Skip to content

Commit

Permalink
dbuild: avoid --pids-limit with podman and cgroupsv1
Browse files Browse the repository at this point in the history
Podman doesn't correctly support --pids-limit with cgroupsv1. Some
versions ignore it, and some versions reject the option.

To avoid the error, don't supply --pids-limit if cgroupsv2 is not
available (detected by its presence in /proc/filesystems). The user
is required to configure the pids limit in
/etc/containers/containers.conf.

Fixes scylladb#7938.
  • Loading branch information
avikivity committed Jan 20, 2021
1 parent 7eb8c71 commit 94b53f9
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion tools/toolchain/dbuild
Original file line number Diff line number Diff line change
Expand Up @@ -146,12 +146,22 @@ if [ -z "$is_podman" ]; then
"${group_args[@]}"
-v /etc/passwd:/etc/passwd:ro
-v /etc/group:/etc/group:ro
--pids-limit -1
)
else
TMP_PASSWD=$(mktemp --tmpdir passwd.XXXXXX)
FULLNAME=$(getent passwd $USER | cut -d ':' -f 5)
echo "$USER:x:0:0:$FULLNAME:$HOME:/bin/bash" > "$TMP_PASSWD"
docker_common_args+=(-v "$TMP_PASSWD:/etc/passwd:ro")
# --pids-limit is not supported on podman with cgroupsv1
if grep -q cgroup2 /proc/filesystems; then
docker_common_args+=(--pids-limit -1)
fi
# if --pids-limit is not supported, add
# [containers]
# pids_limit = 0
#
# to /etc/containers/containers.conf
fi

if [ "$PWD" != "$toplevel" ]; then
Expand All @@ -165,7 +175,6 @@ tmpdir=$(mktemp -d)

docker_common_args+=(
--security-opt seccomp=unconfined \
--pids-limit -1 \
--network host \
--cap-add SYS_PTRACE \
-v "$PWD:$PWD:z" \
Expand Down

0 comments on commit 94b53f9

Please sign in to comment.