libcontainer: ability to compile without kmem

[kolyshkin]

Commit fe898e7 (PR #1350) enables kernel memory accounting
for all cgroups created by libcontainer -- even if kmem limit is
not configured.

Kernel memory accounting is known to be broken in some kernels,
specifically the ones from RHEL7 (including RHEL 7.5). Those
kernels do not support kernel memory reclaim, and are prone to
oopses. Unconditionally enabling kmem acct on such kernels lead
to bugs, such as

• Enabling kmem accounting can break applications on CentOS7 #1725
• application crash due to k8s 1.9.x open the kernel memory accounting by default kubernetes/kubernetes#61937
• Kernel not freeing memory cgroup causing no space left on device moby/moby#29638

This commit gives a way to compile runc without kernel memory setting
support. To do so, use something like

make BUILDTAGS="seccomp nokmem"

Signed-off-by: Kir Kolyshkin kolyshkin@gmail.com

[kolyshkin]

This is an alternative to #1920

[crosbymichael]

I think this could be a safe change in addition to #1920. What do you think?

[mrunalp]

I prefer this over #1920

[kolyshkin]

I think this could be a safe change in addition to #1920. What do you think?

If you approve #1920 then I guess this one is not needed -- the only kernels we see this issue is RHEL7 ones -- everyone else, including ancient Ubuntu 16.04, is using more recent kernels with kmem controller rewritten.

[mrunalp]

LGTM

[cyphar]

LGTM.

[cyphar]

(and pullapprove is broken again! yay!)