From 031fcb31d3a81fbd5c5ab8d898d53fbd486413e6 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Wed, 9 Apr 2014 11:43:19 +0000 Subject: [PATCH 1/3] Setup cgroups for all subsystems Fixes #5117 Fixes #5118 Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- integration-cli/docker_cli_top_test.go | 28 ++++++++++++++++++-- pkg/cgroups/apply_raw.go | 36 ++++++++++++++------------ 2 files changed, 45 insertions(+), 19 deletions(-) diff --git a/integration-cli/docker_cli_top_test.go b/integration-cli/docker_cli_top_test.go index 73d590cf06..d75ec54217 100644 --- a/integration-cli/docker_cli_top_test.go +++ b/integration-cli/docker_cli_top_test.go @@ -7,7 +7,7 @@ import ( "testing" ) -func TestTop(t *testing.T) { +func TestTopNonPrivileged(t *testing.T) { runCmd := exec.Command(dockerBinary, "run", "-i", "-d", "busybox", "sleep", "20") out, _, err := runCommandWithOutput(runCmd) errorOut(err, t, fmt.Sprintf("failed to start the container: %v", err)) @@ -28,5 +28,29 @@ func TestTop(t *testing.T) { t.Fatal("top should've listed sleep 20 in the process list") } - logDone("top - sleep process should be listed") + logDone("top - sleep process should be listed in non privileged mode") +} + +func TestTopPrivileged(t *testing.T) { + runCmd := exec.Command(dockerBinary, "run", "--privileged", "-i", "-d", "busybox", "sleep", "20") + out, _, err := runCommandWithOutput(runCmd) + errorOut(err, t, fmt.Sprintf("failed to start the container: %v", err)) + + cleanedContainerID := stripTrailingCharacters(out) + + topCmd := exec.Command(dockerBinary, "top", cleanedContainerID) + out, _, err = runCommandWithOutput(topCmd) + errorOut(err, t, fmt.Sprintf("failed to run top: %v %v", out, err)) + + killCmd := exec.Command(dockerBinary, "kill", cleanedContainerID) + _, err = runCommand(killCmd) + errorOut(err, t, fmt.Sprintf("failed to kill container: %v", err)) + + deleteContainer(cleanedContainerID) + + if !strings.Contains(out, "sleep 20") { + t.Fatal("top should've listed sleep 20 in the process list") + } + + logDone("top - sleep process should be listed in privileged mode") } diff --git a/pkg/cgroups/apply_raw.go b/pkg/cgroups/apply_raw.go index 220f08f1dc..f4fea133c5 100644 --- a/pkg/cgroups/apply_raw.go +++ b/pkg/cgroups/apply_raw.go @@ -78,17 +78,17 @@ func (raw *rawCgroup) join(subsystem string, pid int) (string, error) { } func (raw *rawCgroup) setupDevices(c *Cgroup, pid int) (err error) { - if !c.DeviceAccess { - dir, err := raw.join("devices", pid) + dir, err := raw.join("devices", pid) + if err != nil { + return err + } + defer func() { if err != nil { - return err + os.RemoveAll(dir) } + }() - defer func() { - if err != nil { - os.RemoveAll(dir) - } - }() + if !c.DeviceAccess { if err := writeFile(dir, "devices.deny", "a"); err != nil { return err @@ -132,16 +132,17 @@ func (raw *rawCgroup) setupDevices(c *Cgroup, pid int) (err error) { } func (raw *rawCgroup) setupMemory(c *Cgroup, pid int) (err error) { - if c.Memory != 0 || c.MemorySwap != 0 { - dir, err := raw.join("memory", pid) + dir, err := raw.join("memory", pid) + if err != nil && (c.Memory != 0 || c.MemorySwap != 0) { + return err + } + defer func() { if err != nil { - return err + os.RemoveAll(dir) } - defer func() { - if err != nil { - os.RemoveAll(dir) - } - }() + }() + + if c.Memory != 0 || c.MemorySwap != 0 { if c.Memory != 0 { if err := writeFile(dir, "memory.limit_in_bytes", strconv.FormatInt(c.Memory, 10)); err != nil { @@ -178,9 +179,10 @@ func (raw *rawCgroup) setupCpu(c *Cgroup, pid int) (err error) { } func (raw *rawCgroup) setupCpuset(c *Cgroup, pid int) (err error) { + // we don't want to join this cgroup unless it is specified if c.CpusetCpus != "" { dir, err := raw.join("cpuset", pid) - if err != nil { + if err != nil && c.CpusetCpus != "" { return err } defer func() { From 505184d2dcb5d21834bcb2b108564fbdab733953 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Fri, 11 Apr 2014 17:27:19 +0000 Subject: [PATCH 2/3] Join cpuacct, freezer, perf_event, and blkio groups Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- pkg/cgroups/apply_raw.go | 54 +++++++++++++++++++++++++++++++--------- 1 file changed, 42 insertions(+), 12 deletions(-) diff --git a/pkg/cgroups/apply_raw.go b/pkg/cgroups/apply_raw.go index f4fea133c5..1700294bea 100644 --- a/pkg/cgroups/apply_raw.go +++ b/pkg/cgroups/apply_raw.go @@ -39,19 +39,21 @@ func rawApply(c *Cgroup, pid int) (ActiveCgroup, error) { root: cgroupRoot, cgroup: cgroup, } + for _, g := range []func(*Cgroup, int) error{ + raw.setupDevices, + raw.setupMemory, + raw.setupCpu, + raw.setupCpuset, + raw.setupCpuacct, + raw.setupBlkio, + raw.setupPerfevent, + raw.setupFreezer, + } { + if err := g(c, pid); err != nil { + return nil, err + } + } - if err := raw.setupDevices(c, pid); err != nil { - return nil, err - } - if err := raw.setupMemory(c, pid); err != nil { - return nil, err - } - if err := raw.setupCpu(c, pid); err != nil { - return nil, err - } - if err := raw.setupCpuset(c, pid); err != nil { - return nil, err - } return raw, nil } @@ -198,6 +200,30 @@ func (raw *rawCgroup) setupCpuset(c *Cgroup, pid int) (err error) { return nil } +func (raw *rawCgroup) setupCpuacct(c *Cgroup, pid int) error { + // we just want to join this group even though we don't set anything + _, err := raw.join("cpuacct", pid) + return err +} + +func (raw *rawCgroup) setupBlkio(c *Cgroup, pid int) error { + // we just want to join this group even though we don't set anything + _, err := raw.join("blkio", pid) + return err +} + +func (raw *rawCgroup) setupPerfevent(c *Cgroup, pid int) error { + // we just want to join this group even though we don't set anything + _, err := raw.join("perf_event", pid) + return err +} + +func (raw *rawCgroup) setupFreezer(c *Cgroup, pid int) error { + // we just want to join this group even though we don't set anything + _, err := raw.join("freezer", pid) + return err +} + func (raw *rawCgroup) Cleanup() error { get := func(subsystem string) string { path, _ := raw.path(subsystem) @@ -209,6 +235,10 @@ func (raw *rawCgroup) Cleanup() error { get("devices"), get("cpu"), get("cpuset"), + get("cpuacct"), + get("blkio"), + get("perf_event"), + get("freezer"), } { if path != "" { os.RemoveAll(path) From 4ddfffcab3edf3d05ee8319e87410fe747979a04 Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Thu, 10 Apr 2014 20:08:56 +0200 Subject: [PATCH 3/3] Join memory and cpu cgroup in systemd too Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: alexlarsson) Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: crosbymichael) --- pkg/cgroups/apply_systemd.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkg/cgroups/apply_systemd.go b/pkg/cgroups/apply_systemd.go index c689d5753e..a9b3a8d301 100644 --- a/pkg/cgroups/apply_systemd.go +++ b/pkg/cgroups/apply_systemd.go @@ -107,6 +107,12 @@ func systemdApply(c *Cgroup, pid int) (ActiveCgroup, error) { })}) } + // Always enable accounting, this gets us the same behaviour as the raw implementation, + // plus the kernel has some problems with joining the memory cgroup at a later time. + properties = append(properties, + systemd1.Property{"MemoryAccounting", dbus.MakeVariant(true)}, + systemd1.Property{"CPUAccounting", dbus.MakeVariant(true)}) + if c.Memory != 0 { properties = append(properties, systemd1.Property{"MemoryLimit", dbus.MakeVariant(uint64(c.Memory))})