beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Limit OOMScoreAdj when running in UserNS ("Rootful-in-Rootless")

Browse source 
Fix issue 46563 "Rootful-in-Rootless dind doesn't work since systemd v250 (due to oom score adj)"

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
(cherry picked from commit ad877271f3)
> Conflicts:
>	daemon/oci_linux.go
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2023-09-29 20:31:22 +09:00
parent 3b09657d72
commit 58c1c7b8dc
No known key found for this signature in database
GPG key ID: 49524C6F9F638F1A
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
daemon/oci_linux.go
View file

@ -113,6 +113,15 @@ func WithRootless(daemon *Daemon) coci.SpecOpts {
}
}
// withRootfulInRootless is used for "rootful-in-rootless" dind;
// the daemon is running in UserNS but has no access to RootlessKit API socket, host filesystem, etc.
func withRootfulInRootless(daemon *Daemon, daemonCfg *dconfig.Config) coci.SpecOpts {
return func(_ context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
specconv.ToRootfulInRootless(s)
return nil
}
}
// WithOOMScore sets the oom score
func WithOOMScore(score *int) coci.SpecOpts {
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
@ -1091,6 +1100,8 @@ func (daemon *Daemon) createSpec(ctx context.Context, c *container.Container) (r
}
if daemon.configStore.Rootless {
opts = append(opts, WithRootless(daemon))
} else if userns.RunningInUserNS() {
opts = append(opts, withRootfulInRootless(daemon, daemon.configStore))
}
var snapshotter, snapshotKey string

14
pkg/rootless/specconv/specconv_linux.go
View file

@ -12,6 +12,20 @@ import (
"github.com/sirupsen/logrus"
)
// ToRootfulInRootless is used for "rootful-in-rootless" dind;
// the daemon is running in UserNS but has no access to RootlessKit API socket, host filesystem, etc.
//
// This fuction does:
// * Fix up OOMScoreAdj (needed since systemd v250: https://github.com/moby/moby/issues/46563)
func ToRootfulInRootless(spec *specs.Spec) {
if spec.Process == nil || spec.Process.OOMScoreAdj == nil {
return
}
if currentOOMScoreAdj := getCurrentOOMScoreAdj(); *spec.Process.OOMScoreAdj < currentOOMScoreAdj {
*spec.Process.OOMScoreAdj = currentOOMScoreAdj
}
}
// ToRootless converts spec to be compatible with "rootless" runc.
// * Remove non-supported cgroups
// * Fix up OOMScoreAdj