Fix jailer --parent-cgroup parameter when no cgroups specified
#4309
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pb8o
force-pushed
the
fix-jailer-parent-cgroup
branch
from
4d8a195
to
3e8b4eb
Compare
pb8o
added
Type: Bug
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #4309 +/- ##
==========================================
- Coverage 81.59% 81.55% -0.04%
==========================================
Files 240 240
Lines 29347 29367 +20
==========================================
+ Hits 23945 23951 +6
- Misses 5402 5416 +14
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
pb8o
force-pushed
the
fix-jailer-parent-cgroup
branch
3 times, most recently
from
3209131
to
c778d9d
Compare
pb8o
added
Status: Awaiting review
JonathanWoollett-Light
previously approved these changes
Dec 11, 2023
|
I realized I should also amend the jailer.md documentation |
pb8o
force-pushed
the
fix-jailer-parent-cgroup
branch
from
c778d9d
to
eb88d9a
Compare
kalyazin
reviewed
Dec 12, 2023
This is to bring clarity while developing a new test. Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
The fixture has information like the cgroups version available on the system and where it is mounted. In addition it has helper functions to create cgroups and move a PID into a cgroup. Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
pb8o
force-pushed
the
fix-jailer-parent-cgroup
branch
from
eb88d9a
to
adc5138
Compare
JonathanWoollett-Light
approved these changes
Dec 13, 2023
xmarcalx
reviewed
Dec 13, 2023
pb8o
added
Priority: High
If we specify `--parent-cgroup` without any `--cgroup` option, the jailer doesn't do anything, though a user specifying it could reasonably expect it to move the process under that cgroup. We could just error in that situation, and expect something else to launch the jailer process in a cgroup, but we risk breaking anybody that is already using it that way. Instead, we move the process to the `--parent-cgroup` since it's the most intuitive, although the specified `--parent-cgroup` is not a parent in that case. Link: firecracker-microvm#4287 Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
Tests that --parent-cgroup without any cgroups moves Firecracker to the cgroup (cgroupsv2 only). Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
pb8o
force-pushed
the
fix-jailer-parent-cgroup
branch
from
adc5138
to
2fd20e4
Compare
kalyazin
approved these changes
Dec 14, 2023
roypat
added a commit
to roypat/firecracker
that referenced
this pull request
Feb 5, 2024
The described issue was fixed by firecracker-microvm#4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
roypat
added a commit
to roypat/firecracker
that referenced
this pull request
Feb 5, 2024
The described issue was fixed by firecracker-microvm#4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
roypat
added a commit
to roypat/firecracker
that referenced
this pull request
Feb 6, 2024
The described issue was fixed by firecracker-microvm#4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
pb8o
pushed a commit
that referenced
this pull request
Feb 12, 2024
The described issue was fixed by #4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
If we specify
--parent-cgroupwithout any--cgroupoption, the jailer doesn't do anything, though a user specifying it could reasonably expect it to move the process under that cgroup.We could just error in that situation, and expect something else to launch the jailer process in a cgroup, but we risk breaking anybody that is already using it that way.
Instead, we move the process to the
--parent-cgroupsince it's the most intuitive, although the specified--parent-cgroupis not a parent in that case.Closes: #4287
Reason
...
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following
Developer Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md.PR Checklist
CHANGELOG.md.TODOs link to an issue.rust-vmm.