From 8d0c8da122f70f28024699123b22e7208aac3714 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 16 Aug 2021 17:30:16 -0700 Subject: [PATCH] libct/cg/sd/v1: add SkipFreezeOnSet knob This is helpful to kubernetes in cases it knows for sure that the freeze is not required (since it created the systemd unit with no device restrictions). As the code is trivial, no tests are required. Signed-off-by: Kir Kolyshkin (cherry picked from commit f2d67bce32d97c1501578e9eea01e93393e858fa) Signed-off-by: Kir Kolyshkin --- libcontainer/cgroups/systemd/v1.go | 5 +++++ libcontainer/configs/cgroup_linux.go | 12 ++++++++++++ 2 files changed, 17 insertions(+) diff --git a/libcontainer/cgroups/systemd/v1.go b/libcontainer/cgroups/systemd/v1.go index 55d522bac21..a2eceb88d9b 100644 --- a/libcontainer/cgroups/systemd/v1.go +++ b/libcontainer/cgroups/systemd/v1.go @@ -374,6 +374,11 @@ func (m *legacyManager) freezeBeforeSet(unitName string, r *configs.Resources) ( // Special case for SkipDevices, as used by Kubernetes to create pod // cgroups with allow-all device policy). if r.SkipDevices { + if r.SkipFreezeOnSet { + // Both needsFreeze and needsThaw are false. + return + } + // No need to freeze if SkipDevices is set, and either // (1) systemd unit does not (yet) exist, or // (2) it has DevicePolicy=auto and empty DeviceAllow list diff --git a/libcontainer/configs/cgroup_linux.go b/libcontainer/configs/cgroup_linux.go index a1e7f0afd44..5ea9d940cef 100644 --- a/libcontainer/configs/cgroup_linux.go +++ b/libcontainer/configs/cgroup_linux.go @@ -131,4 +131,16 @@ type Resources struct { // // NOTE it is impossible to start a container which has this flag set. SkipDevices bool `json:"-"` + + // SkipFreezeOnSet is a flag for cgroup manager to skip the cgroup + // freeze when setting resources. Only applicable to systemd legacy + // (i.e. cgroup v1) manager (which uses freeze by default to avoid + // spurious permission errors caused by systemd inability to update + // device rules in a non-disruptive manner). + // + // If not set, a few methods (such as looking into cgroup's + // devices.list and querying the systemd unit properties) are used + // during Set() to figure out whether the freeze is required. Those + // methods may be relatively slow, thus this flag. + SkipFreezeOnSet bool `json:"-"` }