.memory() {
+            self.set_memory(&mut props, linux_memory)?;
+        }
+
+        if let Some(linux_pids) = resources.pids() {
+            self.set_pids(&mut props, linux_pids)?;
+        }
+
+        self.systemd_client.set_properties(&props)?;
+
+        Ok(())
+    }
+
+    fn stats(&self) -> CgroupStats {
+        self.fs_manager.stats()
+    }
+
+    fn paths(&self) -> &HashMap<String, String> {
+        self.fs_manager.paths()
+    }
+
+    fn mounts(&self) -> &HashMap<String, String> {
+        self.fs_manager.mounts()
+    }
+
+    fn systemd(&self) -> bool {
+        true
+    }
+
+    fn v2(&self) -> bool {
+        self.fs_manager.v2()
+    }
+}
+
+fn new_unit_name(scope_prefix: &str, name: &str) -> String {
+    // By default, we create a scope unless the user explicitly asks
+    // for a slice.
+    if !name.ends_with(SLICE_SUFFIX) {
+        if scope_prefix.is_empty() {
+            // {name}.scope
+            return format!("{}{}", name, SCOPE_SUFFIX);
+        }
+        // {scope_prefix}-{name}.scope
+        return format!("{}-{}{}", scope_prefix, name, SCOPE_SUFFIX);
+    }
+
+    name.to_string()
+}
+
+#[inline]
+/// Convert milliseconds to microseconds.
+fn ms_to_us(ms: u64) -> u64 {
+    ms * 1_000
+}
+
+#[inline]
+/// Convert seconds to microseconds.
+fn s_to_us(s: u64) -> u64 {
+    s * 1_000_000
+}
+
+#[cfg(test)]
+mod tests {
+    //! Tests for the `SystemdManager` implementation of the `Manager`
+    //! trait.
+    //!
+    //! Don't run tests in parallel, use `--test-threads=1`!
+    //!
+
+    use std::path::Path;
+    use std::thread::sleep;
+    use std::time::Duration;
+
+    use oci_spec::runtime::{LinuxCpuBuilder, LinuxMemoryBuilder, LinuxResourcesBuilder};
+    use rand::distributions::Alphanumeric;
+    use rand::Rng;
+
+    use crate::fs::cpu::CpuController;
+    use crate::fs::memory::MemController;
+    use crate::fs::{ControllIdentifier, Controller, Subsystem};
+    use crate::manager::systemd::*;
+    use crate::manager::tests::{MEMORY_1G, MEMORY_2G, MEMORY_512M};
+    use crate::tests::spawn_sleep_inf;
+    use crate::{skip_if_cgroups_v1, skip_if_cgroups_v2, skip_if_no_systemd};
+
+    fn new_cgroups_path() -> (String, String, String) {
+        let rand_string: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(5)
+            .map(char::from)
+            .collect();
+        (
+            "cgroupsrs-test.slice".to_string(),
+            "cri".to_string(),
+            format!("pod{}", rand_string),
+        )
+    }
+
+    fn new_systemd_manager<'a>() -> SystemdManager<'a> {
+        let (slice, scope_prefix, name) = new_cgroups_path();
+        SystemdManager::new(&format!("{}:{}:{}", slice, scope_prefix, name)).unwrap()
+    }
+
+    fn run_set_resources_failed(resources: LinuxResources) {
+        let mut child = spawn_sleep_inf();
+        let mut manager = new_systemd_manager();
+        manager
+            .add_proc(CgroupPid {
+                pid: child.id() as u64,
+            })
+            .unwrap();
+        assert!(manager.set(&resources).is_err());
+        manager.destroy().unwrap();
+        child.wait().unwrap();
+    }
+
+    fn run_set_resources<F>(linux_resources: LinuxResources, test_fn: F)
+    where
+        F: FnOnce(&mut SystemdManager),
+    {
+        let mut manager = new_systemd_manager();
+        let mut child = spawn_sleep_inf();
+
+        manager
+            .add_proc(CgroupPid {
+                pid: child.id() as u64,
+            })
+            .unwrap();
+        manager.set(&linux_resources).unwrap();
+
+        test_fn(&mut manager);
+
+        manager.destroy().unwrap();
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_new_unit_name() {
+        assert_eq!(new_unit_name("test", "unit"), "test-unit.scope");
+        assert_eq!(new_unit_name("test", "unit.slice"), "unit.slice");
+        assert_eq!(new_unit_name("", "unit"), "unit.scope");
+        assert_eq!(new_unit_name("", "unit.slice"), "unit.slice");
+        assert_eq!(new_unit_name("prefix", "unit"), "prefix-unit.scope");
+    }
+
+    #[test]
+    fn test_slice_and_unit() {
+        skip_if_no_systemd!();
+
+        let (slice, scope_prefix, name) = new_cgroups_path();
+        let manager = SystemdManager::new(&format!("{}:{}:{}", slice, scope_prefix, name)).unwrap();
+
+        assert_eq!(manager.slice(), "cgroupsrs-test.slice");
+        assert_eq!(manager.unit(), format!("{scope_prefix}-{name}.scope"));
+    }
+
+    #[test]
+    fn test_destory() {
+        skip_if_no_systemd!();
+
+        let (slice, scope_prefix, name) = new_cgroups_path();
+        let mut manager =
+            SystemdManager::new(&format!("{}:{}:{}", slice, scope_prefix, name)).unwrap();
+
+        let cgroup_path = manager.cgroup_path(Some("memory")).unwrap();
+        // Before starting the unit, no cgroup should exist.
+        assert!(!Path::new(&cgroup_path).exists());
+
+        let mut child = spawn_sleep_inf();
+        manager
+            .add_proc(CgroupPid {
+                pid: child.id() as u64,
+            })
+            .unwrap();
+
+        // Now cgroup should exist.
+        assert!(Path::new(&cgroup_path).exists());
+
+        manager.destroy().unwrap();
+
+        // This process should be killed.
+        child.wait().unwrap();
+
+        // No cgroup should exist after destroy, retry 5 times at 1-second
+        // intervals.
+        for _ in 0..5 {
+            if !Path::new(&cgroup_path).exists() {
+                break;
+            }
+            sleep(Duration::from_secs(1));
+        }
+        assert!(!Path::new(&cgroup_path).exists());
+        // Unit should be stopped.
+        assert!(!manager.systemd_client.exists());
+    }
+
+    fn controller<'a, T>(fs_manager: &'a FsManager) -> &'a T
+    where
+        &'a T: From<&'a Subsystem>,
+        T: Controller + ControllIdentifier,
+    {
+        let controller: &T = fs_manager.cgroup().controller_of().unwrap();
+
+        controller
+    }
+
+    #[test]
+    fn test_set_cpu() {
+        skip_if_no_systemd!();
+
+        // 1024 shares, every 100ms allows to use 1 CPU
+        let linux_cpu = LinuxCpuBuilder::default()
+            .shares(1024u64)
+            .quota(100000i64)
+            .period(100000u64)
+            .quota(100000i64)
+            .build()
+            .unwrap();
+
+        let linux_resources = LinuxResourcesBuilder::default()
+            .cpu(linux_cpu)
+            .build()
+            .unwrap();
+
+        run_set_resources(linux_resources, |manager| {
+            let controller: &CpuController = controller(&manager.fs_manager);
+            let shares = controller.shares().unwrap();
+            let period = controller.cfs_period().unwrap();
+            let quota = controller.cfs_quota().unwrap();
+
+            if manager.v2() {
+                assert_eq!(shares, conv::cpu_shares_to_cgroup_v2(1024));
+            } else {
+                assert_eq!(shares, 1024);
+            }
+
+            assert_eq!(period, 100000);
+            assert_eq!(quota, 100000);
+        })
+    }
+
+    #[test]
+    fn test_set_memory_v2() {
+        skip_if_no_systemd!();
+        skip_if_cgroups_v1!();
+
+        // Expected failure: swap < limit
+        let linux_memory = LinuxMemoryBuilder::default()
+            .limit(MEMORY_1G)
+            .swap(MEMORY_512M)
+            .build()
+            .unwrap();
+        let linux_resources = LinuxResourcesBuilder::default()
+            .memory(linux_memory)
+            .build()
+            .unwrap();
+        run_set_resources_failed(linux_resources);
+
+        // Expected success
+        let linux_memory = LinuxMemoryBuilder::default()
+            .limit(MEMORY_512M)
+            .swap(MEMORY_1G)
+            .reservation(MEMORY_2G)
+            .build()
+            .unwrap();
+        let linux_resources = LinuxResourcesBuilder::default()
+            .memory(linux_memory)
+            .build()
+            .unwrap();
+        run_set_resources(linux_resources, |manager| {
+            let controller: &MemController = controller(&manager.fs_manager);
+            let memory_stat = controller.memory_stat();
+            let memory_swap_stat = controller.memswap();
+
+            assert_eq!(memory_stat.limit_in_bytes, MEMORY_512M);
+            assert_eq!(memory_swap_stat.limit_in_bytes, MEMORY_512M);
+            assert_eq!(memory_stat.soft_limit_in_bytes, MEMORY_2G);
+        });
+    }
+
+    #[test]
+    fn test_set_memory_v1() {
+        skip_if_no_systemd!();
+        skip_if_cgroups_v2!();
+
+        // Expected success
+        let linux_memory = LinuxMemoryBuilder::default()
+            .limit(MEMORY_512M)
+            .build()
+            .unwrap();
+        let linux_resources = LinuxResourcesBuilder::default()
+            .memory(linux_memory)
+            .build()
+            .unwrap();
+        run_set_resources(linux_resources, |manager| {
+            let controller: &MemController = controller(&manager.fs_manager);
+            let memory_stat = controller.memory_stat();
+            assert_eq!(memory_stat.limit_in_bytes, MEMORY_512M);
+        });
+    }
+}

src/stats.rs

@@ -0,0 +1,156 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use std::collections::HashMap;
+
+#[derive(Debug, Default)]
+pub struct CgroupStats {
+    pub cpu: CpuCgroupStats,
+    pub memory: MemoryCgroupStats,
+    pub pids: PidsCgroupStats,
+    pub blkio: BlkioCgroupStats,
+    pub hugetlb: HugeTlbCgroupStats,
+}
+
+#[derive(Debug, Default)]
+pub struct CpuCgroupStats {
+    pub cpu_acct: Option<CpuAcctStats>,
+    pub cpu_throttling: Option<CpuThrottlingStats>,
+}
+
+#[derive(Debug, Default)]
+pub struct CpuAcctStats {
+    /// Usage in userspace, read from `cpuacct.stat` from the line starting
+    /// with `user`. Set 0 if no data.
+    pub user_usage: u64,
+    /// Usage in kernelspace, read from `cpuacct.stat` from the line
+    /// starting with `system`. Set 0 if no data.
+    pub system_usage: u64,
+    /// Total usage, read from `cpuacct.usage`. Set 0 if no data.
+    pub total_usage: u64,
+    /// Per-CPU usage, read from `cpuacct.usage_percpu`.
+    pub usage_percpu: Vec<u64>,
+}
+
+#[derive(Debug, Default)]
+pub struct CpuThrottlingStats {
+    /// Periods, read from `cpu.stat` from the line starting with
+    /// `nr_periods`. Set 0 if no data.
+    pub periods: u64,
+    /// Throttled periods, read from `cpu.stat` from the line starting with
+    /// `nr_throttled`. Set 0 if no data.
+    pub throttled_periods: u64,
+    /// Throttled time, read from `cpu.stat` from the line starting with
+    /// `throttled_time`. Set 0 if no data.
+    pub throttled_time: u64,
+}
+
+#[derive(Debug, Default)]
+pub struct MemoryCgroupStats {
+    pub memory: Option<MemoryStats>,
+    pub memory_swap: Option<MemoryStats>,
+    pub kernel_memory: Option<MemoryStats>,
+
+    /// Use hierarchy, read from `memory.use_hierarchy` in cgroups v1. Only
+    /// available in cgroups v1.
+    pub use_hierarchy: bool,
+
+    // The following data is read from `memory.stat`, see also
+    // `crate::fs::memory::MemoryStat::stat`.
+    pub cache: u64,
+    pub rss: u64,
+    pub rss_huge: u64,
+    pub shmem: u64,
+    pub mapped_file: u64,
+    pub dirty: u64,
+    pub writeback: u64,
+    pub swap: u64,
+    pub pgpgin: u64,
+    pub pgpgout: u64,
+    pub pgfault: u64,
+    pub pgmajfault: u64,
+    pub inactive_anon: u64,
+    pub active_anon: u64,
+    pub inactive_file: u64,
+    pub active_file: u64,
+    pub unevictable: u64,
+    pub hierarchical_memory_limit: i64,
+    pub hierarchical_memsw_limit: i64,
+    pub total_cache: u64,
+    pub total_rss: u64,
+    pub total_rss_huge: u64,
+    pub total_shmem: u64,
+    pub total_mapped_file: u64,
+    pub total_dirty: u64,
+    pub total_writeback: u64,
+    pub total_swap: u64,
+    pub total_pgpgin: u64,
+    pub total_pgpgout: u64,
+    pub total_pgfault: u64,
+    pub total_pgmajfault: u64,
+    pub total_inactive_anon: u64,
+    pub total_active_anon: u64,
+    pub total_inactive_file: u64,
+    pub total_active_file: u64,
+    pub total_unevictable: u64,
+}
+
+#[derive(Debug, Default)]
+pub struct MemoryStats {
+    /// Memory [swap] usage, read from `memory[.memsw].usage_in_bytes` in
+    /// cgroups v1 and `memory[.swap].current` in cgroups v2.
+    pub usage: u64,
+    /// Maximum memory [swap] usage observed by cgroups, read from
+    /// `memory[.memsw].max_usage_in_bytes` in cgroups v1 and
+    /// `memory[.swap].peak` in cgroups v2.
+    pub max_usage: u64,
+    /// Memory [swap] limit, read from `memory[.memsw].limit_in_bytes` in
+    /// cgroups v1 and `memory[.swap].max` in cgroups v2.
+    pub limit: i64,
+    /// Failure count, read from `memory[.memsw].failcnt`. Only available in
+    /// cgroups v1.
+    pub fail_cnt: u64,
+}
+
+#[derive(Debug, Default)]
+pub struct PidsCgroupStats {
+    /// Current number of processes in the cgroup, read from `pids.current`.
+    pub current: u64,
+    /// Maximum number of processes in the cgroup, read from `pids.limit`.
+    pub limit: i64,
+}
+
+#[derive(Debug, Default)]
+pub struct BlkioCgroupStats {
+    pub io_service_bytes_recursive: Vec<BlkioStat>,
+    pub io_serviced_recursive: Vec<BlkioStat>,
+    pub io_queued_recursive: Vec<BlkioStat>,
+    pub io_service_time_recursive: Vec<BlkioStat>,
+    pub io_wait_time_recursive: Vec<BlkioStat>,
+    pub io_merged_recursive: Vec<BlkioStat>,
+    pub io_time_recursive: Vec<BlkioStat>,
+    pub sectors_recursive: Vec<BlkioStat>,
+}
+
+#[derive(Debug, Default)]
+pub struct BlkioStat {
+    pub major: u64,
+    pub minor: u64,
+    pub op: String,
+    pub value: u64,
+}
+
+/// A structure representing the statistics of the `hugetlb` subsystem of a
+/// Cgroup. The key is the huge page size, and the value is the statistics
+/// for that size.
+pub type HugeTlbCgroupStats = HashMap<String, HugeTlbStat>;
+
+#[derive(Debug, Default)]
+pub struct HugeTlbStat {
+    pub usage: u64,
+    pub max_usage: u64,
+    pub fail_cnt: u64,
+}

src/systemd/consts.rs

@@ -0,0 +1,68 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+/// Who enum: all
+pub const WHO_ENUM_ALL: &str = "all";
+
+/// Unit mode: replace
+pub const UNIT_MODE_REPLACE: &str = "replace";
+
+/// No such unit error
+pub const NO_SUCH_UNIT: &str = "org.freedesktop.systemd1.NoSuchUnit";
+
+/// Default description for transient units.
+pub const DEFAULT_DESCRIPTION: &str = "cgroups-rs transient unit";
+
+/// Turn on CPU usage accounting for this unit.
+pub const CPU_ACCOUNTING: &str = "CPUAccounting";
+/// This setting controls the memory controller in the unified hierarchy.
+/// Added in version 208.
+pub const MEMORY_ACCOUNTING: &str = "MemoryAccounting";
+/// This setting controls the pids controller in the unified hierarchy.
+pub const TASKS_ACCOUNTING: &str = "TasksAccounting";
+/// This setting controls the io controller in the unified hierarchy.
+/// Added in version 230.
+pub const IO_ACCOUNTING: &str = "IOAccounting";
+/// This setting controls the block IO controller in the legacy hierarchy.
+/// Deprecated in version 252.
+pub const BLOCK_IO_ACCOUNTING: &str = "BlockIOAccounting";
+/// Description of the unit.
+pub const DESCRIPTION: &str = "Description";
+/// PIDs
+pub const PIDS: &str = "PIDs";
+/// Default dependencies for this unit.
+pub const DEFAULT_DEPENDENCIES: &str = "DefaultDependencies";
+/// Wants, expressing a weak dependency on other units.
+pub const WANTS: &str = "Wants";
+/// Slice, used to assign a unit to a specific slice.
+pub const SLICE: &str = "Slice";
+/// Turns on delegation of further resource control partitioning to
+/// processes of the unit.
+pub const DELEGATE: &str = "Delegate";
+/// Timeout for stopping the unit in microseconds.
+pub const TIMEOUT_STOP_USEC: &str = "TimeoutStopUSec";
+
+/// CPU shares in the legacy hierarchy.
+pub const CPU_SHARES: &str = "CPUShares";
+/// CPU shares in the unified hierarchy.
+pub const CPU_WEIGHT: &str = "CPUWeight";
+/// CPU quota period us.
+pub const CPU_QUOTA_PERIOD_US: &str = "CPUQuotaPeriodUSec";
+/// CPU quota us
+pub const CPU_QUOTA_PER_SEC_US: &str = "CPUQuotaPerSecUSec";
+/// Allowed CPUs
+pub const ALLOWED_CPUS: &str = "AllowedCPUs";
+/// Allowed memory nodes
+pub const ALLOWED_MEMORY_NODES: &str = "AllowedMemoryNodes";
+/// Memory limit in the legacy hierarchy.
+pub const MEMORY_LIMIT: &str = "MemoryLimit";
+/// Memory limit in the unified hierarchy.
+pub const MEMORY_MAX: &str = "MemoryMax";
+/// Memory low
+pub const MEMORY_LOW: &str = "MemoryLow";
+/// Memory swap max
+pub const MEMORY_SWAP_MAX: &str = "MemorySwapMax";
+/// Tasks max
+pub const TASKS_MAX: &str = "TasksMax";

src/systemd/cpu.rs

@@ -0,0 +1,35 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{
+    CPU_QUOTA_PERIOD_US, CPU_QUOTA_PER_SEC_US, CPU_SHARES, CPU_SYSTEMD_VERSION, CPU_WEIGHT,
+};
+
+/// Returns the property for CPU shares.
+///
+/// Please note that if the shares is obtained from OCI runtime spec, it
+/// MUST be converted, see [1] and `convert_shares_to_v2()`.
+///
+/// 1: https://github.com/containers/crun/blob/main/crun.1.md#cgroup-v2
+pub fn shares(shares: u64, v2: bool) -> Result<(&'static str, u64)> {
+    let id = if v2 { CPU_WEIGHT } else { CPU_SHARES };
+
+    Ok((id, shares))
+}
+
+/// Returns the property for CPU period.
+pub fn period(period: u64, systemd_version: usize) -> Result<(&'static str, u64)> {
+    if systemd_version < CPU_SYSTEMD_VERSION {
+        return Err(Error::ObsoleteSystemd);
+    }
+
+    Ok((CPU_QUOTA_PERIOD_US, period))
+}
+
+/// Return the property for CPU quota.
+pub fn quota(quota: u64) -> Result<(&'static str, u64)> {
+    Ok((CPU_QUOTA_PER_SEC_US, quota))
+}

src/systemd/cpuset.rs

@@ -0,0 +1,106 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use bit_vec::BitVec;
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{ALLOWED_CPUS, ALLOWED_MEMORY_NODES, CPUSET_SYSTEMD_VERSION};
+
+const BYTE_IN_BITS: usize = 8;
+
+/// Returns the property for cpuset CPUs.
+pub fn cpus(cpus: &str, systemd_version: usize) -> Result<(&'static str, Vec<u8>)> {
+    if systemd_version < CPUSET_SYSTEMD_VERSION {
+        return Err(Error::ObsoleteSystemd);
+    }
+
+    let mask = convert_list_to_mask(cpus)?;
+
+    Ok((ALLOWED_CPUS, mask))
+}
+
+/// Returns the property for cpuset memory nodes.
+pub fn mems(mems: &str, systemd_version: usize) -> Result<(&'static str, Vec<u8>)> {
+    if systemd_version < CPUSET_SYSTEMD_VERSION {
+        return Err(Error::ObsoleteSystemd);
+    }
+
+    let mask = convert_list_to_mask(mems)?;
+
+    Ok((ALLOWED_MEMORY_NODES, mask))
+}
+
+/// Convert cpuset cpus/mems from the string in comma-separated list format
+/// to bitmask restored in `Vec<u8>`, see [1].
+///
+/// 1: https://man7.org/linux/man-pages/man7/cpuset.7.html
+///
+/// # Arguments
+///
+/// * `list` - A string slice that holds the list of CPUs in the format
+///   "0-3,5,7".
+fn convert_list_to_mask(list: &str) -> Result<Vec<u8>> {
+    let mut bit_vec = BitVec::from_elem(8, false);
+
+    let local_idx =
+        |index: usize| -> usize { index / BYTE_IN_BITS * BYTE_IN_BITS + 7 - index % BYTE_IN_BITS };
+
+    for part1 in list.split(',') {
+        let range: Vec<&str> = part1.split('-').collect();
+        match range.len() {
+            // x-
+            1 => {
+                let left: usize = range[0].parse().map_err(|_| Error::InvalidArgument)?;
+
+                while left >= bit_vec.len() {
+                    bit_vec.grow(BYTE_IN_BITS, false);
+                }
+                bit_vec.set(local_idx(left), true);
+            }
+            // x-y
+            2 => {
+                let left: usize = range[0].parse().map_err(|_| Error::InvalidArgument)?;
+                let right: usize = range[1].parse().map_err(|_| Error::InvalidArgument)?;
+
+                while right >= bit_vec.len() {
+                    bit_vec.grow(BYTE_IN_BITS, false);
+                }
+
+                for index in left..=right {
+                    bit_vec.set(local_idx(index), true);
+                }
+            }
+            _ => {
+                return Err(Error::InvalidArgument);
+            }
+        }
+    }
+
+    let mut mask = bit_vec.to_bytes();
+    mask.reverse();
+
+    Ok(mask)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::systemd::cpuset::convert_list_to_mask;
+
+    #[test]
+    fn test_convert_list_to_mask() {
+        let mask = convert_list_to_mask("2-4").unwrap();
+        assert_eq!(vec![0b00011100_u8], mask);
+
+        let mask = convert_list_to_mask("1,7").unwrap();
+        assert_eq!(vec![0b10000010_u8], mask);
+
+        let mask = convert_list_to_mask("0-4,9").unwrap();
+        assert_eq!(vec![0b00000010_u8, 0b00011111_u8], mask);
+
+        assert!(convert_list_to_mask("1-3-4").is_err());
+
+        assert!(convert_list_to_mask("1-3,,").is_err());
+    }
+}

src/systemd/dbus/README.md

@@ -0,0 +1,17 @@
+# Systemd Dbus
+
+How to generate `xxx_proxy.rs` files
+
+```shell
+# install zbus-xmlgen if not
+$ cargo install zbus-xmlgen
+# generate interface in XML format
+$ busctl introspect --xml-interface \
+    org.freedesktop.systemd1 \
+    /org/freedesktop/systemd1 \
+    org.freedesktop.systemd1.Manager > /tmp/systemd1-manager.xml
+# generate Rust code from XML
+$ zbus-xmlgen file /tmp/systemd1-manager.xml \
+    --output src/systemd/dbus/systemd_manager_proxy.rs
+$ rm -rf /tmp/systemd1-manager.xml
+```

src/systemd/dbus/client.rs

@@ -0,0 +1,572 @@
+// Copyright 2021-2023 Kata Contributors
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use zbus::zvariant::Value;
+use zbus::{Error as ZbusError, Result as ZbusResult};
+
+use crate::systemd::dbus::error::{Error, Result};
+use crate::systemd::dbus::proxy::systemd_manager_proxy;
+use crate::systemd::{Property, NO_SUCH_UNIT, PIDS, UNIT_MODE_REPLACE};
+use crate::CgroupPid;
+
+pub struct SystemdClient<'a> {
+    /// The name of the systemd unit (slice or scope)
+    unit: String,
+    props: Vec<Property<'a>>,
+}
+
+impl<'a> SystemdClient<'a> {
+    pub fn new(unit: &str, props: Vec<Property<'a>>) -> Result<Self> {
+        Ok(Self {
+            unit: unit.to_string(),
+            props,
+        })
+    }
+}
+
+impl SystemdClient<'_> {
+    /// Set the pid to the PIDs property of the unit.
+    ///
+    /// Append a process ID to the PIDs property of the unit. If not
+    /// exists, one property will be created.
+    pub fn set_pid_prop(&mut self, pid: CgroupPid) -> Result<()> {
+        if self.exists() {
+            return Ok(());
+        }
+
+        for prop in self.props.iter_mut() {
+            if prop.0 == PIDS {
+                // If PIDS is already set, we append the new pid to the existing list.
+                if let Value::Array(arr) = &mut prop.1 {
+                    arr.append(pid.pid.into())
+                        .map_err(|_| Error::InvalidProperties)?;
+                    return Ok(());
+                }
+                // Invalid type of PIDs
+                return Err(Error::InvalidProperties);
+            }
+        }
+        // If PIDS is not set, we create a new property.
+        self.props
+            .push((PIDS, Value::Array(vec![pid.pid as u32].into())));
+        Ok(())
+    }
+
+    /// Start a slice or a scope unit controlled and supervised by systemd.
+    ///
+    /// For more information, see:
+    /// https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html
+    /// https://www.freedesktop.org/software/systemd/man/latest/systemd.slice.html
+    /// https://www.freedesktop.org/software/systemd/man/latest/systemd.scope.html
+    pub fn start(&self) -> Result<()> {
+        // PIDs property must be present
+        if !self.props.iter().any(|(k, _)| k == &PIDS) {
+            return Err(Error::InvalidProperties);
+        }
+
+        let sys_proxy = systemd_manager_proxy()?;
+
+        let props_borrowed: Vec<(&str, &zbus::zvariant::Value)> =
+            self.props.iter().map(|(k, v)| (*k, v)).collect();
+        let props_borrowed: Vec<&(&str, &Value)> = props_borrowed.iter().collect();
+
+        sys_proxy.start_transient_unit(&self.unit, UNIT_MODE_REPLACE, &props_borrowed, &[])?;
+
+        Ok(())
+    }
+
+    /// Stop the current transient unit, the processes will be killed on
+    /// unit stop, see [1].
+    ///
+    /// 1. https://www.freedesktop.org/software/systemd/man/latest/systemd.kill.html#KillMode=
+    pub fn stop(&self) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        let ret = sys_proxy.stop_unit(&self.unit, UNIT_MODE_REPLACE);
+        ignore_no_such_unit(ret)?;
+
+        // If we stop the unit and it still exists, it may be in a failed
+        // state, so we will try to reset it.
+        if self.exists() {
+            let ret = sys_proxy.reset_failed_unit(&self.unit);
+            ignore_no_such_unit(ret)?;
+        }
+
+        Ok(())
+    }
+
+    /// Set properties for the unit through dbus `SetUnitProperties`.
+    pub fn set_properties(&mut self, properties: &[Property<'static>]) -> Result<()> {
+        for prop in properties {
+            let new = prop.1.try_clone().map_err(|_| Error::InvalidProperties)?;
+            // Try to update the value first, if fails, append it.
+            if let Some(existing) = self.props.iter_mut().find(|p| p.0 == prop.0) {
+                existing.1 = new;
+            } else {
+                self.props.push((prop.0, new));
+            }
+        }
+
+        // The unit must exist before setting properties.
+        if !self.exists() {
+            return Ok(());
+        }
+
+        let sys_proxy = systemd_manager_proxy()?;
+
+        let props_borrowed: Vec<(&str, &Value)> = properties.iter().map(|(k, v)| (*k, v)).collect();
+        let props_borrowed: Vec<&(&str, &Value)> = props_borrowed.iter().collect();
+
+        sys_proxy.set_unit_properties(&self.unit, true, &props_borrowed)?;
+
+        Ok(())
+    }
+
+    /// Freeze the unit through dbus `FreezeUnit`.
+    pub fn freeze(&self) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        sys_proxy.freeze_unit(&self.unit)?;
+
+        Ok(())
+    }
+
+    /// Thaw the frozen unit through dbus `ThawUnit`.
+    pub fn thaw(&self) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        sys_proxy.thaw_unit(&self.unit)?;
+
+        Ok(())
+    }
+
+    /// Get the systemd version.
+    pub fn systemd_version(&self) -> Result<usize> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        // Parse 249 from "249.11-0ubuntu3.16"
+        let version = sys_proxy.version()?;
+        let version = version
+            .split('.')
+            .next()
+            .and_then(|v| v.parse::<usize>().ok())
+            .ok_or(Error::CorruptedSystemdVersion(version))?;
+
+        Ok(version)
+    }
+
+    /// Check if the unit exists.
+    pub fn exists(&self) -> bool {
+        let sys_proxy = match systemd_manager_proxy() {
+            Ok(proxy) => proxy,
+            _ => return false,
+        };
+
+        sys_proxy
+            .get_unit(&self.unit)
+            .map(|_| true)
+            .unwrap_or_default()
+    }
+
+    /// Add a process (tgid) to the unit through dbus
+    /// `AttachProcessesToUnit`.
+    pub fn add_process(&self, pid: CgroupPid, subcgroup: &str) -> Result<()> {
+        let sys_proxy = systemd_manager_proxy()?;
+
+        sys_proxy.attach_processes_to_unit(&self.unit, subcgroup, &[pid.pid as u32])?;
+
+        Ok(())
+    }
+}
+
+fn ignore_no_such_unit<T>(result: ZbusResult<T>) -> ZbusResult<bool> {
+    if let Err(ZbusError::MethodError(err_name, _, _)) = &result {
+        if err_name.as_str() == NO_SUCH_UNIT {
+            return Ok(true);
+        }
+    }
+    result.map(|_| false)
+}
+
+#[cfg(test)]
+pub mod tests {
+    //! Unit tests for the SystemdClient
+    //!
+    //! Not sure why the tests are going to fail if we run them in
+    //! parallel. Everything goes smoothly in serial.
+    //!
+    //! $ cargo test --package cgroups-rs --lib \
+    //!   -- systemd::dbus::client::tests \
+    //!   --show-output --test-threads=1
+
+    use std::fs;
+    use std::path::Path;
+    use std::process::Command;
+    use std::thread::sleep;
+    use std::time::Duration;
+
+    use rand::distributions::Alphanumeric;
+    use rand::Rng;
+
+    use crate::fs::hierarchies;
+    use crate::systemd::dbus::client::*;
+    use crate::systemd::props::PropertiesBuilder;
+    use crate::systemd::utils::expand_slice;
+    use crate::systemd::{DEFAULT_DESCRIPTION, DESCRIPTION, PIDS};
+    use crate::tests::{spawn_sleep_inf, spawn_yes, systemd_version};
+
+    const TEST_SLICE: &str = "cgroupsrs-test.slice";
+
+    fn test_unit() -> String {
+        let rand_string: String = rand::thread_rng()
+            .sample_iter(&Alphanumeric)
+            .take(5)
+            .map(char::from)
+            .collect();
+        format!("cri-pod{}.scope", rand_string)
+    }
+
+    #[macro_export]
+    macro_rules! skip_if_no_systemd {
+        () => {
+            if $crate::tests::systemd_version().is_none() {
+                eprintln!("Test skipped, no systemd?");
+                return;
+            }
+        };
+    }
+
+    fn systemd_show(unit: &str) -> String {
+        let output = Command::new("systemctl")
+            .arg("show")
+            .arg(unit)
+            .output()
+            .expect("Failed to execute systemctl show command");
+        String::from_utf8_lossy(&output.stdout).to_string()
+    }
+
+    fn start_default_cgroup(pid: CgroupPid, unit: &str) -> SystemdClient {
+        let mut props = PropertiesBuilder::default_cgroup(TEST_SLICE, unit).build();
+        props.push((PIDS, Value::Array(vec![pid.pid as u32].into())));
+        let cgroup = SystemdClient::new(unit, props).unwrap();
+        // Stop the unit if it exists.
+        cgroup.stop().unwrap();
+
+        // Write the current process to the cgroup.
+        cgroup.start().unwrap();
+        cgroup.add_process(pid, "/").unwrap();
+        cgroup
+    }
+
+    fn stop_cgroup(cgroup: &SystemdClient) {
+        cgroup.stop().unwrap();
+    }
+
+    #[test]
+    fn test_start() {
+        skip_if_no_systemd!();
+
+        let v2 = hierarchies::is_cgroup2_unified_mode();
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        let base = expand_slice(TEST_SLICE).unwrap();
+
+        // Check if the cgroup exists in the filesystem
+        let full_base = if v2 {
+            format!("/sys/fs/cgroup/{}", base)
+        } else {
+            format!("/sys/fs/cgroup/memory/{}", base)
+        };
+        assert!(
+            Path::new(&full_base).exists(),
+            "Cgroup base path does not exist: {}",
+            full_base
+        );
+
+        // PIDs
+        let cgroup_procs_path = format!("{}/{}/cgroup.procs", full_base, &unit);
+        for i in 0..5 {
+            let content = fs::read_to_string(&cgroup_procs_path);
+            if let Ok(content) = &content {
+                if content.contains(&child.id().to_string()) {
+                    break;
+                }
+            }
+            // Retry attempts exhausted, resulting in failure
+            if i == 4 {
+                let content = content.as_ref().unwrap();
+                assert!(
+                    content.contains(&child.id().to_string()),
+                    "Cgroup procs does not contain the child process ID"
+                );
+            }
+            // Wait 500ms before next retrying
+            sleep(Duration::from_millis(500));
+        }
+
+        // Check the unit from "systemctl show <unit>"
+        let output = systemd_show(&cgroup.unit);
+
+        // Slice
+        assert!(
+            output
+                .lines()
+                .any(|line| line == format!("Slice={}", TEST_SLICE)),
+            "Slice not found"
+        );
+        // Delegate
+        assert!(
+            output.lines().any(|line| line == "Delegate=yes"),
+            "Delegate not set"
+        );
+        // DelegateControllers
+        // controllers: cpu cpuacct cpuset io blkio memory devices pids
+        let controllers = output
+            .lines()
+            .find(|line| line.starts_with("DelegateControllers="))
+            .map(|line| line.trim_start_matches("DelegateControllers="))
+            .unwrap();
+        let controllers = controllers.split(' ').collect::<Vec<&str>>();
+        assert!(
+            controllers.contains(&"cpu"),
+            "DelegateControllers cpu not set"
+        );
+        assert!(
+            controllers.contains(&"cpuset"),
+            "DelegateControllers cpuset not set"
+        );
+        if v2 {
+            assert!(
+                controllers.contains(&"io"),
+                "DelegateControllers io not set"
+            );
+        } else {
+            assert!(
+                controllers.contains(&"blkio"),
+                "DelegateControllers blkio not set"
+            );
+        }
+        assert!(
+            controllers.contains(&"memory"),
+            "DelegateControllers memory not set"
+        );
+        assert!(
+            controllers.contains(&"pids"),
+            "DelegateControllers pids not set"
+        );
+
+        // CPUAccounting
+        assert!(
+            output.lines().any(|line| line == "CPUAccounting=yes"),
+            "CPUAccounting not set"
+        );
+        // IOAccounting for v2, and BlockIOAccounting for v1
+        if v2 {
+            assert!(
+                output.lines().any(|line| line == "IOAccounting=yes"),
+                "IOAccounting not set"
+            );
+        } else {
+            assert!(
+                output.lines().any(|line| line == "BlockIOAccounting=yes"),
+                "BlockIOAccounting not set"
+            );
+        }
+        // MemoryAccounting
+        assert!(
+            output.lines().any(|line| line == "MemoryAccounting=yes"),
+            "MemoryAccounting not set"
+        );
+        // TasksAccounting
+        assert!(
+            output.lines().any(|line| line == "TasksAccounting=yes"),
+            "TasksAccounting not set"
+        );
+        // ActiveState
+        assert!(
+            output.lines().any(|line| line == "ActiveState=active"),
+            "Unit is not active"
+        );
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_stop() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        // Check ActiveState: expected to be "active"
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output.lines().any(|line| line == "ActiveState=active"),
+            "Unit is not active"
+        );
+
+        stop_cgroup(&cgroup);
+
+        // Check ActiveState: expected to be "inactive"
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output.lines().any(|line| line == "ActiveState=inactive"),
+            "Unit is not inactive"
+        );
+
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_set_properties() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let mut cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output.lines().any(|line| line
+                == format!(
+                    "Description={} {}:{}",
+                    DEFAULT_DESCRIPTION, TEST_SLICE, unit
+                )),
+            "Initial description not set correctly"
+        );
+
+        let properties = [(
+            DESCRIPTION,
+            Value::Str("kata-container1 description".into()),
+        )];
+        cgroup.set_properties(&properties).unwrap();
+        assert!(cgroup.props.iter().any(|(k, v)| {
+            k == &DESCRIPTION && v == &Value::Str("kata-container1 description".into())
+        }));
+
+        let output = systemd_show(&cgroup.unit);
+        assert!(
+            output
+                .lines()
+                .any(|line| line == "Description=kata-container1 description"),
+            "Updated description not set correctly"
+        );
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_freeze_and_thaw() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_yes();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        // Freeze the unit
+        cgroup.freeze().unwrap();
+
+        let pid = child.id() as u64;
+
+        let stat_path = format!("/proc/{}/stat", pid);
+        let content = fs::read_to_string(&stat_path).unwrap();
+        // The process state is the third field, e.g.:
+        // 1234 (bash) S 1233 ...
+        //             ^
+        let mut content_iter = content.split_whitespace();
+        assert_eq!(
+            content_iter.nth(2).unwrap(),
+            "S",
+            "Process should be in 'S' (sleeping) state after freezing"
+        );
+
+        // Thaw the unit
+        cgroup.thaw().unwrap();
+
+        // No more S now
+        let content = fs::read_to_string(&stat_path).unwrap();
+        let mut content_iter = content.split_whitespace();
+        assert_ne!(
+            content_iter.nth(2).unwrap(),
+            "S",
+            "Process should not be in 'S' (sleeping) state after thawing"
+        );
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_systemd_version() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let props = PropertiesBuilder::default_cgroup(TEST_SLICE, &unit).build();
+        let cgroup = SystemdClient::new(&unit, props).unwrap();
+        let version = cgroup.systemd_version().unwrap();
+
+        let expected_version = systemd_version().unwrap();
+        assert_eq!(version, expected_version, "Systemd version mismatch");
+    }
+
+    #[test]
+    fn test_exists() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        assert!(cgroup.exists(), "Cgroup should exist after starting");
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+    }
+
+    #[test]
+    fn test_add_process() {
+        skip_if_no_systemd!();
+
+        let unit = test_unit();
+        let mut child = spawn_sleep_inf();
+        let cgroup = start_default_cgroup(CgroupPid::from(child.id() as u64), &unit);
+
+        let mut child1 = spawn_sleep_inf();
+        let pid1 = CgroupPid::from(child1.id() as u64);
+        cgroup.add_process(pid1, "/").unwrap();
+
+        let cgroup_procs_path = format!(
+            "/sys/fs/cgroup/{}/{}/cgroup.procs",
+            expand_slice(TEST_SLICE).unwrap(),
+            unit
+        );
+        for i in 0..5 {
+            let content = fs::read_to_string(&cgroup_procs_path);
+            if let Ok(content) = content {
+                assert!(
+                    content.contains(&child1.id().to_string()),
+                    "Cgroup procs does not contain the child1 process ID"
+                );
+                break;
+            }
+            // Retry attempts exhausted, resulting in failure
+            if i == 4 {
+                content.unwrap();
+            }
+            // Wait 500ms before next retrying
+            sleep(Duration::from_millis(500));
+        }
+
+        stop_cgroup(&cgroup);
+        child.wait().unwrap();
+        child1.wait().unwrap();
+    }
+}

src/systemd/dbus/error.rs

@@ -0,0 +1,18 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("invalid properties")]
+    InvalidProperties,
+
+    #[error("dbus error: {0}")]
+    Dbus(#[from] zbus::Error),
+
+    #[error("corrupted systemd version: {0}")]
+    CorruptedSystemdVersion(String),
+}

src/systemd/dbus/mod.rs

@@ -0,0 +1,18 @@
+// Copyright (c) 2018 Levente Kurusa
+// Copyright (c) 2020-2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+//! Systemd D-Bus interface for managing cgroups and units.
+//!
+//! References:
+//! https://www.freedesktop.org/software/systemd/man/latest/org.freedesktop.systemd1.html
+//! https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html
+//! https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html
+
+mod client;
+pub mod error;
+mod systemd_manager_proxy;
+pub use client::SystemdClient;
+mod proxy;

src/systemd/dbus/proxy.rs

@@ -0,0 +1,16 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use zbus::blocking::Connection;
+use zbus::Result;
+
+use crate::systemd::dbus::systemd_manager_proxy::ManagerProxyBlocking as SystemManager;
+
+pub(crate) fn systemd_manager_proxy<'a>() -> Result<SystemManager<'a>> {
+    let connection = Connection::system()?;
+    let proxy = SystemManager::new(&connection)?;
+
+    Ok(proxy)
+}

src/systemd/error.rs

@@ -0,0 +1,18 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("invalid argument")]
+    InvalidArgument,
+
+    #[error("obsolete systemd, please upgrade your systemd")]
+    ObsoleteSystemd,
+
+    #[error("resource not supported by cgroups v1")]
+    CgroupsV1NotSupported,
+}

src/systemd/memory.rs

@@ -0,0 +1,32 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{MEMORY_LIMIT, MEMORY_LOW, MEMORY_MAX, MEMORY_SWAP_MAX};
+
+/// Returns the property for memory limit.
+pub fn limit(limit: i64, v2: bool) -> Result<(&'static str, u64)> {
+    let id = if v2 { MEMORY_MAX } else { MEMORY_LIMIT };
+
+    Ok((id, limit as u64))
+}
+
+/// Returns the property for memory limit.
+pub fn low(low: i64, v2: bool) -> Result<(&'static str, u64)> {
+    if !v2 {
+        return Err(Error::CgroupsV1NotSupported);
+    }
+
+    Ok((MEMORY_LOW, low as u64))
+}
+
+/// Returns the property for memory swap.
+pub fn swap(swap: i64, v2: bool) -> Result<(&'static str, u64)> {
+    if !v2 {
+        return Err(Error::CgroupsV1NotSupported);
+    }
+
+    Ok((MEMORY_SWAP_MAX, swap as u64))
+}

src/systemd/mod.rs

@@ -0,0 +1,25 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+pub mod cpu;
+pub mod cpuset;
+pub mod dbus;
+pub use dbus::SystemdClient;
+mod consts;
+pub use consts::*;
+pub mod error;
+pub mod memory;
+pub mod pids;
+pub mod props;
+pub use props::Property;
+pub mod utils;
+
+pub const DEFAULT_SLICE: &str = "system.slice";
+
+pub const SLICE_SUFFIX: &str = ".slice";
+pub const SCOPE_SUFFIX: &str = ".scope";
+
+pub const CPU_SYSTEMD_VERSION: usize = 242;
+pub const CPUSET_SYSTEMD_VERSION: usize = 244;

src/systemd/pids.rs

@@ -0,0 +1,11 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::Result;
+use crate::systemd::TASKS_MAX;
+
+pub fn max(max: i64) -> Result<(&'static str, u64)> {
+    Ok((TASKS_MAX, max as u64))
+}

src/systemd/props.rs

@@ -0,0 +1,170 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use zbus::zvariant::Value as ZbusValue;
+
+use crate::fs::hierarchies;
+use crate::systemd::utils::is_slice_unit;
+use crate::systemd::{
+    BLOCK_IO_ACCOUNTING, CPU_ACCOUNTING, DEFAULT_DEPENDENCIES, DEFAULT_DESCRIPTION, DELEGATE,
+    DESCRIPTION, IO_ACCOUNTING, MEMORY_ACCOUNTING, PIDS, SLICE, TASKS_ACCOUNTING,
+    TIMEOUT_STOP_USEC, WANTS,
+};
+
+pub type Property<'a> = (&'a str, ZbusValue<'a>);
+
+#[derive(Debug, Clone, Default)]
+pub struct PropertiesBuilder {
+    cpu_accounting: Option<bool>,
+    // MemoryAccount is for cgroup v2 as documented in dbus. However,
+    // "github.com/opencontainer/runc" uses it for all. Shall we follow the
+    // same way?
+    memory_accounting: Option<bool>,
+    task_accounting: Option<bool>,
+    // Use IO_ACCOUNTING for cgroup v2 and BLOCK_IO_ACCOUNTING for cgroup v1.
+    io_accounting: Option<bool>,
+    default_dependencies: Option<bool>,
+    description: Option<String>,
+    wants: Option<String>,
+    slice: Option<String>,
+    delegate: Option<bool>,
+    pids: Option<Vec<u32>>,
+    timeout_stop_usec: Option<u64>,
+}
+
+impl PropertiesBuilder {
+    pub fn default_cgroup(slice: &str, unit: &str) -> Self {
+        let mut builder = Self::default()
+            .cpu_accounting(true)
+            .memory_accounting(true)
+            .task_accounting(true)
+            .io_accounting(true)
+            .default_dependencies(false)
+            .description(format!("{} {}:{}", DEFAULT_DESCRIPTION, slice, unit));
+
+        if is_slice_unit(unit) {
+            // If we create a slice, the parent is defined via a Wants=.
+            builder = builder.wants(slice.to_string());
+        } else {
+            // Otherwise it's a scope, which we put into a Slice=.
+            builder = builder.slice(slice.to_string());
+            // Assume scopes always support delegation (supported since systemd v218).
+            builder = builder.delegate(true);
+        }
+
+        builder
+    }
+
+    pub fn cpu_accounting(mut self, enabled: bool) -> Self {
+        self.cpu_accounting = Some(enabled);
+        self
+    }
+
+    pub fn memory_accounting(mut self, enabled: bool) -> Self {
+        self.memory_accounting = Some(enabled);
+        self
+    }
+
+    pub fn task_accounting(mut self, enabled: bool) -> Self {
+        self.task_accounting = Some(enabled);
+        self
+    }
+
+    pub fn io_accounting(mut self, enabled: bool) -> Self {
+        self.io_accounting = Some(enabled);
+        self
+    }
+
+    pub fn default_dependencies(mut self, enabled: bool) -> Self {
+        self.default_dependencies = Some(enabled);
+        self
+    }
+
+    pub fn description(mut self, desc: String) -> Self {
+        self.description = Some(desc);
+        self
+    }
+
+    pub fn wants(mut self, wants: String) -> Self {
+        self.wants = Some(wants);
+        self
+    }
+
+    pub fn slice(mut self, slice: String) -> Self {
+        self.slice = Some(slice);
+        self
+    }
+
+    pub fn delegate(mut self, enabled: bool) -> Self {
+        self.delegate = Some(enabled);
+        self
+    }
+
+    pub fn pids(mut self, pids: Vec<u32>) -> Self {
+        self.pids = Some(pids);
+        self
+    }
+
+    pub fn timeout_stop_usec(mut self, timeout: u64) -> Self {
+        self.timeout_stop_usec = Some(timeout);
+        self
+    }
+
+    pub fn build(self) -> Vec<Property<'static>> {
+        let mut props = vec![];
+
+        if let Some(cpu_accounting) = self.cpu_accounting {
+            props.push((CPU_ACCOUNTING, ZbusValue::Bool(cpu_accounting)));
+        }
+
+        if let Some(memory_accounting) = self.memory_accounting {
+            props.push((MEMORY_ACCOUNTING, ZbusValue::Bool(memory_accounting)));
+        }
+
+        if let Some(task_accounting) = self.task_accounting {
+            props.push((TASKS_ACCOUNTING, ZbusValue::Bool(task_accounting)));
+        }
+
+        if let Some(io_accounting) = self.io_accounting {
+            if hierarchies::is_cgroup2_unified_mode() {
+                props.push((IO_ACCOUNTING, ZbusValue::Bool(io_accounting)));
+            } else {
+                props.push((BLOCK_IO_ACCOUNTING, ZbusValue::Bool(io_accounting)));
+            }
+        }
+
+        if let Some(default_dependencies) = self.default_dependencies {
+            props.push((DEFAULT_DEPENDENCIES, ZbusValue::Bool(default_dependencies)));
+        }
+
+        if let Some(description) = self.description {
+            props.push((DESCRIPTION, ZbusValue::Str(description.into())));
+        } else {
+            props.push((DESCRIPTION, ZbusValue::Str(DEFAULT_DESCRIPTION.into())));
+        }
+
+        if let Some(wants) = self.wants {
+            props.push((WANTS, ZbusValue::Str(wants.into())));
+        }
+
+        if let Some(slice) = self.slice {
+            props.push((SLICE, ZbusValue::Str(slice.into())));
+        }
+
+        if let Some(delegate) = self.delegate {
+            props.push((DELEGATE, ZbusValue::Bool(delegate)));
+        }
+
+        if let Some(pids) = self.pids {
+            props.push((PIDS, ZbusValue::Array(pids.into())));
+        }
+
+        if let Some(timeout) = self.timeout_stop_usec {
+            props.push((TIMEOUT_STOP_USEC, ZbusValue::U64(timeout)));
+        }
+
+        props
+    }
+}

src/systemd/utils.rs

@@ -0,0 +1,101 @@
+// Copyright (c) 2025 Ant Group
+//
+// SPDX-License-Identifier: Apache-2.0 or MIT
+//
+
+use crate::systemd::error::{Error, Result};
+use crate::systemd::{SCOPE_SUFFIX, SLICE_SUFFIX};
+
+/// Check if a systemd unit name is a slice unit.
+pub fn is_slice_unit(name: &str) -> bool {
+    name.ends_with(SLICE_SUFFIX)
+}
+
+/// Check if a systemd unit name is a scope unit.
+pub fn is_scope_unit(name: &str) -> bool {
+    name.ends_with(SCOPE_SUFFIX)
+}
+
+/// Expand a slice name to a full path in the filesystem.
+///
+/// # Arguments
+///
+/// * `slice` - A string slice that holds the slice name in the format
+///   "xxx-yyy-zzz.slice".
+///
+/// # Returns
+///
+/// A string that represents the full path of the slice in the filesystem.
+/// In the above case, the value would be
+/// "xxx.slice/xxx-yyy.slice/xxx-yyy-zzz.slice".
+pub fn expand_slice(slice: &str) -> Result<String> {
+    // Name has to end with ".slice", but can't be just ".slice".
+    if !slice.ends_with(SLICE_SUFFIX) || slice.len() < SLICE_SUFFIX.len() {
+        return Err(Error::InvalidArgument);
+    }
+
+    // Path-separators are not allowed.
+    if slice.contains('/') {
+        return Err(Error::InvalidArgument);
+    }
+
+    let name = slice.trim_end_matches(SLICE_SUFFIX);
+
+    // If input was -.slice, we should just return root now
+    if name == "-" {
+        return Ok("".to_string());
+    }
+
+    let mut slice_path = String::new();
+    let mut prefix = String::new();
+    for sub_slice in name.split('-') {
+        if sub_slice.is_empty() {
+            return Err(Error::InvalidArgument);
+        }
+
+        slice_path = format!("{}/{}{}{}", slice_path, prefix, sub_slice, SLICE_SUFFIX);
+        prefix = format!("{}{}-", prefix, sub_slice);
+    }
+
+    // We need a relative path, so remove the first slash.
+    slice_path.remove(0);
+
+    Ok(slice_path)
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::systemd::utils::*;
+
+    #[test]
+    fn test_is_slice_unit() {
+        assert!(is_slice_unit("test.slice"));
+        assert!(!is_slice_unit("test.scope"));
+    }
+
+    #[test]
+    fn test_is_scope_unit() {
+        assert!(is_scope_unit("test.scope"));
+        assert!(!is_scope_unit("test.slice"));
+    }
+
+    #[test]
+    fn test_expand_slice() {
+        assert_eq!(expand_slice("test.slice").unwrap(), "test.slice");
+        assert_eq!(
+            expand_slice("test-1.slice").unwrap(),
+            "test.slice/test-1.slice"
+        );
+        assert_eq!(
+            expand_slice("test-1-test-2.slice").unwrap(),
+            "test.slice/test-1.slice/test-1-test.slice/test-1-test-2.slice"
+        );
+        assert_eq!(
+            expand_slice("slice-slice.slice").unwrap(),
+            "slice.slice/slice-slice.slice"
+        );
+        assert_eq!(expand_slice("-.slice").unwrap(), "");
+        assert!(expand_slice("invalid/slice").is_err());
+        assert!(expand_slice("invalid-slice").is_err());
+    }
+}

tests/builder.rs

@@ -5,19 +5,19 @@
 //
 
 //! Some simple tests covering the builder pattern for control groups.
-use cgroups_rs::blkio::*;
-use cgroups_rs::cgroup_builder::*;
-use cgroups_rs::cpu::*;
-use cgroups_rs::devices::*;
-use cgroups_rs::hugetlb::*;
-use cgroups_rs::memory::*;
-use cgroups_rs::net_cls::*;
-use cgroups_rs::pid::*;
-use cgroups_rs::*;
+use cgroups_rs::fs::blkio::*;
+use cgroups_rs::fs::cgroup_builder::*;
+use cgroups_rs::fs::cpu::*;
+use cgroups_rs::fs::devices::*;
+use cgroups_rs::fs::hugetlb::*;
+use cgroups_rs::fs::memory::*;
+use cgroups_rs::fs::net_cls::*;
+use cgroups_rs::fs::pid::*;
+use cgroups_rs::fs::*;
 
 #[test]
 pub fn test_cpu_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg: Cgroup = CgroupBuilder::new("test_cpu_res_build")
         .cpu()
         .shares(85)
@@ -36,7 +36,7 @@ pub fn test_cpu_res_build() {
 
 #[test]
 pub fn test_memory_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg: Cgroup = CgroupBuilder::new("test_memory_res_build")
         .memory()
         .kernel_memory_limit(128 * 1024 * 1024)
@@ -61,7 +61,7 @@ pub fn test_memory_res_build() {
 
 #[test]
 pub fn test_pid_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg: Cgroup = CgroupBuilder::new("test_pid_res_build")
         .pid()
         .maximum_number_of_processes(MaxValue::Value(123))
@@ -81,7 +81,7 @@ pub fn test_pid_res_build() {
 #[test]
 #[ignore] // ignore this test for now, not sure why my kernel doesn't like it
 pub fn test_devices_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg: Cgroup = CgroupBuilder::new("test_devices_res_build")
         .devices()
         .device(1, 6, DeviceType::Char, true, vec![DevicePermissions::Read])
@@ -108,7 +108,7 @@ pub fn test_devices_res_build() {
 
 #[test]
 pub fn test_network_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     if h.v2() {
         // FIXME add cases for v2
         return;
@@ -130,7 +130,7 @@ pub fn test_network_res_build() {
 
 #[test]
 pub fn test_hugepages_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     if h.v2() {
         // FIXME add cases for v2
         return;
@@ -153,7 +153,7 @@ pub fn test_hugepages_res_build() {
 #[test]
 #[ignore] // high version kernel not support `blkio.weight`
 pub fn test_blkio_res_build() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg: Cgroup = CgroupBuilder::new("test_blkio_res_build")
         .blkio()
         .weight(100)

tests/cgroup.rs

@@ -5,20 +5,22 @@
 //
 
 //! Simple unit tests about the control groups system.
-use cgroups_rs::cgroup::{
-    CGROUP_MODE_DOMAIN, CGROUP_MODE_DOMAIN_INVALID, CGROUP_MODE_DOMAIN_THREADED,
-    CGROUP_MODE_THREADED,
-};
-use cgroups_rs::memory::MemController;
-use cgroups_rs::Controller;
-use cgroups_rs::{Cgroup, CgroupPid, Subsystem};
 use std::process::Command;
 use std::thread::sleep;
 use std::time::Duration;
 
+use cgroups_rs::fs::cgroup::{
+    CGROUP_MODE_DOMAIN, CGROUP_MODE_DOMAIN_INVALID, CGROUP_MODE_DOMAIN_THREADED,
+    CGROUP_MODE_THREADED,
+};
+use cgroups_rs::fs::memory::MemController;
+use cgroups_rs::fs::Controller;
+use cgroups_rs::fs::{Cgroup, Subsystem};
+use cgroups_rs::CgroupPid;
+
 #[test]
 fn test_procs_iterator_cgroup() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let pid = libc::pid_t::from(nix::unistd::getpid()) as u64;
     let cg = Cgroup::new(h, String::from("test_procs_iterator_cgroup")).unwrap();
     {
@@ -42,10 +44,10 @@ fn test_procs_iterator_cgroup() {
 
 #[test]
 fn test_tasks_iterator_cgroup_v1() {
-    if cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let pid = libc::pid_t::from(nix::unistd::getpid()) as u64;
     let cg = Cgroup::new(h, String::from("test_tasks_iterator_cgroup_v1")).unwrap();
     {
@@ -69,23 +71,23 @@ fn test_tasks_iterator_cgroup_v1() {
 
 #[test]
 fn test_tasks_iterator_cgroup_threaded_mode() {
-    if !cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if !cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
     let pid = libc::pid_t::from(nix::unistd::getpid()) as u64;
     let cg = Cgroup::new(
-        cgroups_rs::hierarchies::auto(),
+        cgroups_rs::fs::hierarchies::auto(),
         String::from("test_tasks_iterator_cgroup_threaded_mode"),
     )
     .unwrap();
     let cg_threaded_sub1 = Cgroup::new_with_specified_controllers(
-        cgroups_rs::hierarchies::auto(),
+        cgroups_rs::fs::hierarchies::auto(),
         String::from("test_tasks_iterator_cgroup_threaded_mode/threaded_sub1"),
         Some(vec![String::from("cpuset"), String::from("cpu")]),
     )
     .unwrap();
     let cg_threaded_sub2 = Cgroup::new_with_specified_controllers(
-        cgroups_rs::hierarchies::auto(),
+        cgroups_rs::fs::hierarchies::auto(),
         String::from("test_tasks_iterator_cgroup_threaded_mode/threaded_sub2"),
         Some(vec![String::from("cpuset"), String::from("cpu")]),
     )
@@ -163,10 +165,10 @@ fn test_tasks_iterator_cgroup_threaded_mode() {
 
 #[test]
 fn test_kill_cgroup() {
-    if !cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if !cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_kill_cgroup")).unwrap();
     {
         // Spawn a proc, don't want to getpid(2) here.
@@ -206,10 +208,10 @@ fn test_kill_cgroup() {
 
 #[test]
 fn test_cgroup_with_relative_paths() {
-    if cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cgroup_root = h.root();
     let cgroup_name = "test_cgroup_with_relative_paths";
 
@@ -247,10 +249,10 @@ fn test_cgroup_with_relative_paths() {
 
 #[test]
 fn test_cgroup_v2() {
-    if !cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if !cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_v2")).unwrap();
 
     let mem_controller: &MemController = cg.controller_of().unwrap();

tests/cpu.rs

@@ -4,12 +4,12 @@
 //
 
 //! Simple unit tests about the CPU control groups system.
-use cgroups_rs::cpu::CpuController;
-use cgroups_rs::Cgroup;
+use cgroups_rs::fs::cpu::CpuController;
+use cgroups_rs::fs::Cgroup;
 
 #[test]
 fn test_cfs_quota_and_periods() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_cfs_quota_and_periods")).unwrap();
 
     let cpu_controller: &CpuController = cg.controller_of().unwrap();

tests/cpuset.rs

@@ -3,16 +3,16 @@
 //
 // SPDX-License-Identifier: Apache-2.0 or MIT
 //
-
-use cgroups_rs::cpuset::CpuSetController;
-use cgroups_rs::error::ErrorKind;
-use cgroups_rs::{Cgroup, CgroupPid};
-
 use std::fs;
 
+use cgroups_rs::fs::cpuset::CpuSetController;
+use cgroups_rs::fs::error::ErrorKind;
+use cgroups_rs::fs::Cgroup;
+use cgroups_rs::CgroupPid;
+
 #[test]
 fn test_cpuset_memory_pressure_root_cg() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_cpuset_memory_pressure_root_cg")).unwrap();
     {
         let cpuset: &CpuSetController = cg.controller_of().unwrap();
@@ -26,7 +26,7 @@ fn test_cpuset_memory_pressure_root_cg() {
 
 #[test]
 fn test_cpuset_set_cpus() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_cpuset_set_cpus")).unwrap();
     {
         let cpuset: &CpuSetController = cg.controller_of().unwrap();
@@ -63,7 +63,7 @@ fn test_cpuset_set_cpus() {
 
 #[test]
 fn test_cpuset_set_cpus_add_task() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_cpuset_set_cpus_add_task/sub-dir")).unwrap();
 
     let cpuset: &CpuSetController = cg.controller_of().unwrap();

tests/devices.rs

@@ -6,17 +6,17 @@
 
 //! Integration tests about the devices subsystem
 
-use cgroups_rs::devices::{DevicePermissions, DeviceType, DevicesController};
-use cgroups_rs::{Cgroup, DeviceResource};
+use cgroups_rs::fs::devices::{DevicePermissions, DeviceType, DevicesController};
+use cgroups_rs::fs::{Cgroup, DeviceResource};
 
 #[test]
 fn test_devices_parsing() {
     // now only v2
-    if cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
 
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_devices_parsing")).unwrap();
     {
         let devices: &DevicesController = cg.controller_of().unwrap();

tests/hugetlb.rs

@@ -4,19 +4,19 @@
 //
 
 //! Integration tests about the hugetlb subsystem
-use cgroups_rs::error::*;
-use cgroups_rs::hugetlb::{self, HugeTlbController};
-use cgroups_rs::Cgroup;
+use cgroups_rs::fs::error::*;
+use cgroups_rs::fs::hugetlb::{self, HugeTlbController};
+use cgroups_rs::fs::Cgroup;
 use std::fs;
 
 #[test]
 fn test_hugetlb_sizes() {
     // now only v2
-    if cgroups_rs::hierarchies::is_cgroup2_unified_mode() {
+    if cgroups_rs::fs::hierarchies::is_cgroup2_unified_mode() {
         return;
     }
 
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_hugetlb_sizes")).unwrap();
     {
         let hugetlb_controller: &HugeTlbController = cg.controller_of().unwrap();

tests/memory.rs

@@ -4,13 +4,12 @@
 //
 
 //! Integration tests about the hugetlb subsystem
-use cgroups_rs::memory::{MemController, SetMemory};
-use cgroups_rs::Controller;
-use cgroups_rs::{Cgroup, MaxValue};
+use cgroups_rs::fs::memory::{MemController, SetMemory};
+use cgroups_rs::fs::{Cgroup, Controller, MaxValue};
 
 #[test]
 fn test_disable_oom_killer() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_disable_oom_killer")).unwrap();
     {
         let mem_controller: &MemController = cg.controller_of().unwrap();
@@ -35,7 +34,7 @@ fn test_disable_oom_killer() {
 
 #[test]
 fn set_kmem_limit_v1() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     if h.v2() {
         return;
     }
@@ -50,7 +49,7 @@ fn set_kmem_limit_v1() {
 
 #[test]
 fn set_mem_v2() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     if !h.v2() {
         return;
     }

tests/pids.rs

@@ -5,18 +5,15 @@
 //
 
 //! Integration tests about the pids subsystem
-use cgroups_rs::pid::PidController;
-use cgroups_rs::Controller;
-use cgroups_rs::{Cgroup, MaxValue};
-
+use cgroups_rs::fs::pid::PidController;
+use cgroups_rs::fs::{Cgroup, Controller, MaxValue};
+use libc::pid_t;
 use nix::sys::wait::{waitpid, WaitStatus};
 use nix::unistd::{fork, ForkResult};
 
-use libc::pid_t;
-
 #[test]
 fn create_and_delete_cgroup() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("create_and_delete_cgroup")).unwrap();
     {
         let pidcontroller: &PidController = cg.controller_of().unwrap();
@@ -30,7 +27,7 @@ fn create_and_delete_cgroup() {
 
 #[test]
 fn test_pids_current_is_zero() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_pids_current_is_zero")).unwrap();
     {
         let pidcontroller: &PidController = cg.controller_of().unwrap();
@@ -42,7 +39,7 @@ fn test_pids_current_is_zero() {
 
 #[test]
 fn test_pids_events_is_zero() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_pids_events_is_zero")).unwrap();
     {
         let pidcontroller: &PidController = cg.controller_of().unwrap();
@@ -55,7 +52,7 @@ fn test_pids_events_is_zero() {
 
 #[test]
 fn test_pid_events_is_not_zero() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("test_pid_events_is_not_zero")).unwrap();
     {
         let pids: &PidController = cg.controller_of().unwrap();

tests/resources.rs

@@ -5,12 +5,12 @@
 //
 
 //! Integration test about setting resources using `apply()`
-use cgroups_rs::pid::PidController;
-use cgroups_rs::{Cgroup, MaxValue, PidResources, Resources};
+use cgroups_rs::fs::pid::PidController;
+use cgroups_rs::fs::{Cgroup, MaxValue, PidResources, Resources};
 
 #[test]
 fn pid_resources() {
-    let h = cgroups_rs::hierarchies::auto();
+    let h = cgroups_rs::fs::hierarchies::auto();
     let cg = Cgroup::new(h, String::from("pid_resources")).unwrap();
     {
         let res = Resources {