Container fails to run with memory limit

[dtchanpura]

When adding -m or --memory as limit to podman run command it fails with following error.

# podman run --rm -it --memory 1g alpine sh
Error: could not find cgroup mount in "/proc/self/cgroup"

I tried to check the mount and that was available.

# mount | grep cgroup
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,relatime)

I also tried adding options like nsdelegate and memory_recursiveprot, but it had the same issue.

# mount | grep cgroup
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,relatime,nsdelegate,memory_recursiveprot)

[stapelberg]

Looks like podman expects cgroups to be set up on the system, and we don’t currently do that yet: containers/podman#14236 (comment)

Not entirely sure what the minimum steps are to fix this. Contributions welcome :)

[dtchanpura]

Thanks for the reference, I will try something and if it works will share the updates here.

[dtchanpura]

The steps mentioned in the referenced issue works. I used the same code as mentioned in https://gokrazy.org/packages/docker-containers/ and added a function setCgroups() which initializes the current process to use a common cgroups.

const (
	CgroupPath = "/sys/fs/cgroup/podman_containers"
)

func setCgroups() error {
	// create a cgroups path
	if err := os.MkdirAll(CgroupsPath, 0755); err != nil {
		return err
	}

	// set current process pid in that cgroup.procs
	if err := os.WriteFile(filepath.Join(CgroupsPath, "cgroup.procs"), []byte(strconv.Itoa(os.Getpid())), 0644); err != nil {
		return err
	}

	return nil
}

func irssi() error {
	// Ensure we have an up-to-date clock, which in turn also means that
	// networking is up. This is relevant because podman takes what’s in
	// /etc/resolv.conf (nothing at boot) and holds on to it, meaning your
	// container will never have working networking if it starts too early.
	gokrazy.WaitForClock()

	if err := mountVar(); err != nil {
		return err
	}
	
	
	if err := setCgroups(); err != nil {
		return err
	}
	
	// ...
}

[stapelberg]

It sounds to me like commits containers/podman@94e8212 and/or containers/podman@bd51410 will fix this without requiring changes from our end, but are not yet in a tagged podman release.

[stapelberg]

gokrazy/podman is now updated to v4.2.1, which contains the fixes. For me, podman run --rm -it --memory 1g alpine sh now results in a working container.