0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #46564 from AkihiroSuda/fix-46563

Browse source 
Limit OOMScoreAdj when running in UserNS ("Rootful-in-Rootless")
This commit is contained in:
Bjorn Neergaard 2023-10-11 12:06:18 -07:00 • committed by GitHub
commit bea1462f4f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
daemon/oci_linux.go
View file

@ -110,6 +110,15 @@ func withRootless(daemon *Daemon, daemonCfg *dconfig.Config) coci.SpecOpts {
}
}
// withRootfulInRootless is used for "rootful-in-rootless" dind;
// the daemon is running in UserNS but has no access to RootlessKit API socket, host filesystem, etc.
func withRootfulInRootless(daemon *Daemon, daemonCfg *dconfig.Config) coci.SpecOpts {
return func(_ context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
specconv.ToRootfulInRootless(s)
return nil
}
}
// WithOOMScore sets the oom score
func WithOOMScore(score *int) coci.SpecOpts {
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
@ -1126,6 +1135,8 @@ func (daemon *Daemon) createSpec(ctx context.Context, daemonCfg *configStore, c
}
if daemonCfg.Rootless {
opts = append(opts, withRootless(daemon, &daemonCfg.Config))
} else if userns.RunningInUserNS() {
opts = append(opts, withRootfulInRootless(daemon, &daemonCfg.Config))
}
var snapshotter, snapshotKey string

14
pkg/rootless/specconv/specconv_linux.go
View file

@ -13,6 +13,20 @@ import (
specs "github.com/opencontainers/runtime-spec/specs-go"
)
// ToRootfulInRootless is used for "rootful-in-rootless" dind;
// the daemon is running in UserNS but has no access to RootlessKit API socket, host filesystem, etc.
//
// This fuction does:
// * Fix up OOMScoreAdj (needed since systemd v250: https://github.com/moby/moby/issues/46563)
func ToRootfulInRootless(spec *specs.Spec) {
if spec.Process == nil || spec.Process.OOMScoreAdj == nil {
return
}
if currentOOMScoreAdj := getCurrentOOMScoreAdj(); *spec.Process.OOMScoreAdj < currentOOMScoreAdj {
*spec.Process.OOMScoreAdj = currentOOMScoreAdj
}
}
// ToRootless converts spec to be compatible with "rootless" runc.
// * Remove non-supported cgroups
// * Fix up OOMScoreAdj