summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
authorcdoern <cdoern@redhat.com>2022-01-18 15:46:11 -0500
committercdoern <cdoern@redhat.com>2022-02-03 09:30:17 -0500
commit9eb88ea474c3f6160090573c4bae3fe4c5ece016 (patch)
tree3aaef20e0da547c9a1c0658707b1260a44eefae3 /pkg
parent55ad6188b067ba6594819c318dd2ae92dea2f27e (diff)
downloadpodman-9eb88ea474c3f6160090573c4bae3fe4c5ece016.tar.gz
podman-9eb88ea474c3f6160090573c4bae3fe4c5ece016.tar.bz2
podman-9eb88ea474c3f6160090573c4bae3fe4c5ece016.zip
Podman pod create --share-parent vs --share=cgroup
separated cgroupNS sharing from setting the pod as the cgroup parent, made a new flag --share-parent which sets the pod as the cgroup parent for all containers entering the pod remove cgroup from the default kernel namespaces since we want the same default behavior as before which is just the cgroup parent. resolves #12765 Signed-off-by: cdoern <cdoern@redhat.com> Signed-off-by: cdoern <cbdoer23@g.holycross.edu> Signed-off-by: cdoern <cdoern@redhat.com>
Diffstat (limited to 'pkg')
-rw-r--r--pkg/api/handlers/libpod/pods.go4
-rw-r--r--pkg/domain/entities/pods.go2
-rw-r--r--pkg/specgen/generate/namespaces.go2
-rw-r--r--pkg/specgen/generate/pod_create.go3
-rw-r--r--pkg/specgen/namespaces.go2
-rw-r--r--pkg/specgen/podspecgen.go2
6 files changed, 13 insertions, 2 deletions
diff --git a/pkg/api/handlers/libpod/pods.go b/pkg/api/handlers/libpod/pods.go
index 4b15c9675..5ebfdd034 100644
--- a/pkg/api/handlers/libpod/pods.go
+++ b/pkg/api/handlers/libpod/pods.go
@@ -42,6 +42,10 @@ func PodCreate(w http.ResponseWriter, r *http.Request) {
infraOptions.Net = &entities.NetOptions{}
infraOptions.Devices = psg.Devices
infraOptions.SecurityOpt = psg.SecurityOpt
+ if psg.ShareParent == nil {
+ t := true
+ psg.ShareParent = &t
+ }
err = specgenutil.FillOutSpecGen(psg.InfraContainerSpec, &infraOptions, []string{}) // necessary for default values in many cases (userns, idmappings)
if err != nil {
utils.Error(w, "Something went wrong.", http.StatusInternalServerError, errors.Wrap(err, "error filling out specgen"))
diff --git a/pkg/domain/entities/pods.go b/pkg/domain/entities/pods.go
index aeccc82b4..7922db4e6 100644
--- a/pkg/domain/entities/pods.go
+++ b/pkg/domain/entities/pods.go
@@ -132,6 +132,7 @@ type PodCreateOptions struct {
Name string `json:"name,omitempty"`
Net *NetOptions `json:"net,omitempty"`
Share []string `json:"share,omitempty"`
+ ShareParent *bool `json:"share_parent,omitempty"`
Pid string `json:"pid,omitempty"`
Cpus float64 `json:"cpus,omitempty"`
CpusetCpus string `json:"cpuset_cpus,omitempty"`
@@ -324,6 +325,7 @@ func ToPodSpecGen(s specgen.PodSpecGenerator, p *PodCreateOptions) (*specgen.Pod
}
s.InfraImage = p.InfraImage
s.SharedNamespaces = p.Share
+ s.ShareParent = p.ShareParent
s.PodCreateCommand = p.CreateCommand
s.VolumesFrom = p.VolumesFrom
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index 93d9caf4c..3f77cbe76 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -482,7 +482,7 @@ func GetNamespaceOptions(ns []string, netnsIsHost bool) ([]libpod.PodCreateOptio
for _, toShare := range ns {
switch toShare {
case "cgroup":
- options = append(options, libpod.WithPodCgroups())
+ options = append(options, libpod.WithPodCgroup())
case "net":
// share the netns setting with other containers in the pod only when it is not set to host
if !netnsIsHost {
diff --git a/pkg/specgen/generate/pod_create.go b/pkg/specgen/generate/pod_create.go
index 369ebda58..672a53eea 100644
--- a/pkg/specgen/generate/pod_create.go
+++ b/pkg/specgen/generate/pod_create.go
@@ -166,6 +166,9 @@ func createPodOptions(p *specgen.PodSpecGenerator, rt *libpod.Runtime, infraSpec
)
if !p.NoInfra { //&& infraSpec != nil {
options = append(options, libpod.WithInfraContainer())
+ if p.ShareParent == nil || (p.ShareParent != nil && *p.ShareParent) {
+ options = append(options, libpod.WithPodParent())
+ }
nsOptions, err := GetNamespaceOptions(p.SharedNamespaces, p.InfraContainerSpec.NetNS.IsHost())
if err != nil {
return nil, err
diff --git a/pkg/specgen/namespaces.go b/pkg/specgen/namespaces.go
index 1634b86b5..c1356bef4 100644
--- a/pkg/specgen/namespaces.go
+++ b/pkg/specgen/namespaces.go
@@ -57,7 +57,7 @@ const (
// DefaultKernelNamespaces is a comma-separated list of default kernel
// namespaces.
- DefaultKernelNamespaces = "cgroup,ipc,net,uts"
+ DefaultKernelNamespaces = "ipc,net,uts"
)
// Namespace describes the namespace
diff --git a/pkg/specgen/podspecgen.go b/pkg/specgen/podspecgen.go
index 62b4725a7..7b1115f5d 100644
--- a/pkg/specgen/podspecgen.go
+++ b/pkg/specgen/podspecgen.go
@@ -63,6 +63,8 @@ type PodBasicConfig struct {
// also be used by some tools that wish to recreate the pod
// (e.g. `podman generate systemd --new`).
// Optional.
+ // ShareParent determines if all containers in the pod will share the pod's cgroup as the cgroup parent
+ ShareParent *bool `json:"share_parent,omitempty"`
PodCreateCommand []string `json:"pod_create_command,omitempty"`
// Pid sets the process id namespace of the pod
// Optional (defaults to private if unset). This sets the PID namespace of the infra container