Skip to content

Commit

Permalink
libct: clean cached rlimit nofile in go runtime
Browse files Browse the repository at this point in the history
As reported in issue opencontainers#4195, the new version(since 1.19) of go runtime
will cache rlimit-nofile. Before executing execve, the rlimit-nofile
of the process will be restored with the cache. In runc, this will
cause the rlimit-nofile set by the parent process for the container
to become invalid. It can be solved by clearing the cache.

Signed-off-by: ls-ggg <[email protected]>
(cherry picked from commit f9f8abf)
Signed-off-by: lifubang <[email protected]>
(cherry picked from commit da68c8e)
Signed-off-by: lifubang <[email protected]>
  • Loading branch information
ls-ggg authored and lifubang committed May 10, 2024
1 parent ebc0f65 commit 6b26e7e
Show file tree
Hide file tree
Showing 4 changed files with 47 additions and 0 deletions.
16 changes: 16 additions & 0 deletions libcontainer/init_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,13 @@ func newContainerInit(t initType, pipe *os.File, consoleSocket *os.File, fifoFd,
if err := populateProcessEnvironment(config.Env); err != nil {
return nil, err
}

// Clean the RLIMIT_NOFILE cache in go runtime.
// Issue: https://github.com/opencontainers/runc/issues/4195
if containsRlimit(config.Rlimits, unix.RLIMIT_NOFILE) {
system.ClearRlimitNofileCache()
}

switch t {
case initSetns:
// mountFds must be nil in this case. We don't mount while doing runc exec.
Expand Down Expand Up @@ -518,6 +525,15 @@ func setupRoute(config *configs.Config) error {
return nil
}

func containsRlimit(limits []configs.Rlimit, resource int) bool {
for _, rlimit := range limits {
if rlimit.Type == resource {
return true
}
}
return false
}

func setupRlimits(limits []configs.Rlimit, pid int) error {
for _, rlimit := range limits {
if err := unix.Prlimit(pid, rlimit.Type, &unix.Rlimit{Max: rlimit.Hard, Cur: rlimit.Soft}, nil); err != nil {
Expand Down
1 change: 1 addition & 0 deletions libcontainer/setns_init_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ func (l *linuxSetnsInit) Init() error {
}
}
}

if l.config.CreateConsole {
if err := setupConsole(l.consoleSocket, l.config, false); err != nil {
return err
Expand Down
24 changes: 24 additions & 0 deletions libcontainer/system/rlimit_go119.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
//go:build go1.19

package system

import (
"sync/atomic"
"syscall"

_ "unsafe" // for go:linkname
)

//go:linkname syscallOrigRlimitNofile syscall.origRlimitNofile
var syscallOrigRlimitNofile atomic.Pointer[syscall.Rlimit]

// As reported in issue #4195, the new version of go runtime(since 1.19)
// will cache rlimit-nofile. Before executing execve, the rlimit-nofile
// of the process will be restored with the cache. In runc, this will
// cause the rlimit-nofile setting by the parent process for the container
// to become invalid. It can be solved by clearing this cache. But
// unfortunately, go stdlib doesn't provide such function, so we need to
// link to the private var `origRlimitNofile` in package syscall to hack.
func ClearRlimitNofileCache() {
syscallOrigRlimitNofile.Store(nil)
}
6 changes: 6 additions & 0 deletions libcontainer/system/rlimit_stub.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
//go:build !go1.19

package system

func ClearRlimitNofileCache() {
}

0 comments on commit 6b26e7e

Please sign in to comment.