diff options
| author | Ralf Haferkamp <rhafer@suse.com> | 2020-06-26 11:14:35 +0200 |
|---|---|---|
| committer | Matthew Heon <matthew.heon@pm.me> | 2020-07-06 14:21:53 -0400 |
| commit | 626aeffc559b8aea0f24ac5f7506ba1eacb6f9e3 (patch) | |
| tree | ccf1c6934726d272c364cd5311af48bbd418dd7c | |
| parent | 0b7885b90a959f0552a481bcf7b27aa58d753d53 (diff) | |
| download | podman-626aeffc559b8aea0f24ac5f7506ba1eacb6f9e3.tar.gz podman-626aeffc559b8aea0f24ac5f7506ba1eacb6f9e3.tar.bz2 podman-626aeffc559b8aea0f24ac5f7506ba1eacb6f9e3.zip | |
specgen: fix order for setting rlimits
Also make sure that the limits we set for rootless are not higher than
what we'd set for root containers.
Rootless containers failed to start when the calling user already
had ulimit (e.g. on NOFILE) set.
This is basically a cherry-pick of 76f8efc0d0d into specgen
Signed-off-by: Ralf Haferkamp <rhafer@suse.com>
| -rw-r--r-- | pkg/specgen/generate/oci.go | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/pkg/specgen/generate/oci.go b/pkg/specgen/generate/oci.go index 3732d5431..0a485e7cd 100644 --- a/pkg/specgen/generate/oci.go +++ b/pkg/specgen/generate/oci.go @@ -52,10 +52,14 @@ func addRlimits(s *specgen.SpecGenerator, g *generate.Generator) error { if err := unix.Getrlimit(unix.RLIMIT_NOFILE, &rlimit); err != nil { logrus.Warnf("failed to return RLIMIT_NOFILE ulimit %q", err) } - current = rlimit.Cur - max = rlimit.Max + if rlimit.Cur < current { + current = rlimit.Cur + } + if rlimit.Max < max { + max = rlimit.Max + } } - g.AddProcessRlimits("RLIMIT_NOFILE", current, max) + g.AddProcessRlimits("RLIMIT_NOFILE", max, current) } if !nprocSet { max := kernelMax @@ -65,10 +69,14 @@ func addRlimits(s *specgen.SpecGenerator, g *generate.Generator) error { if err := unix.Getrlimit(unix.RLIMIT_NPROC, &rlimit); err != nil { logrus.Warnf("failed to return RLIMIT_NPROC ulimit %q", err) } - current = rlimit.Cur - max = rlimit.Max + if rlimit.Cur < current { + current = rlimit.Cur + } + if rlimit.Max < max { + max = rlimit.Max + } } - g.AddProcessRlimits("RLIMIT_NPROC", current, max) + g.AddProcessRlimits("RLIMIT_NPROC", max, current) } return nil |