Support Docker Pids Limit

client/driver/docker_linux_test.go

@@ -5,8 +5,11 @@ import (
 	"io/ioutil"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
+	tu "github.com/hashicorp/nomad/testutil"
 	"github.com/stretchr/testify/require"
 )
 
@@ -39,3 +42,57 @@ func TestDockerDriver_authFromHelper(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, []byte("https://registry.local:5000"), content)
 }
+
+func TestDockerDriver_PidsLimit(t *testing.T) {
+	if !tu.IsTravis() {
+		t.Parallel()
+	}
+	if !testutil.DockerIsConnected(t) {
+		t.Skip("Docker not connected")
+	}
+
+	task, _, _ := dockerTask(t)
+	task.Config["pids_limit"] = "1"
+	task.Config["command"] = "/bin/sh"
+	task.Config["args"] = []string{"-c", "sleep 2 & sleep 2"}
+
+	ctx := testDockerDriverContexts(t, task)
+	defer ctx.AllocDir.Destroy()
+	d := NewDockerDriver(ctx.DriverCtx)
+
+	// Copy the image into the task's directory
+	copyImage(t, ctx.ExecCtx.TaskDir, "busybox.tar")
+
+	_, err := d.Prestart(ctx.ExecCtx, task)
+	if err != nil {
+		t.Fatalf("error in prestart: %v", err)
+	}
+	resp, err := d.Start(ctx.ExecCtx, task)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	defer resp.Handle.Kill()
+
+	select {
+	case res := <-resp.Handle.WaitCh():
+		if res.Successful() {
+			t.Fatalf("expected error, but container exited successful")
+		}
+	case <-time.After(time.Duration(tu.TestMultiplier()*5) * time.Second):
+		t.Fatalf("timeout")
+	}
+
+	// XXX Logging doesn't work on OSX so just test on Linux
+	// Check that data was written to the directory.
+	outputFile := filepath.Join(ctx.ExecCtx.TaskDir.LogDir, "redis-demo.stderr.0")
+	act, err := ioutil.ReadFile(outputFile)
+	if err != nil {
+		t.Fatalf("Couldn't read expected output: %v", err)
+	}
+
+	exp := "can't fork"
+	if !strings.Contains(string(act), exp) {
+		t.Fatalf("Expected failed fork: %q", act)
+	}
+
+}

website/source/docs/drivers/docker.html.md

@@ -368,6 +368,9 @@ The `docker` driver supports the following configuration in the job spec.  Only
 * `readonly_rootfs` - (Optional) `true` or `false` (default). Mount
   the container's filesystem as read only.
 
+* `pids_limit` - (Optional) An integer value that specifies the pid limit for
+  the container. Defaults to unlimited.
+
 ### Container Name
 
 Nomad creates a container after pulling an image. Containers are named