diff options
| -rw-r--r-- | .cirrus.yml | 35 | ||||
| -rw-r--r-- | cmd/podman/common.go | 5 | ||||
| -rw-r--r-- | cmd/podman/shared/create.go | 7 | ||||
| -rw-r--r-- | cmd/podman/start.go | 3 | ||||
| -rw-r--r-- | contrib/cirrus/lib.sh | 4 | ||||
| -rw-r--r-- | contrib/cirrus/packer/fedora_setup.sh | 1 | ||||
| -rw-r--r-- | contrib/varlink/io.podman.socket | 1 | ||||
| -rw-r--r-- | docs/podman-create.1.md | 2 | ||||
| -rw-r--r-- | docs/podman-run.1.md | 2 | ||||
| -rw-r--r-- | pkg/spec/spec.go | 23 | ||||
| -rw-r--r-- | pkg/sysinfo/sysinfo.go | 9 | ||||
| -rw-r--r-- | pkg/sysinfo/sysinfo_linux.go | 15 |
12 files changed, 58 insertions, 49 deletions
diff --git a/.cirrus.yml b/.cirrus.yml index 5d6cfefd0..71fa68d45 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -30,7 +30,7 @@ env: #### #### Cache-image names to test with (double-quotes around names are critical) ### - _BUILT_IMAGE_SUFFIX: "libpod-5816955207942144" + _BUILT_IMAGE_SUFFIX: "libpod-6296905679634432" FEDORA_CACHE_IMAGE_NAME: "fedora-30-${_BUILT_IMAGE_SUFFIX}" PRIOR_FEDORA_CACHE_IMAGE_NAME: "fedora-29-${_BUILT_IMAGE_SUFFIX}" SPECIAL_FEDORA_CACHE_IMAGE_NAME: "xfedora-30-${_BUILT_IMAGE_SUFFIX}" @@ -370,38 +370,6 @@ testing_task: journal_script: '$SCRIPT_BASE/logcollector.sh journal' varlink_script: '$SCRIPT_BASE/logcollector.sh varlink' -# Test crun only on latest Fedora -testing_crun_task: - - depends_on: - - "gating" - - "vendor" - - "varlink_api" - - "build_each_commit" - - "build_without_cgo" - - # Only test build cache-images, if that's what's requested - only_if: $CIRRUS_CHANGE_MESSAGE !=~ '.*\*\*\*\s*CIRRUS:\s*TEST\s*IMAGES\s*\*\*\*.*' - - timeout_in: 120m - - env: - ADD_SECOND_PARTITION: true - OCI_RUNTIME: "/usr/bin/crun" - - networking_script: '${CIRRUS_WORKING_DIR}/${SCRIPT_BASE}/networking.sh' - setup_environment_script: '$SCRIPT_BASE/setup_environment.sh |& ${TIMESTAMP}' - install_crun_script: 'dnf install -y crun' - unit_test_script: '$SCRIPT_BASE/unit_test.sh |& ${TIMESTAMP}' - integration_test_script: '$SCRIPT_BASE/integration_test.sh |& ${TIMESTAMP}' - system_test_script: '$SCRIPT_BASE/system_test.sh |& ${TIMESTAMP}' - - on_failure: - failed_branch_script: '$CIRRUS_WORKING_DIR/$SCRIPT_BASE/notice_branch_failure.sh' - - always: - <<: *standardlogs - # This task executes tests under unique environments/conditions special_testing_rootless_task: @@ -687,7 +655,6 @@ success_task: - "meta" - "image_prune" - "testing" - - "testing_crun" - "special_testing_rootless" - "special_testing_in_podman" - "special_testing_cgroupv2" diff --git a/cmd/podman/common.go b/cmd/podman/common.go index 0115e6ef1..2a3f8f3ad 100644 --- a/cmd/podman/common.go +++ b/cmd/podman/common.go @@ -11,6 +11,7 @@ import ( "github.com/containers/libpod/cmd/podman/shared" "github.com/containers/libpod/libpod/define" "github.com/containers/libpod/pkg/rootless" + "github.com/containers/libpod/pkg/sysinfo" "github.com/fatih/camelcase" jsoniter "github.com/json-iterator/go" "github.com/pkg/errors" @@ -374,8 +375,8 @@ func getCreateFlags(c *cliconfig.PodmanCommand) { "PID namespace to use", ) createFlags.Int64( - "pids-limit", 0, - "Tune container pids limit (set -1 for unlimited)", + "pids-limit", sysinfo.GetDefaultPidsLimit(), + "Tune container pids limit (set 0 for unlimited)", ) createFlags.String( "pod", "", diff --git a/cmd/podman/shared/create.go b/cmd/podman/shared/create.go index c9b05d2c4..9020613c5 100644 --- a/cmd/podman/shared/create.go +++ b/cmd/podman/shared/create.go @@ -686,6 +686,11 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod. logDriver = c.String("log-driver") } + pidsLimit := c.Int64("pids-limit") + if c.String("cgroups") == "disabled" && !c.Changed("pids-limit") { + pidsLimit = 0 + } + config := &cc.CreateConfig{ Annotations: annotations, BuiltinImgVolumes: ImageVolumes, @@ -764,7 +769,7 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod. MemorySwappiness: int(memorySwappiness), KernelMemory: memoryKernel, OomScoreAdj: c.Int("oom-score-adj"), - PidsLimit: c.Int64("pids-limit"), + PidsLimit: pidsLimit, Ulimit: c.StringSlice("ulimit"), }, RestartPolicy: c.String("restart"), diff --git a/cmd/podman/start.go b/cmd/podman/start.go index 737a6d9f1..2d2cf74d2 100644 --- a/cmd/podman/start.go +++ b/cmd/podman/start.go @@ -60,6 +60,9 @@ func startCmd(c *cliconfig.StartValues) error { } sigProxy := c.SigProxy || attach + if c.Flag("sig-proxy").Changed { + sigProxy = c.SigProxy + } if sigProxy && !attach { return errors.Wrapf(define.ErrInvalidArg, "you cannot use sig-proxy without --attach") diff --git a/contrib/cirrus/lib.sh b/contrib/cirrus/lib.sh index f1ddd65da..8a7d3c1a3 100644 --- a/contrib/cirrus/lib.sh +++ b/contrib/cirrus/lib.sh @@ -373,8 +373,8 @@ remove_packaged_podman_files() { # yum/dnf/dpkg may list system directories, only remove files $LISTING_CMD | while read fullpath do - # TODO: This can go away when conmon gets it's own package - if [[ -d "$fullpath" ]] || [[ $(basename "$fullpath") == "conmon" ]] ; then continue; fi + # Sub-directories may contain unrelated/valuable stuff + if [[ -d "$fullpath" ]]; then continue; fi ooe.sh sudo rm -vf "$fullpath" done diff --git a/contrib/cirrus/packer/fedora_setup.sh b/contrib/cirrus/packer/fedora_setup.sh index 679ad3b8d..38b9e6860 100644 --- a/contrib/cirrus/packer/fedora_setup.sh +++ b/contrib/cirrus/packer/fedora_setup.sh @@ -31,6 +31,7 @@ ooe.sh sudo dnf install -y \ bridge-utils \ btrfs-progs-devel \ bzip2 \ + conmon \ container-selinux \ containernetworking-plugins \ containers-common \ diff --git a/contrib/varlink/io.podman.socket b/contrib/varlink/io.podman.socket index 629a5dd20..f6a3ddc49 100644 --- a/contrib/varlink/io.podman.socket +++ b/contrib/varlink/io.podman.socket @@ -8,4 +8,3 @@ SocketMode=0600 [Install] WantedBy=sockets.target -Also=multi-user.target diff --git a/docs/podman-create.1.md b/docs/podman-create.1.md index c088f3e94..46fa4fcd4 100644 --- a/docs/podman-create.1.md +++ b/docs/podman-create.1.md @@ -552,7 +552,7 @@ Default is to create a private PID namespace for the container **--pids-limit**=*limit* -Tune the container's pids limit. Set `-1` to have unlimited pids for the container. +Tune the container's pids limit. Set `0` to have unlimited pids for the container. (default "4096" on systems that support PIDS cgroups). **--pod**=*name* diff --git a/docs/podman-run.1.md b/docs/podman-run.1.md index d677f8262..dfc634288 100644 --- a/docs/podman-run.1.md +++ b/docs/podman-run.1.md @@ -565,7 +565,7 @@ Default is to create a private PID namespace for the container **--pids-limit**=*limit* -Tune the container's pids limit. Set `-1` to have unlimited pids for the container. +Tune the container's pids limit. Set `0` to have unlimited pids for the container. (default "4096" on systems that support PIDS cgroups). **--pod**=*name* diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go index c7aa003e8..57c6e8da7 100644 --- a/pkg/spec/spec.go +++ b/pkg/spec/spec.go @@ -7,6 +7,7 @@ import ( "github.com/containers/libpod/libpod" "github.com/containers/libpod/pkg/cgroups" "github.com/containers/libpod/pkg/rootless" + "github.com/containers/libpod/pkg/sysinfo" "github.com/docker/docker/oci/caps" "github.com/docker/go-units" "github.com/opencontainers/runc/libcontainer/user" @@ -300,9 +301,25 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM blockAccessToKernelFilesystems(config, &g) // RESOURCES - PIDS - if config.Resources.PidsLimit != 0 { - g.SetLinuxResourcesPidsLimit(config.Resources.PidsLimit) - addedResources = true + if config.Resources.PidsLimit > 0 { + // if running on rootless on a cgroupv1 machine, pids limit is + // not supported. If the value is still the default + // then ignore the settings. If the caller asked for a + // non-default, then try to use it. + setPidLimit := true + if rootless.IsRootless() { + cgroup2, err := cgroups.IsCgroup2UnifiedMode() + if err != nil { + return nil, err + } + if !cgroup2 && config.Resources.PidsLimit == sysinfo.GetDefaultPidsLimit() { + setPidLimit = false + } + } + if setPidLimit { + g.SetLinuxResourcesPidsLimit(config.Resources.PidsLimit) + addedResources = true + } } for name, val := range config.Env { diff --git a/pkg/sysinfo/sysinfo.go b/pkg/sysinfo/sysinfo.go index f046de4b1..686f66ce5 100644 --- a/pkg/sysinfo/sysinfo.go +++ b/pkg/sysinfo/sysinfo.go @@ -142,3 +142,12 @@ func popcnt(x uint64) (n byte) { x *= 0x0101010101010101 return byte(x >> 56) } + +// GetDefaultPidsLimit returns the default pids limit to run containers with +func GetDefaultPidsLimit() int64 { + sysInfo := New(true) + if !sysInfo.PidsLimit { + return 0 + } + return 4096 +} diff --git a/pkg/sysinfo/sysinfo_linux.go b/pkg/sysinfo/sysinfo_linux.go index 9e675c655..76bda23c6 100644 --- a/pkg/sysinfo/sysinfo_linux.go +++ b/pkg/sysinfo/sysinfo_linux.go @@ -7,6 +7,7 @@ import ( "path" "strings" + cg "github.com/containers/libpod/pkg/cgroups" "github.com/opencontainers/runc/libcontainer/cgroups" "github.com/sirupsen/logrus" "golang.org/x/sys/unix" @@ -227,12 +228,18 @@ func checkCgroupCpusetInfo(cgMounts map[string]string, quiet bool) cgroupCpusetI // checkCgroupPids reads the pids information from the pids cgroup mount point. func checkCgroupPids(quiet bool) cgroupPids { - _, err := cgroups.FindCgroupMountpoint("", "pids") + cgroup2, err := cg.IsCgroup2UnifiedMode() if err != nil { - if !quiet { - logrus.Warn(err) + logrus.Errorf("Failed to check cgroups version: %v", err) + } + if !cgroup2 { + _, err := cgroups.FindCgroupMountpoint("", "pids") + if err != nil { + if !quiet { + logrus.Warn(err) + } + return cgroupPids{} } - return cgroupPids{} } return cgroupPids{ |