-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Podman pod create --share-parent vs --share=cgroup #12930
Conversation
All kinds of test redness @cdoern |
the failures seem to be coming from the mixture of --share=cgroup and --share-parent should these be mutually exclusive @mheon? that would mean we remove cgroup from the |
649a394
to
679d95b
Compare
That's Conmon failing - potentially segfaulting? We'd need to look in syslog to figure out the details, that's the only place it logs to (and then, only with |
7495ef1
to
98114ce
Compare
So the issue is that we can't read from the conmon pidfile, it is returning -1 rather than the conmon pid I am unsure why as I cannot reproduce this locally, could it be the testing suite @mheon ? |
@cdoern Is this something we need to get into podman 4.0, or can it wait for podman 4.1? |
Ideally 4.0 since this could theoretically be viewed as a breaking change. |
@giuseppe @mheon I have been racking my brain trying to figure out why this is blowing up. My only thought left is this scenario of sharing the cgroupNS in a pod (since it has never actually happened) breaks something unnecessarily within conmon. Either that or within podman libpod/container_validate.go we need some other stipulation about pid namespaces and cgroup namespaces if coming from a pod. |
@giuseppe PTAL |
d470cbd
to
f6eedc1
Compare
I am putting a bunch of debugs on where I think this is failing to try and figure out why, this is not reproducible for me, @giuseppe does this happen on your machine? |
@giuseppe I think this portion is the issue but I am unfamiliar with how these pipes work... https://github.com/containers/podman/blob/f6eedc1fe86090a9e388e1ac8e962dcb4e09d4eb/libpod/oci_conmon_linux.go#L1585-L1598 could this all be because of |
please drop the debugging statements and the If I run locally, it fails here:
Both Since the second check expects |
@giuseppe I am talking about this: https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/5437340771418112/html/int-podman-fedora-34-rootless-host.log.html#t--podman-pod-create-share-parent-test--3 failure. The syslogs are in because all I was seeing before was |
I think fedora-34 is configured with cgroup v1, and rootless cannot use cgroups with cgroup v1. I think you just need to skip the test when it is rootless on cgroupv1 ( |
ok thanks @giuseppe that makes sense, I will fix the other test now and remove all of the debugs. |
9602945
to
a46a8b9
Compare
separated cgroupNS sharing from setting the pod as the cgroup parent, made a new flag --share-parent which sets the pod as the cgroup parent for all containers entering the pod remove cgroup from the default kernel namespaces since we want the same default behavior as before which is just the cgroup parent. resolves containers#12765 Signed-off-by: cdoern <[email protected]> Signed-off-by: cdoern <[email protected]> Signed-off-by: cdoern <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: cdoern, giuseppe The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/lgtm |
separated cgroupNS sharing from setting the pod as the cgroup parent,
made a new flag --share-parent which sets the pod as the cgroup parent for all
containers entering the pod
resolves #12765
Signed-off-by: cdoern [email protected]