Skip to content

Commit

Permalink
Add a setting for enabling cgroups
Browse files Browse the repository at this point in the history
  • Loading branch information
edolstra committed Nov 28, 2022
1 parent ff12d1c commit 67bcb99
Show file tree
Hide file tree
Showing 4 changed files with 27 additions and 10 deletions.
5 changes: 3 additions & 2 deletions doc/manual/src/release-notes/rl-next.md
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,11 @@

```
extra-experimental-features = cgroups
use-cgroups = true
```

to `nix.conf`. It is also automatically enabled for builds that
require the `uid-range` system feature.
to `nix.conf`. Cgroups are required for derivations that require the
`uid-range` system feature.

* `nix build --json` now prints some statistics about top-level
derivations, such as CPU statistics when cgroups are enabled.
7 changes: 6 additions & 1 deletion src/libstore/build/local-derivation-goal.cc
Original file line number Diff line number Diff line change
Expand Up @@ -401,9 +401,14 @@ static void linkOrCopy(const Path & from, const Path & to)
void LocalDerivationGoal::startBuilder()
{
if ((buildUser && buildUser->getUIDCount() != 1)
|| settings.isExperimentalFeatureEnabled(Xp::Cgroups))
#if __linux__
|| settings.useCgroups
#endif
)
{
#if __linux__
settings.requireExperimentalFeature(Xp::Cgroups);

auto ourCgroups = getCgroups("/proc/self/cgroup");
auto ourCgroup = ourCgroups[""];
if (ourCgroup == "")
Expand Down
23 changes: 17 additions & 6 deletions src/libstore/globals.hh
Original file line number Diff line number Diff line change
Expand Up @@ -304,6 +304,17 @@ public:
"id-count",
"The number of UIDs/GIDs to use for dynamic ID allocation."};

#if __linux__
Setting<bool> useCgroups{

This comment has been minimized.

Copy link
@rickynils

rickynils Nov 28, 2022

Member

It is not clear from this description if I need to turn on use-groups in order to be able to build uid-range derivations, or if that happens automatically.

this, false, "use-cgroups",
R"(
Whether to execute builds inside cgroups. Cgroups are
enabled automatically for derivations that require the
`uid-range` system feature.
)"
};
#endif

Setting<bool> impersonateLinux26{this, false, "impersonate-linux-26",
"Whether to impersonate a Linux 2.6 machine on newer kernels.",
{"build-impersonate-linux-26"}};
Expand Down Expand Up @@ -592,10 +603,10 @@ public:
cache) must have a signature by a trusted key. A trusted key is one
listed in `trusted-public-keys`, or a public key counterpart to a
private key stored in a file listed in `secret-key-files`.
Set to `false` to disable signature checking and trust all
non-content-addressed paths unconditionally.
(Content-addressed paths are inherently trustworthy and thus
unaffected by this configuration option.)
)"};
Expand Down Expand Up @@ -681,7 +692,7 @@ public:
is `root`.
> **Warning**
>
>
> Adding a user to `trusted-users` is essentially equivalent to
> giving that user root access to the system. For example, the user
> can set `sandbox-paths` and thereby obtain read access to
Expand Down Expand Up @@ -771,13 +782,13 @@ public:
The program executes with no arguments. The program's environment
contains the following environment variables:
- `DRV_PATH`
- `DRV_PATH`
The derivation for the built paths.
Example:
`/nix/store/5nihn1a7pa8b25l9zafqaqibznlvvp3f-bash-4.4-p23.drv`
- `OUT_PATHS`
- `OUT_PATHS`
Output paths of the built derivation, separated by a space
character.
Expand Down Expand Up @@ -815,7 +826,7 @@ public:
documentation](https://ec.haxx.se/usingcurl-netrc.html).
> **Note**
>
>
> This must be an absolute path, and `~` is not resolved. For
> example, `~/.netrc` won't resolve to your home directory's
> `.netrc`.
Expand Down
2 changes: 1 addition & 1 deletion tests/containers.nix
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ makeTest ({
nix.binaryCaches = lib.mkForce [ ];
nix.extraOptions =
''
extra-experimental-features = nix-command auto-allocate-uids
extra-experimental-features = nix-command auto-allocate-uids cgroups
extra-system-features = uid-range
'';
nix.nixPath = [ "nixpkgs=${nixpkgs}" ];
Expand Down

0 comments on commit 67bcb99

Please sign in to comment.