beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request #46627 from AkihiroSuda/cherrypick-46564-23

Browse source 
[23.0 backport] Limit OOMScoreAdj when running in UserNS ("Rootful-in-Rootless")
This commit is contained in:
Sebastiaan van Stijn 2023-10-12 08:52:48 +02:00 committed by GitHub
commit af23b5ad8e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
daemon/oci_linux.go
View file

@ -114,6 +114,15 @@ func WithRootless(daemon *Daemon) coci.SpecOpts {
}
}
// withRootfulInRootless is used for "rootful-in-rootless" dind;
// the daemon is running in UserNS but has no access to RootlessKit API socket, host filesystem, etc.
func withRootfulInRootless(daemon *Daemon, daemonCfg *dconfig.Config) coci.SpecOpts {
return func(_ context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
specconv.ToRootfulInRootless(s)
return nil
}
}
// WithOOMScore sets the oom score
func WithOOMScore(score *int) coci.SpecOpts {
return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
@ -1094,6 +1103,8 @@ func (daemon *Daemon) createSpec(c *container.Container) (retSpec *specs.Spec, e
}
if daemon.configStore.Rootless {
opts = append(opts, WithRootless(daemon))
} else if userns.RunningInUserNS() {
opts = append(opts, withRootfulInRootless(daemon, daemon.configStore))
}
return &s, coci.ApplyOpts(context.Background(), nil, &containers.Container{
ID: c.ID,

14
pkg/rootless/specconv/specconv_linux.go
View file

@ -12,6 +12,20 @@ import (
"github.com/sirupsen/logrus"
)
// ToRootfulInRootless is used for "rootful-in-rootless" dind;
// the daemon is running in UserNS but has no access to RootlessKit API socket, host filesystem, etc.
//
// This fuction does:
// * Fix up OOMScoreAdj (needed since systemd v250: https://github.com/moby/moby/issues/46563)
func ToRootfulInRootless(spec *specs.Spec) {
if spec.Process == nil || spec.Process.OOMScoreAdj == nil {
return
}
if currentOOMScoreAdj := getCurrentOOMScoreAdj(); *spec.Process.OOMScoreAdj < currentOOMScoreAdj {
*spec.Process.OOMScoreAdj = currentOOMScoreAdj
}
}
// ToRootless converts spec to be compatible with "rootless" runc.
// * Remove non-supported cgroups
// * Fix up OOMScoreAdj