External/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-01-25 14:05:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

lxc: don't try to hide parent cgroups inside container

Browse Source 
On the host when we start a container, it will be
placed in a cgroup path of

   /machine.slice/machine-lxc\x2ddemo.scope

under /sys/fs/cgroup/*

Inside the containers' namespace we need to setup
/sys/fs/cgroup mounts, and currently will bind
mount /machine.slice/machine-lxc\x2ddemo.scope on
the host to appear as / in the container.

While this may sound nice, it confuses applications
dealing with cgroups, because /proc/$PID/cgroup
now does not match the directory in /sys/fs/cgroup

This particularly causes problems for systems and
will make it create repeated path components in
the cgroup for apps run in the container eg

  /machine.slice/machine-lxc\x2ddemo.scope/machine.slice/machine-lxc\x2ddemo.scope/user.slice/user-0.slice/session-61.scope

This also causes any systemd service that uses
sd-notify to fail to start, because when systemd
receives the notification it won't be able to
identify the corresponding unit it came from.
In particular this break rabbitmq-server startup

Future kernels will provide proper cgroup namespacing
which will handle this problem, but until that time
we should not try to play games with hiding parent
cgroups.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrange 2016-01-22 16:07:18 +00:00
parent 511e7c5bba
commit dc576025c3
4 changed files with 9 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/libvirt_private.syms
View File

@ -1196,6 +1196,7 @@ virCgroupAllowDevice;
virCgroupAllowDeviceMajor; virCgroupAllowDeviceMajor;
virCgroupAllowDevicePath; virCgroupAllowDevicePath;
virCgroupAvailable; virCgroupAvailable;
virCgroupBindMount;
virCgroupControllerAvailable; virCgroupControllerAvailable;
virCgroupControllerTypeFromString; virCgroupControllerTypeFromString;
virCgroupControllerTypeToString; virCgroupControllerTypeToString;
@ -1233,7 +1234,6 @@ virCgroupGetMemSwapUsage;
virCgroupGetPercpuStats; virCgroupGetPercpuStats;
virCgroupHasController; virCgroupHasController;
virCgroupHasEmptyTasks; virCgroupHasEmptyTasks;
virCgroupIsolateMount;
virCgroupKill; virCgroupKill;
virCgroupKillPainfully; virCgroupKillPainfully;
virCgroupKillRecursive; virCgroupKillRecursive;

2
src/lxc/lxc_container.c
View File

@ -1827,7 +1827,7 @@ static int lxcContainerSetupPivotRoot(virDomainDefPtr vmDef,
/* Now we can re-mount the cgroups controllers in the /* Now we can re-mount the cgroups controllers in the
* same configuration as before */ * same configuration as before */
if (virCgroupIsolateMount(cgroup, "/.oldroot/", sec_mount_options) < 0) if (virCgroupBindMount(cgroup, "/.oldroot/", sec_mount_options) < 0)
goto cleanup; goto cleanup;
/* Mounts /dev */ /* Mounts /dev */

7
src/util/vircgroup.c
View File

@ -3917,7 +3917,7 @@ virCgroupGetFreezerState(virCgroupPtr group, char **state)
int int
virCgroupIsolateMount(virCgroupPtr group, const char *oldroot, virCgroupBindMount(virCgroupPtr group, const char *oldroot,
const char *mountopts) const char *mountopts)
{ {
int ret = -1; int ret = -1;
@ -3954,10 +3954,9 @@ virCgroupIsolateMount(virCgroupPtr group, const char *oldroot,
if (!virFileExists(group->controllers[i].mountPoint)) { if (!virFileExists(group->controllers[i].mountPoint)) {
char *src; char *src;
if (virAsprintf(&src, "%s%s%s", if (virAsprintf(&src, "%s%s",
oldroot, oldroot,
group->controllers[i].mountPoint, group->controllers[i].mountPoint) < 0)
group->controllers[i].placement) < 0)
goto cleanup; goto cleanup;
VIR_DEBUG("Create mount point '%s'", VIR_DEBUG("Create mount point '%s'",

2
src/util/vircgroup.h
View File

@ -286,7 +286,7 @@ int virCgroupKill(virCgroupPtr group, int signum);
int virCgroupKillRecursive(virCgroupPtr group, int signum); int virCgroupKillRecursive(virCgroupPtr group, int signum);
int virCgroupKillPainfully(virCgroupPtr group); int virCgroupKillPainfully(virCgroupPtr group);
int virCgroupIsolateMount(virCgroupPtr group, int virCgroupBindMount(virCgroupPtr group,
const char *oldroot, const char *oldroot,
const char *mountopts); const char *mountopts);