-
Notifications
You must be signed in to change notification settings - Fork 1.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix jailer --parent-cgroup
parameter when no cgroups specified
#4309
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4d8a195
to
3e8b4eb
Compare
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## main #4309 +/- ##
==========================================
- Coverage 81.59% 81.55% -0.04%
==========================================
Files 240 240
Lines 29347 29367 +20
==========================================
+ Hits 23945 23951 +6
- Misses 5402 5416 +14
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
3209131
to
c778d9d
Compare
JonathanWoollett-Light
previously approved these changes
Dec 11, 2023
I realized I should also amend the jailer.md documentation |
c778d9d
to
eb88d9a
Compare
kalyazin
reviewed
Dec 12, 2023
This is to bring clarity while developing a new test. Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
The fixture has information like the cgroups version available on the system and where it is mounted. In addition it has helper functions to create cgroups and move a PID into a cgroup. Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
eb88d9a
to
adc5138
Compare
JonathanWoollett-Light
approved these changes
Dec 13, 2023
xmarcalx
reviewed
Dec 13, 2023
If we specify `--parent-cgroup` without any `--cgroup` option, the jailer doesn't do anything, though a user specifying it could reasonably expect it to move the process under that cgroup. We could just error in that situation, and expect something else to launch the jailer process in a cgroup, but we risk breaking anybody that is already using it that way. Instead, we move the process to the `--parent-cgroup` since it's the most intuitive, although the specified `--parent-cgroup` is not a parent in that case. Link: firecracker-microvm#4287 Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
Tests that --parent-cgroup without any cgroups moves Firecracker to the cgroup (cgroupsv2 only). Signed-off-by: Pablo Barbáchano <pablob@amazon.com>
adc5138
to
2fd20e4
Compare
kalyazin
approved these changes
Dec 14, 2023
roypat
added a commit
to roypat/firecracker
that referenced
this pull request
Feb 5, 2024
The described issue was fixed by firecracker-microvm#4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
roypat
added a commit
to roypat/firecracker
that referenced
this pull request
Feb 5, 2024
The described issue was fixed by firecracker-microvm#4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
roypat
added a commit
to roypat/firecracker
that referenced
this pull request
Feb 6, 2024
The described issue was fixed by firecracker-microvm#4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
pb8o
pushed a commit
that referenced
this pull request
Feb 12, 2024
The described issue was fixed by #4309. Signed-off-by: Patrick Roy <roypat@amazon.co.uk>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Priority: High
Indicates than an issue or pull request should be resolved ahead of issues or pull requests labelled
Status: Awaiting review
Indicates that a pull request is ready to be reviewed
Type: Enhancement
Indicates new feature requests
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
If we specify
--parent-cgroup
without any--cgroup
option, the jailer doesn't do anything, though a user specifying it could reasonably expect it to move the process under that cgroup.We could just error in that situation, and expect something else to launch the jailer process in a cgroup, but we risk breaking anybody that is already using it that way.
Instead, we move the process to the
--parent-cgroup
since it's the most intuitive, although the specified--parent-cgroup
is not a parent in that case.Closes: #4287
Reason
...
License Acceptance
By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache 2.0 license. For more information on following
Developer Certificate of Origin and signing off your commits, please check
CONTRIBUTING.md
.PR Checklist
CHANGELOG.md
.TODO
s link to an issue.rust-vmm
.