-
Notifications
You must be signed in to change notification settings - Fork 883
stage1: common: mount also the host cgroup hierarchy #1437
Conversation
With this PR I managed to run rkt on Void Linux without needing to do anything else. For it to work I needed to create and join a subcgroup (see last commit). Isolators don't work, I'll look into it next week. |
2f51931
to
de42c55
Compare
Isolators work now too in Void Linux |
I tried this and it works as advertised. Thanks @iaguis! |
de42c55
to
b84c2c0
Compare
// 1. Mount RW knobs we need to make the enabled isolators work | ||
for _, c := range controllers { | ||
cPath := filepath.Join(cgroupTmpfs, c) | ||
// 1a. Check if we're running from a unit to know which subcgroup |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The code below does not seem to check if you are running from a unit
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Right, comment rot
We'll need it for mounting the host cgroups too.
9bacdfe
to
7c8a789
Compare
var flags uintptr | ||
|
||
// 1. Mount /sys read-only | ||
// Mount /sys read-only |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
s/read-only//
To avoid problems on environments without a properly mounted cgroup hierarchy and/or without the systemd hierarchy we also mount the host cgroup hierarchy. Since we're in a different mount namespace the host is not affected.
systemd-nspawn doesn't allow the caller process to be in the root cgroup. If that is the case, we create and add ourselves to a new "rkt" subcgroup. Distributions like Void Linux put every process in the root cgroup by default so this allows rkt to work on them.
7c8a789
to
94b3fb5
Compare
LGTM if the tests pass. |
Thanks! |
stage1: common: mount also the host cgroup hierarchy
👍 |
Thanks for getting this done! I tried it and it works great. |
Yeah, thanks a lot @jaybuff! |
To avoid problems on environments without a properly mounted cgroup
hierarchy and/or without the systemd hierarchy we also deal with
mounting the host cgroup hierarchy.
Since we're in a different mount namespace the host is not affected.
Fixes #1320
Fixes #1076
Fixes #1042